{ "Event": { "published": true, "date": "2021-12-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-12-18", "timestamp": 1639872182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "24255dbe-80ee-47f2-87f9-30d1e0546fed", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f77872-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639844091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844091, "uuid": "1063e7df-1f34-4e19-9d33-7759b005184c", "comment": "Malware payload (Mirai)", "value": "81dbd92cd070728b54c70913f84dd06f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844091, "uuid": "74dd010b-e4bd-41a7-b07d-d039b10b9539", "comment": "Malware payload (Mirai)", "value": "027950d552caf243f5ceb99ea96ef91ceb1406a016c7c7015b6de38b4628f5c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844091, "uuid": "35476f2e-9086-493f-b6d9-7e8988d54ec6", "comment": "Malware payload (Mirai)", "value": "b9585783f36b84e20034ff8df8c13acc130471a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844091, "uuid": "7d0475a2-972f-45eb-83ee-bf4649f1c571", "comment": "Malware payload (Mirai)", "value": "d9ae017cfb8e8b49e981c91c979359ac4a5bcb30cb19606dba8ba62f1d493cb9a38da30428c6a55820d7e246a8c7dc24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844091, "uuid": "ab4ccef9-c260-4b20-b0b4-4d0765b8143f", "value": "T131D2E1A43FCB6A62D7F844F4DD0D86C6175306B86AB233725A002B9853D0CA5BF3CB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844091, "uuid": "51215809-9a48-4c0c-8fad-9cf29925f072", "value": "768:X/0K3nwOPE/MD8ec62hpZlQw743f22YZ/IkEs3UozO:XMKXwOFVo4w743eZ/1zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844091, "uuid": "eb9ef02f-91bd-40a5-b104-658d80798e9b", "value": 31100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844091, "uuid": "b67d62b2-be55-4e52-9688-71b983e28925", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844091, "uuid": "0b8e2f61-aad0-433a-834d-f811eb150291", "value": "81dbd92cd070728b54c70913f84dd06f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa170af-6032-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639852920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639852920, "uuid": "d6e45d12-dbe8-46c5-87cf-8335c27cf16c", "comment": "Malware payload (RedLineStealer)", "value": "eb677ab20771eb365046cc231cd15bda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639852920, "uuid": "0264da21-d499-49ef-937b-b4ce8a5cb1db", "comment": "Malware payload (RedLineStealer)", "value": "0424eadf0dbf331e3ff48bbe6224001722d0ddcd65d18958533e6c27bb832c5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639852920, "uuid": "f1b74778-aa3e-4f58-a112-83f31dab23fe", "comment": "Malware payload (RedLineStealer)", "value": "5e9871216f52dd9e4e24a61d61bdee932bc36b61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639852920, "uuid": "f7cf1c01-5de9-42dc-9ebd-a452ab3456fb", "comment": "Malware payload (RedLineStealer)", "value": "130cb9bead148170e79df51ca5af12521850edbaade389f4260f46a8f8a9fdbf14d53d80a170aafd9461f53b33a7e8dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639852920, "uuid": "2dd5b1b3-0b36-40ca-b696-183d308be764", "value": "T1B484D000B7E0D034F1B752F44DB6D3AC7A3E79A26B24A4CB22D516EA5A746E0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639852920, "uuid": "4e98c142-2d42-42b9-9dc6-4e43a0c32a67", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639852920, "uuid": "9efdd296-5c7c-4fc6-8bf3-a5d8d57c9de2", "value": "6144:KzshTve85lg2KTzLkvdq0nTUZKz9tyR4kS3K9RKElse+zTMwnqXOjhiEjrFPxoxB:P56uq0nAutyR0K9RK0se+X9PjrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639852920, "uuid": "46cfb2bd-4676-427d-b7f0-37332872d3d0", "value": 406600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639852920, "uuid": "0578f199-a6bb-4af1-891c-10ed7a0d906b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639852920, "uuid": "d580971e-abd8-49ea-8fe3-df0d837ae1a6", "value": "eb677ab20771eb365046cc231cd15bda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24313752-5fcb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639808663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808663, "uuid": "30c6e241-ce7f-4ef0-a9e7-075af102ee5c", "comment": "Malware payload (Mirai)", "value": "5faf021ea2b23c515db636983ea7d335", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808663, "uuid": "b6aaf69a-2d25-4147-96e7-f064751bb8d5", "comment": "Malware payload (Mirai)", "value": "054909b9a07e41b598bdf8fa817b6ba97052396c923b93d14552c86c9ad1754e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808663, "uuid": "bb8eb1e3-6af8-47a1-a80d-b74c788ffd17", "comment": "Malware payload (Mirai)", "value": "a97352324403e792d52996b65bec445b1eaba65b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808663, "uuid": "47108297-b1f9-4754-a49c-7f59fb232477", "comment": "Malware payload (Mirai)", "value": "cd5a708a162a3010a800fde395290e37c66a6a9df73650604e7e33134440f9c61ca9b425ab14bf2a990d94feda2f5086", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639808663, "uuid": "08604d36-e8d5-4e20-bd51-454181b89605", "value": "T19B041909D6408B17C1E2277AFB9B434B33239B94A797332656285FF03FC27A95E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639808663, "uuid": "348beae3-df72-498b-8f30-31ecd8734c05", "value": "3072:P6wTYgF36p+sMpe+q34waNNKmXJFYK/NM+rlKT+5hb22INSM/9BMymowhbRWz3J:PO+rwaNNKm5FYvcll5hb22IkM/93mow0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639808663, "uuid": "1eb3258c-eb4a-437f-8b90-d24b2bb11a14", "value": 179628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639808663, "uuid": "7d656714-68d0-404f-a6b6-ebac7cd114dd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639808663, "uuid": "e6fa71c7-23d0-481c-a325-7c5d4476cb14", "value": "ill.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4d935b-5fd7-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639813860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813860, "uuid": "353c2d35-2f75-4209-a4dd-0bd227948b06", "comment": "Malware payload (CoinMiner)", "value": "7c1385cdfdd131225d182c6886848036", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813860, "uuid": "bf5ccd22-86be-42fe-a5b3-577f1fe36127", "comment": "Malware payload (CoinMiner)", "value": "054db71cd59068690009183dc807efaf1f2ddb6e1d14ef680ab786460094fabf", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813860, "uuid": "ab143a09-4552-4869-b448-0ddc2534e7de", "comment": "Malware payload (CoinMiner)", "value": "5a403a70fcfa04d867ffef2215227ec210f31f57", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813860, "uuid": "a73718e7-9d18-430c-b1dc-286d0609e6c1", "comment": "Malware payload (CoinMiner)", "value": "56b449b1ebd94586eefba08b9f2425b37ae258c3d06923e6dc1eeda7a4da239f0b66ba598279603c90e2704ce3a303b2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813860, "uuid": "b470492a-4542-44d7-94dd-29479e44982f", "value": "T1D5649E00B7E0D435F1B752F449BAD3ADA53EBAA15B2591CB52D826EE07386E0EC71307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813860, "uuid": "d20b1c60-0de2-427a-b3bf-57ebf10b083a", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813860, "uuid": "99fe1cb2-30ec-4d69-9f52-d466de58a466", "value": "6144:Ho7Tw7ugNkqtCIY8gm271wD+OG/hMSoBiwln:0EnU8gn71wD+OWMSoBiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639813860, "uuid": "1aeaf251-fd52-42c0-ae35-b5877cc10fbb", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639813860, "uuid": "a170fbeb-cabc-4a7c-9558-37abcbb39968", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813860, "uuid": "a4038fba-904a-4ba1-bc9a-acc4906e7c8f", "value": "7c1385cdfdd131225d182c6886848036.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623c43a1-5fdf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639817357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817357, "uuid": "e233421f-8e0d-4450-aab4-5cc66ef3c8e0", "comment": "Malware payload", "value": "7dadcfafedb0e8e781c98671a83faceb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817357, "uuid": "8c1f1d0f-2aa0-4cfe-aa2a-4a48c487360f", "comment": "Malware payload", "value": "06405be32f9c0adf2fd806d974f29483158874f3afccfcb5cd64a64be4c556e2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817357, "uuid": "b815d5de-0fa2-4703-be3f-2d029f904882", "comment": "Malware payload", "value": "c6c298e5d3706cbaf5b2336e58f3adc09b436dcf", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817357, "uuid": "520f693b-00c1-41fe-b81f-4a1c347c0682", "comment": "Malware payload", "value": "40c316c2299dca4767c4246b759ef243fc000130b04dcb7729f3bfc318d4d6f40eabc53f22cd51ba0a18089896b150ff", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817357, "uuid": "832f4cd7-b3e4-412e-87b3-7446b9d028de", "value": "T1724123F51133C8C6221D05870DA4753ECF4CE297635BAE19EE5E68147F8D8B6B4D0368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817357, "uuid": "813b557f-b111-426d-9d1d-8c4c0285d10d", "value": "48:SMhZ2rX0Cp50riBREYX0yW6eRW5BtU8T0vEZb5:SEZGhdT0u5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817357, "uuid": "5aa7e71b-f95b-414d-9fdd-556f1b90f841", "value": 2107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817357, "uuid": "7490bbc2-9d29-4964-8c95-a89d87c35680", "value": "application/csv", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817357, "uuid": "8f4b110b-6e21-41f6-9af4-d4b8a974ac90", "value": "QWVOP821HKUOPL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e4f21d-600c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639836937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836937, "uuid": "7551ea08-30d9-4313-a702-ef125b1610f2", "comment": "Malware payload (RedLineStealer)", "value": "86bc42b4d2467c63976d565bbfec21eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836937, "uuid": "a4e1d90d-2066-46a1-9b20-018b24578060", "comment": "Malware payload (RedLineStealer)", "value": "0766319b5e59356a77cd84ceb1a752b7b39c03a0f978ec5a1d7f59556bf00f42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836937, "uuid": "0dc05c4a-7932-406a-8fcc-60b13da49559", "comment": "Malware payload (RedLineStealer)", "value": "8ef50520c4fea5e8d22ccef0fea6b89bdc7857a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836937, "uuid": "cccbf2a6-be38-4a9a-88b4-d59a6151c6bd", "comment": "Malware payload (RedLineStealer)", "value": "8abedbcb10d71528d867210d33c9081b2bf7ce90ecd49c4d64c5eaff251309bcee14e4ddbbfb60aa529f7a60ad348c40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836937, "uuid": "cff684c1-af39-429c-9a5f-0ba70d896db9", "value": "T12664AE00ABA0D035F5B7A2F459B993BDB53E79A16B74A1CB62D516EE07386E0DC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836937, "uuid": "b78404d8-9744-4ce5-bd28-c6adced2911f", "value": "97510e08b27860260a6b4085182271af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836937, "uuid": "4eab9183-e68b-4a6e-9984-46d279822b85", "value": "6144:O9kRLdfkYlkYWE31jwC17XEV7Q9MGnzARI1enE:nPldl31EC17XEe9MGnzAxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639836937, "uuid": "d00a8c59-2bf2-4e95-8cf5-cb0b52eb7ba3", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639836937, "uuid": "e14ef880-879c-40e3-b921-2218ae8ea395", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836937, "uuid": "816139fd-1fed-40cb-ab96-ce126fa8535f", "value": "86bc42b4d2467c63976d565bbfec21eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334a1bba-6020-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639845195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845195, "uuid": "db035bcb-0fd2-4824-9cde-5837708f6940", "comment": "Malware payload (RedLineStealer)", "value": "e5143cf7bbacb85e29de7655f242b3da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845195, "uuid": "e2fecd53-36d5-4341-9952-17fdfdbf850c", "comment": "Malware payload (RedLineStealer)", "value": "07a70011b8a0b499f6813436837642b01a13ac5638f7189a312f0377ff875668", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845195, "uuid": "3620e26d-c1cf-4993-9e02-b0d74b135db8", "comment": "Malware payload (RedLineStealer)", "value": "cef8aaf48cde28dbe22a111054c09ef4046c0ae2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845195, "uuid": "70b392ef-9317-402a-ad42-4bfd91f81957", "comment": "Malware payload (RedLineStealer)", "value": "93d957dca498350ccec301d82aff2099df5cdf1f47f5c9289ab0d29f1381c70add292273a49c9ffb48e1f1598f75d48c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845195, "uuid": "0ce82831-9410-4fe9-9805-9b04e4082c89", "value": "T1C2963312E9518031E87BBC321B5EEE5069B9D8350F94D98FE3808DDD8F314E097A5BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845195, "uuid": "96752f78-424f-491f-839e-3aa7d0d2356f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845195, "uuid": "3b6fed66-074c-4738-89bf-d4bb003ef5f9", "value": "196608:pGynltq5HBGPbp6Sgha5TPOq3wqlzh3DB8fZH/Sbqc:fjq5hGPbiUpPOq3wqvDpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639845195, "uuid": "127e1d22-3e21-40ad-b06d-9013d39b7392", "value": 9194422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639845195, "uuid": "903b7c6e-a18f-44f1-a621-40b5527961db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845195, "uuid": "f86eb319-986d-44df-b3cd-ae0c3ba31320", "value": "e5143cf7bbacb85e29de7655f242b3da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3568f6-6039-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639855973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639855973, "uuid": "c61bb63a-6f01-418e-9d83-5102d564a6ee", "comment": "Malware payload", "value": "949c76125029cdfc4809a06af3591ddd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639855973, "uuid": "9bea07f4-7d4e-4a94-b7af-e82e69004d44", "comment": "Malware payload", "value": "087b589c9fd7b934fe9c2a7711795165d8022e101983f9654de89c3125715929", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639855973, "uuid": "60940764-c85e-4b03-bf42-9d4563174f0d", "comment": "Malware payload", "value": "6ef0c10b447090ba77a162c17a3f218801173246", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639855973, "uuid": "592e8958-58da-4d55-8f41-0a103ae8af29", "comment": "Malware payload", "value": "7294025e3af0a1c18f1b693c10c9650c535c73fb9e0180fd75db866cb20d01dc9f38d5f9e3f1ef19663a43822f942000", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639855973, "uuid": "280e8374-27c5-4a86-b8f8-52634255cf1d", "value": "T1D6157D8AF6C751F3C8934EB0025BE73F4231AA268017CD96F78DDE15F823E96570A259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639855973, "uuid": "fe94d8ec-ae28-44c7-84e6-4fc8d3ff5709", "value": "12288:/UZssk3AvXrCOHdhA/vsBg4svy+8zC3ltGf2uW9+n2fFf+j9DIhs/:/ussgAvXzHdhW0Bg4Ru3DGfRIucf+R+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639855973, "uuid": "d18d44d4-35d0-42a5-a2fc-cfe66bcb83bc", "value": 949066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639855973, "uuid": "84724045-3951-4a98-9ed8-a666415d992a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639855973, "uuid": "3319a9fa-5bcf-4b3e-ae97-7bebdea1aed7", "value": "949c76125029cdfc4809a06af3591ddd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847d5922-601c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639843613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843613, "uuid": "27131e36-bca5-4864-b35f-e166d11b37ab", "comment": "Malware payload (Mirai)", "value": "42d69f5ac69d524770883b5afabdd19b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843613, "uuid": "60c4a3b9-65c3-485c-a8cf-edc00e09a869", "comment": "Malware payload (Mirai)", "value": "08a7bbd46bbfeae06a9343082405a57952e0404290836058b8409a5302cba4d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843613, "uuid": "f48c03c2-7759-4667-b498-2113a4c080c0", "comment": "Malware payload (Mirai)", "value": "4fc6654a40f4389ce10ba54411e1c0dbd1ed6003", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843613, "uuid": "2f6d35f7-b4fa-4be8-9bf3-b6bf5ea51b9f", "comment": "Malware payload (Mirai)", "value": "4bf6a0563ce8d333be831df8c258db73fc32d663a3bcc9253824b79d28b8ad68c468f41f664195c39cf52e6db8b65238", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843613, "uuid": "c7067574-ca33-414b-9a7f-a63621bef1d2", "value": "T17053AE62C9642C28DA254A747810CA749367F43483972FFAE545C27CC027DEEF1AA3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843613, "uuid": "94ab874e-5189-4caa-97a1-a59d8b9c5eb2", "value": "1536:5aE+4+P+6gId8KxAxliyad35YKF75BkJ3cCHpupyu:5j+4+P+6b8KxArTu5fFQJ3cBEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639843613, "uuid": "b785a47d-9ade-4d1a-ae61-b85a30127acf", "value": 64304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639843613, "uuid": "e0119171-0b18-41ed-b47e-d48d19fb38be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843613, "uuid": "6756748d-4acf-4cb6-b5c6-f3d618dd6d3b", "value": "42d69f5ac69d524770883b5afabdd19b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef13fe9c-5ffb-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639829619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829619, "uuid": "87d6b6da-4c39-489b-86b3-b1c651c57aa0", "comment": "Malware payload (Gafgyt)", "value": "aadf5d8b780789c2c2b13842a4ec8191", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829619, "uuid": "afed68fd-e5b8-4e50-8bcd-d5d2ce9f8a07", "comment": "Malware payload (Gafgyt)", "value": "091aae46818cf112f00a6ee08b6d2e31c544790182fe27fb80afdda682e9721c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829619, "uuid": "ab24bf5e-dc9f-40c8-8c68-cb04b2cc2032", "comment": "Malware payload (Gafgyt)", "value": "8dc95024bb42bc0ee25e2e31485624cd3e300272", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829619, "uuid": "0fef7fc4-9e4d-4b90-9acf-640895b54297", "comment": "Malware payload (Gafgyt)", "value": "d4762e542fe761658e72ff1dc37910f5641d319f22c499aa32053555be4e6daecd8915093bfa248de731d0ec61576dcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829619, "uuid": "8c7a2bc7-3c35-4dd2-8e9b-da2c76a9a4ff", "value": "T1A5B31905F845876BC3D327BAEB8E439D3B36169457D733116A387EB42BC1B982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829619, "uuid": "d736a5c8-570e-45e9-b802-8f6fd9a2541c", "value": "3072:oZBb5xpNqsagbivI5cJmI9rQAhPE4XrGe:WpNnagbivIemI9rQAhPE4XrGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639829619, "uuid": "dfb32939-857d-4e58-b1bb-77f3ec3bd3d5", "value": 112751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639829619, "uuid": "cb0f5481-cc50-49c0-a85b-e7ed636cc43b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829619, "uuid": "f471c8fe-752b-449e-8ad5-986c5efdf300", "value": "aadf5d8b780789c2c2b13842a4ec8191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c6fc2f-600d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639837012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837012, "uuid": "7cba9252-21dd-4519-a7a2-989355dad4d2", "comment": "Malware payload (RedLineStealer)", "value": "de642bc9886e6dda3279515dce2d73f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837012, "uuid": "4bdb8f25-9173-4fd9-88a0-e4e4932a1dd0", "comment": "Malware payload (RedLineStealer)", "value": "0975d7edcc421731d88114abb9777af286de015c522a1a66192d7e55b6496ef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837012, "uuid": "a106f492-2a6c-4a7c-8424-5493b9a21123", "comment": "Malware payload (RedLineStealer)", "value": "f4a6dd1e849aaee74f5828da35d5c4e3a0a07b13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837012, "uuid": "89f43240-60f9-4d33-bac8-d22e19403cc5", "comment": "Malware payload (RedLineStealer)", "value": "82b3d025d5faeba6f0a1ea85ab8ce6f28a4c82286cd549b3557a23e109a92f0e729fb67c74b7f65eafc1c531580385c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837012, "uuid": "b7b46f60-cf16-4781-9564-2ccba47024b0", "value": "T1DB94DF04BBA0D034F5B712F44DB6D3A8753FBAA26B2494CF62D526DA4A346E4DC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837012, "uuid": "96c7262e-48e2-488d-b8de-21b05e007d6d", "value": "cd2e8aca313b88a16bc7b305a3f26143", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837012, "uuid": "7806a28e-7406-4fcc-aabb-6b2c5ddac987", "value": "6144:xe7JNLtZXhjwNjndQBvVDFcK5ykXWxpyk11EcQx06SnBz:oJNLFwhd4VDFrykXWxpyKEcQx07B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639837012, "uuid": "20e46ddc-a5e0-4d15-b5e4-8a6358284233", "value": 419851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639837012, "uuid": "06479047-c71f-4eb8-8329-2d22996dbce9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837012, "uuid": "1479376a-5890-4028-a795-60bf4df6b56f", "value": "de642bc9886e6dda3279515dce2d73f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8900f9cf-601a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639842762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842762, "uuid": "b589fbc7-00a1-4742-aa9c-c3a1b9ad5148", "comment": "Malware payload (Mirai)", "value": "e09ae60382ff391cb794b8e19bf02708", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842762, "uuid": "b9231eb1-fbdf-402b-9dc8-2f1ffad6c4c4", "comment": "Malware payload (Mirai)", "value": "09ad70c868ce0d63b1e5338739e10cdfb9c2373d3d0532c42970744caac4b5d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842762, "uuid": "92bfcaeb-3dad-40b1-9a87-622b0d325712", "comment": "Malware payload (Mirai)", "value": "0c9c8077e8f21a580752da089551651e11ff5438", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842762, "uuid": "3233997e-8135-40b0-a4f1-016681897c8f", "comment": "Malware payload (Mirai)", "value": "bca07e65f0c2b1cc42dd2b56e6a42ac3c7ca128d87efe9db2d96cb36f15bb1f7e0dd9f80ef69279e8ff434708b422f74", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842762, "uuid": "9327fa24-3c2d-452c-8319-35d7c31572c7", "value": "T19FE2F195D1B29786C85D40FF1D3E3986205CDA7D91D01A90FE4C76E7A852F6039343AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842762, "uuid": "dfea16c6-ebe9-4f9b-8ec9-b77b0932d952", "value": "768:4rnwTgp0X0ZILcakR6ENZJSIuGBkWtmy0druflfnbcuyD7Uiyq5:3sp0fLr2TXcIuGjtmy0dSfhnouy8Zq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639842762, "uuid": "5f768c5c-800e-4c59-86e6-7976bd1f1171", "value": 33032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639842762, "uuid": "8f4288a8-519b-4c54-ae7d-651570f4c5b8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842762, "uuid": "35dc6ace-95e1-42b7-a390-e54b6b342f05", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b8791d-604e-11ec-9275-42010a9c0029", "comment": "Malware payload (IRCbot)", "timestamp": 1639865033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639865033, "uuid": "b13508ac-7993-47bd-8a0d-0b103891d2ab", "comment": "Malware payload (IRCbot)", "value": "1f117804c02358083138227c1a2835e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639865033, "uuid": "d89e261b-c752-4afe-be17-b0c18859ef8f", "comment": "Malware payload (IRCbot)", "value": "0bd5383c6c2ab4787567b4baa511640b3ee7f0da25e90055285959d398348992", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639865033, "uuid": "2d385eb4-6066-48ab-a167-fa96412a79ce", "comment": "Malware payload (IRCbot)", "value": "aa6eb70b41fa86639554cca458450f820af44c33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639865033, "uuid": "55ffa494-e9f1-4164-a8f0-bd41b94a960e", "comment": "Malware payload (IRCbot)", "value": "5b01c024be66f5f0bd9a57f014cf26bb94bb6f4852b72d6bf887d4d268d90e5efee22298ca626c2d8bf5276c336fdcfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639865033, "uuid": "a5383891-651f-475c-b186-2ddb4943c2eb", "value": "T127D47D53B682DC36E892077481B247735669FDA09E53DB4BE2C0B62B1DF2DC1B928317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639865033, "uuid": "301f90f3-23b0-4cce-9220-09341bd40574", "value": "21d171d8652b011644031de33568cbcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639865033, "uuid": "4995a39a-ebd0-4681-b5b5-5a38b26300a8", "value": "12288:cmoN+KqH7zak7K0IXMBR6yrD7VORbCV/hWZ:o3i7zakIsR6yroRCV/hWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639865033, "uuid": "58fe4282-bece-4e97-aebf-b6f68f758de8", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639865033, "uuid": "5495d4bd-b0a0-4cfd-bc53-71f4accff0e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639865033, "uuid": "fb171d59-1c75-4ed2-85cd-67bc403a8d82", "value": "1f117804c02358083138227c1a2835e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8620dd-6048-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639862523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639862523, "uuid": "b66deceb-3b96-4db2-bcf2-505f3156f52e", "comment": "Malware payload (njrat)", "value": "77aab511a86f2bbd8770e837bced3f03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639862523, "uuid": "7d07c2e0-758e-47d4-aee5-132db5d6f5ae", "comment": "Malware payload (njrat)", "value": "0c588a633e7979a81579f3317dd735884f660ccc7b78ebf20be8654f2546a915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639862523, "uuid": "750e8efe-0a70-4bdb-8b15-3ba412bd67fa", "comment": "Malware payload (njrat)", "value": "cf9e07c7543e7aa481fcb0d1c2544967f6b0ed94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639862523, "uuid": "845f9217-5381-40b5-b3ff-7871a16c5673", "comment": "Malware payload (njrat)", "value": "280081b51bbf1621dd6d61f23ec70f9e5f886890d1dbcc7a607504864bfa7fa5b276c0caef90024b3fd4bb31dc445614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639862523, "uuid": "c7186c50-3008-4594-98dd-449941475506", "value": "T1B913E74CB694E175D5FF8BF1B4A2B2890B71A01BA902D30F99F114D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639862523, "uuid": "4d0071f6-da47-461c-b443-29c262217e31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639862523, "uuid": "d8fa122d-5ba8-4304-b53b-950f9eb40ad7", "value": "384:BZyxzE1STss7yKSDzGS+qE1rpS2dzsIij+ZsNO3PlpJKkkjh/TzF7pWns/greT0k:Tuok4smKSPGhrrkYuXQ/oN3+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639862523, "uuid": "c18c3817-2f4f-4623-afba-9729aa2d6ce7", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639862523, "uuid": "edda87c0-8e75-4348-82d2-dbd8590de30a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639862523, "uuid": "e523f600-9b75-4d49-8aae-160eaa9950bf", "value": "0C588A633E7979A81579F3317DD735884F660CCC7B78E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e09a8d5-604e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639865024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639865024, "uuid": "585bfb04-5709-46c6-a288-277a053a069e", "comment": "Malware payload", "value": "c05f6c7c90925358865e591e13b7647a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639865024, "uuid": "8e824030-3673-4c9c-b35a-dddc08e4f706", "comment": "Malware payload", "value": "0db6c2a5f841c34c9ae8974c40c6f9509276ac21367072d3b2f944bf9a21cb36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639865024, "uuid": "afd684c8-0a6d-439c-a67e-9a3f72e742c5", "comment": "Malware payload", "value": "78da51e0c9e5d71a0fb30b45ee173421bbea0a7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639865024, "uuid": "8fcfb277-93b2-411b-b856-17e22e422a1e", "comment": "Malware payload", "value": "b418f34480fd183ca90bd47d7ec4e7d1429a666f23043dd9fbc88eebac0c04a8fe01834fb1e93db754e3211a82517d1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639865024, "uuid": "28bdf372-8a81-4ac0-a935-ff03b1b14d3e", "value": "T18CD47D53B682DC36E892077481B247735669FDA09E53DB4BE2C0B62B1DF2DC1B928317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639865024, "uuid": "25b25b56-8316-43fd-90a1-c8004b078145", "value": "21d171d8652b011644031de33568cbcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639865024, "uuid": "9e485a8b-d0a6-48cd-9cb0-8ee54a62c6d9", "value": "12288:cmov+KqH7zak7K0IXMBR6yrD7VORbCV/hWy:opi7zakIsR6yroRCV/hWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639865024, "uuid": "068dae05-f6ee-4574-9b84-5ea53486505b", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639865024, "uuid": "31a96ed3-097f-4e77-8237-79e4e9d2fa00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639865024, "uuid": "b6e9dc6f-85bc-4a0c-953d-336e9f64e699", "value": "c05f6c7c90925358865e591e13b7647a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be44dd8-5fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639803602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803602, "uuid": "9b6f9e5c-d045-4cd3-a9a5-1c228f3f480e", "comment": "Malware payload (Mirai)", "value": "a282c84446d15b005aef0818a28c5337", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803602, "uuid": "65e25a11-26f5-45d7-8daa-edad6f6500b0", "comment": "Malware payload (Mirai)", "value": "0dd7e73d435767f53a288a54c9893adaa3e6bf09337e25b5e83a8606f8ebcc2c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803602, "uuid": "55bf3c6d-253d-4e40-bd01-2b20b9c1c0a4", "comment": "Malware payload (Mirai)", "value": "b72de745a153302e51c60f2600535de30847637e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803602, "uuid": "67f99e36-1efa-4e70-aa50-c53ce8fe6d3b", "comment": "Malware payload (Mirai)", "value": "7ae7652154dcd8c4d79cb56d33ddb08a08527eeebb4bda3dac917dd00be9fcb33a4f44653984c83dc8c0a7b6789a3534", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639803602, "uuid": "ceab2f00-b616-40d4-885e-0089b0fc91dc", "value": "T18EC26C46EF83E0B6FC530579553F53229632E12F1056EBA1E368A535EC93D20672B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639803602, "uuid": "df8e7b0c-5167-4a4c-8f74-94e31fe62703", "value": "768:JomhSuk3nJjMHAzjO/yIdp3p8OJnVjSSI2:ymhSV36Azjiy6p3J7SS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639803602, "uuid": "9ed6e33e-5fe3-4051-bd4a-6fbed6ae03bf", "value": 26420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639803602, "uuid": "4192e06d-15a0-4d93-91e9-4face2081075", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639803602, "uuid": "060952f3-26e3-4874-ae78-09f105b0425d", "value": "beamer.x86-20211218-0500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c129d47f-604c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639864331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864331, "uuid": "97de9d79-a036-4a7e-ad5f-bcab79b5ab8f", "comment": "Malware payload", "value": "ca08fc373f77ff593637a89e77cd17a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864331, "uuid": "e01676f1-43b9-49cd-8bc5-a8417d993ac5", "comment": "Malware payload", "value": "104ff9dc40679ff493ef94c8d76fa23b29bb64a71ca6f8c9cb4240e569b46490", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864331, "uuid": "f4c79bf4-5df6-4ffb-92e7-c51c9c65779c", "comment": "Malware payload", "value": "9378fc0df3a2a1047a809c4ca7d5110ce1d89b3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864331, "uuid": "8a7f2b2b-cabd-45ba-bb02-b99715ec0c5c", "comment": "Malware payload", "value": "780c9812aee6fafa831a70291f7c0143ebe69923fbade49dc0aac94da32aee6008cb69f2dc4453f8d86a158c201771a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864331, "uuid": "77c36b44-4a25-4cb9-b595-96cc1f542aab", "value": "T11A5302A69A483293B737F32CC4768A04BBE7FD74C435E2851B2856199ED4E4A2EE1402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864331, "uuid": "3de117a1-f460-4946-bc78-bdb94a22495a", "value": "1536:grwMgYYs3CWpHErC/Me4Z0cZyYouAO9A1W9Oaqp:0Xghs3CvC0eTceuRZLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639864331, "uuid": "6f927822-61a3-4e1c-83a2-1dcae25cac17", "value": 64192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639864331, "uuid": "565ef8d4-2456-41d3-9848-6ab4aaa6317d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864331, "uuid": "d18378d8-56a8-4ec9-af2a-0f769386d65c", "value": "ca08fc373f77ff593637a89e77cd17a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcd3f75-6026-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639848085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639848085, "uuid": "bd96c8a3-9429-40e2-85aa-51fffe3642f0", "comment": "Malware payload (RedLineStealer)", "value": "444b9678011aabe59672ae6db89eb572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639848085, "uuid": "8737332d-d567-4235-80e2-4a1c39ec0a04", "comment": "Malware payload (RedLineStealer)", "value": "124711820295075b2b23a56f46aa65941cd94b9b592af83f1da26da6af212741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639848085, "uuid": "0703ae55-5186-4915-8059-e9e983087e7f", "comment": "Malware payload (RedLineStealer)", "value": "966c2888de966d38de2e7d74ba7aa4c6945b1473", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639848085, "uuid": "b573ad4a-c4e7-463d-97cb-fc6fd5f431e0", "comment": "Malware payload (RedLineStealer)", "value": "acb62c674bb205b5d6642d04137748e7a6e803707357ff938f57bc86dc54f73cecd01e959c887071192e42210355fc54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639848085, "uuid": "0e4aeeea-a108-4aa8-94bf-d213a5fcca23", "value": "T12884CF00BBE0D035F5B762F44D7693ADA53E7AA16B34A4CB22C026DA57746E0EC7134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639848085, "uuid": "6adcce44-6d8f-4c77-b522-ae30299e8f7e", "value": "fffb3573e6a31c80ef6af28a69351bf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639848085, "uuid": "b492ecc5-b7ba-42eb-98db-6de5de306108", "value": "6144:ibsXkAifDileIs174iSmL+w9gAV38Mv/k+8KEF9qxBZZaD2xRza:8VDile5X6AV38W/k+xzbZZIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639848085, "uuid": "73ef32f6-61e2-4e33-8d61-68c15e290033", "value": 407055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639848085, "uuid": "4183c116-e879-45ea-83fe-afcc9b52cd68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639848085, "uuid": "93ac6b3c-4cd2-4e9d-84fe-39291c774709", "value": "444b9678011aabe59672ae6db89eb572.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2927a90e-6020-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639845178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845178, "uuid": "07ae7a88-fd24-48ab-af16-dcbe76829a47", "comment": "Malware payload (Mirai)", "value": "d0a71cab691710fe843d032f8d7e1a12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845178, "uuid": "76187120-dbf7-4c75-bec4-9d4ec94f7f32", "comment": "Malware payload (Mirai)", "value": "12b415eadf292326de3d4f4431bc5acbff9c4154433cfe5a15023ecb13b0c902", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845178, "uuid": "41ae7c12-5cdf-4be5-a850-870d71e317f5", "comment": "Malware payload (Mirai)", "value": "56760ab16023820f04c2af53ff173cb3f4a0bbe3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845178, "uuid": "6ce35373-0841-4cfc-bd26-2edcadbf3538", "comment": "Malware payload (Mirai)", "value": "466327053a2490e2c97db2461f02ee4565c7d9304168e75012c607776e9efaeaa0270f6c5ecf776c5f7a0eef94d31d81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845178, "uuid": "2f1fbac1-80b7-427e-aa74-a04f3767d99d", "value": "T11E733A32AE651D27C4D4A27A21F78220F2F6531E22B8851E3CB10E9DEF74A4471677B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845178, "uuid": "3a7abb6f-7e7c-4ecb-a8d6-85371f18cbdb", "value": "768:jsnoEjo/rmwLwriLIGlasLHfQ/wck67pzZO+75oG8g2B3+1tOFRmIQ:Qnjjo/CwLyiLAm/BOb75VvtOFRmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639845178, "uuid": "e82300ed-5047-4a82-92b3-670ac0edd4e3", "value": 75152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639845178, "uuid": "2c96cb61-3277-484a-99b3-6187882455b7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845178, "uuid": "78c20a94-f4d9-4285-9b51-c707e665aa89", "value": "d0a71cab691710fe843d032f8d7e1a12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2876cfc-5ff2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639825706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825706, "uuid": "19d40f58-1353-4e98-b8f5-2c9887f635d4", "comment": "Malware payload (AgentTesla)", "value": "7a2af1d11e562464a084f61feba311aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825706, "uuid": "f5ef480a-eb96-492f-957e-878429bd5b09", "comment": "Malware payload (AgentTesla)", "value": "143aac6980db6a14d2b66df0940a2b620942c4729db2f3ae7ec108225691acc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825706, "uuid": "ee8c173c-bcd7-491d-a0a9-32b45954ba18", "comment": "Malware payload (AgentTesla)", "value": "b826f9329479f87448bf35da670e9e9b665d1965", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825706, "uuid": "8e93e48c-cfaf-4004-bb7b-f4d36a121977", "comment": "Malware payload (AgentTesla)", "value": "5534ad1ad57f7884d50dfcb38e361578698b3bdc71eadac715d3501f2e56125a554d8e85b0220c1637a8dee359e89123", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825706, "uuid": "b230eb76-52e8-47b2-82a4-1ec66b4b96be", "value": "T1F3B4129812F4CF5AC0790BFE207462F05BB453627122DE5F6F9A66D78D122CD1B02BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825706, "uuid": "44ad1459-ceb5-4999-9d62-5384d3dd3811", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825706, "uuid": "c626ff99-b229-4015-a63a-e560e98cf7ef", "value": "12288:xrsvcasfnu28cz0nYsAOqiuUuSK3vkmyyy1pWyBtGG:xycl228pYfOqi+SK3vkdFGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639825706, "uuid": "6a8b4e0f-7f8c-479a-84ee-f29eafcbb563", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639825706, "uuid": "f90b6d7f-555b-4426-a11e-63c8c55a14a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825706, "uuid": "fa9fcfce-5480-4522-b80c-9fc27aa64652", "value": "7a2af1d11e562464a084f61feba311aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cff890-6052-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639866681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866681, "uuid": "a8817df3-cbb9-49c0-b763-ff910fe5e979", "comment": "Malware payload (Mirai)", "value": "b7d2e0659de1d41adeddefcc19d96bb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866681, "uuid": "d33c0df1-c5ae-4a87-b290-4976870a57ac", "comment": "Malware payload (Mirai)", "value": "14c313592afe295b1a5b2cbe1864aa8712d6d875008bf74d727c771820c22087", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866681, "uuid": "c04ff87d-9c0d-4601-afd8-91dfd6af08cc", "comment": "Malware payload (Mirai)", "value": "6578bf25b9b0b328922e250cf17bc1d2cfa88465", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866681, "uuid": "43be7397-9d66-47c3-93b1-e5a46471b2d6", "comment": "Malware payload (Mirai)", "value": "ad7875509d1c36de0ae87fb6937175d46575c292a6a0819aa279b6c10aec40bfe0f7fdc52f5f4c45c77eb35c312da7b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866681, "uuid": "bd03b6aa-f5e4-4e7c-bd8e-a12c76bef509", "value": "T16883824A7F614FF7E89FDC3705A92B1224CD651B25A97F35BA30D818F20A24F19E3861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866681, "uuid": "82065125-4018-4976-b4a4-6b0ec79ceaa6", "value": "1536:4tHI0VzfKg4SfYfPuw/uu9PLp98GfjHghP1q5Gpc:2HI0Vz9fYfPZ9mhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639866681, "uuid": "e7d8baeb-28b8-43e7-850f-4d13cab9a6b8", "value": 88736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639866681, "uuid": "83de4ab8-9c6c-4cb4-8eed-5eb8a6060e05", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866681, "uuid": "30dfe8f9-634f-4f77-8ba9-9d6d4253c863", "value": "b7d2e0659de1d41adeddefcc19d96bb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0063098-5fe2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639818803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818803, "uuid": "77701fc6-040d-454a-b7d5-3e56610bfa28", "comment": "Malware payload (RedLineStealer)", "value": "ac1a0a88247ad25a467c366f10176a80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818803, "uuid": "bc2ff561-66dc-417e-b16c-93ec25de3bea", "comment": "Malware payload (RedLineStealer)", "value": "168cf1b514dcd2935f60fd9be6317d2eb3ab32908f3a46d6b7f339109044e8ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818803, "uuid": "a7cb5aad-f090-4fbb-8635-549d3c9c78d0", "comment": "Malware payload (RedLineStealer)", "value": "50afd4371933a158dd0ef30b03800c929534de2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818803, "uuid": "9c575520-a638-4926-af64-915430cc0d92", "comment": "Malware payload (RedLineStealer)", "value": "78601124e9c5f7c2354d785fb8418c0afeaecc67596b5dc9b3e4c873abf8c9f4e9e8575c81aa08ef4ad3968ed5fa8b11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818803, "uuid": "f4b86594-d7c6-4bc3-abba-880d458eee7f", "value": "T11CC4E4283EFA5019F2B3BF759AE875E6DA6FF7633703A45E204103864613A40DDD163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818803, "uuid": "bf1401d8-c5fe-487e-b1b4-7aa344b6a317", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818803, "uuid": "c8c90564-fbd8-4283-9036-6a0fa730ca11", "value": "12288:mCOJYlK/h+Y15q67/inezsQTz2Et/ZfirrNJA7qvkVRfe0oPBgIgFe:xOJYlK/h/15q67/inMhoAHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639818803, "uuid": "a17e9485-cf7f-4c7b-beef-f6bbae9d9916", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639818803, "uuid": "fa391fdc-c5b4-4d9e-a09a-233f02bc2f09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818803, "uuid": "bfdc0729-4e4a-469a-8077-ed140bc3f966", "value": "ac1a0a88247ad25a467c366f10176a80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d62be6d-5ffc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639829750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829750, "uuid": "534b99b5-203c-4712-a9c1-59253a21ab1e", "comment": "Malware payload (RedLineStealer)", "value": "8205d65f76fa63e73b7685faf647a048", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829750, "uuid": "9f744ef3-ec60-4c6a-8466-9b7dd04009d0", "comment": "Malware payload (RedLineStealer)", "value": "16c6a61f609b7ef5cd13fc587805018efad3be42545912f4281adde004cf928b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829750, "uuid": "8f4dae10-2d1c-436c-b786-a59221e0b98f", "comment": "Malware payload (RedLineStealer)", "value": "79ea7b6dda9d45f021150d57ce90f340cef35940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829750, "uuid": "f6807242-a688-492d-ac26-8d3688e8ef62", "comment": "Malware payload (RedLineStealer)", "value": "de4fd494fabc96ae10e2910d8c2e048b5f7b40cc39c14d8b01521da9c728407c8e95b7fa5941950a90ed3559033b9c70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829750, "uuid": "7b4395a5-025b-434f-8d5c-6f3073318e15", "value": "T125F3BF3179ECC472C9A702718464DBE55E7BE8222671824B3768136E2F70ECC4AF635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829750, "uuid": "c763c902-4bad-4435-ae73-205257ca78e5", "value": "254f2d7d316c651aeb3e2ff6fd4504f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829750, "uuid": "51cd0cc9-998e-4e3c-8391-2d392a239f7d", "value": "3072:a2hqRXLtQiHKibnOVTo5fQe5Tf1yfGWrxpzbgqru7WNcbB:HhqVLpHKn5aHEGuzbgwu/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639829750, "uuid": "f4f448fb-7f99-4507-9692-2be04d579a03", "value": 157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639829750, "uuid": "095d56fd-8071-4788-b252-8de7160dae24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829750, "uuid": "a20b178d-d63f-45df-9970-c9d53a658be8", "value": "16c6a61f609b7ef5cd13fc587805018efad3be4254591.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62caacb4-6055-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639868038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868038, "uuid": "fc2bea8b-b122-4446-9fd7-f4d7f27146bb", "comment": "Malware payload", "value": "587205c17f1121b839744b064e3cd92d", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868038, "uuid": "565e9afd-b3fc-4943-a8f4-159526c3a6cb", "comment": "Malware payload", "value": "18225aa660386627cb41f0392b00fc6b8f0a1007cee413dfd95e3809880a8fc2", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868038, "uuid": "4f81ba18-6836-4c11-a04d-99edb6e38cdb", "comment": "Malware payload", "value": "650a17d2beacd66530b89d7a01ea88ad5e284005", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868038, "uuid": "b1268f05-8473-48e7-978d-70ba08928c71", "comment": "Malware payload", "value": "f8efecac315d4ef6df1c2157ed55b690d129ba47176445c22d3fe9ff086479285e6c4f1e8c395beb4d692afb04c87e40", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639868038, "uuid": "9dc2e46d-aaf5-43dd-83b7-e920313b11a1", "value": "T1EAB2C447FBA2CE78C0C4D630885FA5286172B8F4DE20772B6914667229457C82F7FE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639868038, "uuid": "53814020-39e0-4b7f-aa01-3ba774eb310f", "value": "192:GZCBf/00lZPzIoRzXWRJPwnY+xr+2oBc0ZQdtkfmy8ShD8LAZ7DDFA0UGRSEsSkJ:zXlZSPwnYoKfZQdtkfmenBJ2djJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639868038, "uuid": "7d23872d-8e48-4af8-9dc3-1e0a5b52f6ae", "value": 25184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639868038, "uuid": "1a5c6533-a7c5-4a4f-bb46-af0a58eb010f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639868038, "uuid": "80711f4d-c18b-48fc-adf0-4c1295ce12fe", "value": "java", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ff4bf3-5fe0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639817933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817933, "uuid": "77103d78-5e91-4b24-b75a-1b5c94b3ea35", "comment": "Malware payload (RedLineStealer)", "value": "f823fa98f9087254ccb00b5c1a7904d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817933, "uuid": "7e054349-8169-4c48-88f6-b14a10dea306", "comment": "Malware payload (RedLineStealer)", "value": "18cd037dafda0a1a6af0cc72a5bfdfbae4a9c78f63708cd4fdd38048f5a4c87f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817933, "uuid": "d0b426ee-fa75-4b34-8654-d2b5f7850f1b", "comment": "Malware payload (RedLineStealer)", "value": "6401eead5028bfd132855f2f4772d407639c8d26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817933, "uuid": "444f61e6-3b30-4145-a768-a5f8f1709a75", "comment": "Malware payload (RedLineStealer)", "value": "6e27ab91b3db59be905f3208fe985578f353bf787ff0f2d81d100ed1c84d9234013f9e3cf3ae2774c0614279e658208f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817933, "uuid": "24f22f26-f3fe-4c4a-ab0b-f1073ed76a82", "value": "T1CFB4D53839FB5019F273EFB59AD874A69A6FF7633707A55E205003874A13A80EDD1239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817933, "uuid": "099ff18b-be19-4ba8-8409-8a70b0c0e885", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817933, "uuid": "79e46983-ef29-4011-8848-25e204009a57", "value": "12288:F68K/YHoLAC7fCZhMX7P7qbqB53xupJ/CVb:F6NYqrChEqch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817933, "uuid": "62a8de02-24c0-4796-ab9f-9a8a16ab53b0", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817933, "uuid": "850e88ed-d711-47f6-b66a-cbc665b60533", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817933, "uuid": "5312f047-1c02-4bd9-9b4d-3ddc4e93f7be", "value": "f823fa98f9087254ccb00b5c1a7904d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6386eb1e-6054-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639867610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867610, "uuid": "8c312dde-d7a2-4490-9cd3-5e498150966c", "comment": "Malware payload (Mirai)", "value": "2e0f6a725ff8787677f9f1349bd717bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867610, "uuid": "d9bca754-be25-4479-a0d6-1a18a6cdaeb0", "comment": "Malware payload (Mirai)", "value": "19a2cac98a487a95b97de142d33e26c00eb36bc6c539ed68879a976629dd4cf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867610, "uuid": "86903b06-7196-46c0-bc22-c4b6873d6e4c", "comment": "Malware payload (Mirai)", "value": "643168a13265deba59471a99fffc6dd7569a03cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867610, "uuid": "63107aee-5dad-4a4d-956c-c5162201156d", "comment": "Malware payload (Mirai)", "value": "3aaa3fa7094f97fe250ca7a44c01c4e9d7bcd38a220f99d57f23ecf85b3a81c3de333a37cd5437be7ac65206c072f56f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867610, "uuid": "b78e88d4-55e7-4dfe-a43a-6dbda9238501", "value": "T117731981B8809E15C6D517BBFA6F108E331257ACE2DEB353CD145B6077CA81B0E77A89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867610, "uuid": "7cbb1c64-1e96-42dc-b8a0-b4b18ead9b90", "value": "1536:n1n/sLsUUCnVRs2qOfH0u0KKiAfvZS/IAuL16o9mrsplDKZUdQBKXAVan4X+F8Jb:xsLO4q4H70BiGvZcI5L199mrsplDKZUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639867610, "uuid": "a3b919e7-12f4-4fc5-9a3c-5565de7aefe1", "value": 80124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639867610, "uuid": "84df9f6b-f67a-48b1-8574-293a733065c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867610, "uuid": "74faa8b6-529d-4ecc-865c-bb215c710567", "value": "2e0f6a725ff8787677f9f1349bd717bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f266ce38-6024-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639847234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639847234, "uuid": "0e58d4a3-6469-4add-a672-f6e9c09af987", "comment": "Malware payload (RedLineStealer)", "value": "b72f49b7e447030de5dbb59e5347aeda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639847234, "uuid": "7c8393e8-8315-451d-8241-a035c68cc29a", "comment": "Malware payload (RedLineStealer)", "value": "1bdfcfa2faaa7f70ad6b29dc77711dde848a9ffc5c63da8502ea2b1b9dc2aa06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639847234, "uuid": "1fabbd17-15ab-497c-bddb-68c9856cebfc", "comment": "Malware payload (RedLineStealer)", "value": "c33ba192ae6bf50f356a6d4cae24e0a6427f2759", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639847234, "uuid": "04b53c1a-9b3a-4a04-abfa-f2ad27f906f4", "comment": "Malware payload (RedLineStealer)", "value": "9b7f7c7caf5be49e46b5fbf63d7004cbb1188d9577844c5ddb5f920ff48ef3d6e5ff9fb2a79da2b6f11655a7bcc45e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639847234, "uuid": "ba412512-3898-4f8a-9e04-3a6b94b108ad", "value": "T1E915E1BF25C2B66DEF76077989FFB7004BB998D9432703C89354BAE0CAF81625B00595", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639847234, "uuid": "c29c8012-6c81-4764-be61-e954803b5616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639847234, "uuid": "031e188b-3a88-4d47-9930-d4d0b0737a20", "value": "12288:Ozq6lYN4ZOicHWTcovappm2QfKDb2qMt8CpP:kYOlIocoyBQfSa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639847234, "uuid": "d984a216-2187-4411-8e86-eb2feb99e159", "value": 919944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639847234, "uuid": "513c2442-4709-4f6b-b1ef-5d1454ba47e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639847234, "uuid": "47a54627-ce35-493b-b33f-73c8bbc97f17", "value": "b72f49b7e447030de5dbb59e5347aeda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a971f9-6053-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639867129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867129, "uuid": "9f57ab09-4aa3-4c8f-9428-73f36da7819f", "comment": "Malware payload (Mirai)", "value": "1f52bfb4953f8d25736177f785c7a077", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867129, "uuid": "f061d153-63a1-428a-91eb-3599901ad413", "comment": "Malware payload (Mirai)", "value": "1be475b31b3af6dfad92f4fa52f98e40511fd164fe3f702f22cc2215d044afff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867129, "uuid": "ef2036e1-db17-4379-83fa-eea5d6b70c43", "comment": "Malware payload (Mirai)", "value": "8176917b3b05ebb375aafb387ef7943512cac4cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867129, "uuid": "9b9d8b39-96f3-4e6f-8079-f9082830060a", "comment": "Malware payload (Mirai)", "value": "45a8ec0e50c9a235eff14b82e877a747356fec18430991dbf8f95e574bff8b6c87a28f3b32092c5888f30e65ce6b83cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867129, "uuid": "2edadd00-6096-44c4-a869-c3645a732020", "value": "T125B31937A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867129, "uuid": "e8621d42-0787-41ce-845b-ca30e5ef34a0", "value": "3072:pC/4rdZHsXsZwwR9HNSmm/QcuLmH26PNb:pCwrvHwsZwY9HQmm/QcuLmH26PNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639867129, "uuid": "dbdff77c-4bbf-4e90-8922-762f14057432", "value": 116787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639867129, "uuid": "46b3e859-4021-407b-931b-d9232f38f919", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867129, "uuid": "68b03314-301f-4b15-bd47-e0a71d45e813", "value": "1f52bfb4953f8d25736177f785c7a077", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1af0722-601c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639843662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843662, "uuid": "492e1b1d-1a9f-4c3c-baa7-9c778836ce75", "comment": "Malware payload (RedLineStealer)", "value": "51b53d0acb921cb522e3f5a0ad3535fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843662, "uuid": "8ddc0e49-b634-4ecd-a0ff-06baa9649637", "comment": "Malware payload (RedLineStealer)", "value": "1ccc0af2e57d00c53b91e8e191a9a3ce4692c87c4ae8a00035323c840f921708", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843662, "uuid": "6ef67cef-843c-4a39-865b-0a951d8d0fa1", "comment": "Malware payload (RedLineStealer)", "value": "e3f2cf8106db97c7c855f863f9f6f6df3a50b3e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843662, "uuid": "3200f0cd-ff76-4dcf-b09a-3786ebbccf2e", "comment": "Malware payload (RedLineStealer)", "value": "5e508c95163798bf89f53844a1fad05167475f1252ba2c7864831a0a93119cbd81d82d54f5b348b8ba8309c4ff73ddb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843662, "uuid": "6275e93b-9be0-4392-9c98-d032b793bebc", "value": "T16D85331EEF442F49C7CC5A3B0880912A3DB1F41575828634B7574AAB5BC87AFF22563E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843662, "uuid": "4a165c1a-083b-486b-bd3b-48be8335eeef", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843662, "uuid": "d5201f4a-030a-4dad-ab79-162321a48070", "value": "49152:kGFCOrxNT/jgd4RahlfDd7m+nNa6QWdvg2:kahrxNLj1RUlNm+NLQWdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639843662, "uuid": "d89712f8-32d4-4766-bf28-ab448212e320", "value": 1738968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639843662, "uuid": "92b40880-f47d-4674-82af-e359bb2ab4b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843662, "uuid": "b3c6c3ef-cd41-4689-8072-19b1272da978", "value": "51b53d0acb921cb522e3f5a0ad3535fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe8660d-6053-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639867094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867094, "uuid": "d4b40dee-abb2-43bc-b6e4-9a0d1fd417e2", "comment": "Malware payload (Mirai)", "value": "c5de32050695d27c694ea554fb7ac02f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867094, "uuid": "3a8e3cf9-af4d-466a-969d-a84988c52711", "comment": "Malware payload (Mirai)", "value": "1db296d68552c8c9504c4e23075d0147c664450e4ea9ca488c9e3bd2662af211", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867094, "uuid": "5f09d4a3-285d-48ae-922e-d822dc05ff7e", "comment": "Malware payload (Mirai)", "value": "7968bfa53d24e1fd0a168e86661c8fd759c54d6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867094, "uuid": "51815564-2091-4647-b79a-806364890c8f", "comment": "Malware payload (Mirai)", "value": "820e49b647d9efa34182787384e5e260328af3154c9e4b6470255e9cd0a5e17b058a5a1eb3eb150fdcc447f6ef7f8411", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867094, "uuid": "11819b3e-36d8-480e-835a-c6c0504738ec", "value": "T16A4309827881AA39C7D057BBEA9F108E3354ABD9D0DB7347CC140B9176CA51F0D67B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867094, "uuid": "256a5666-a9ef-478e-8ffb-cd8f9a7189a8", "value": "1536:k+RGSePMuco0FmTKsyGPD6NdYU75WN0TG3Ia4YceZWi0JMM:rRGSePMm0GIaDcwgJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639867094, "uuid": "ae5052a4-e670-4695-a242-e40cc7570fc7", "value": 60184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639867094, "uuid": "03f7f4f6-af1e-40bb-bdce-a2a69b3739f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867094, "uuid": "0f9ae511-2c8d-4574-8496-6a96fc99386f", "value": "c5de32050695d27c694ea554fb7ac02f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b48e24-601e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639844505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844505, "uuid": "caff08a4-8b5f-4df4-b5e9-f86e2774b607", "comment": "Malware payload (RedLineStealer)", "value": "e87e11ce89b7d4626fdf8a25da6caf3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844505, "uuid": "9aa3dd8f-e540-4ca4-b353-2ab82304bb7c", "comment": "Malware payload (RedLineStealer)", "value": "1ddf8e4908e590308dd662cba6ded6bc0edebae1ec9346d2264ec65c420f0449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844505, "uuid": "159861e9-6a69-4ed0-ac1f-b69630f08588", "comment": "Malware payload (RedLineStealer)", "value": "240e184324c36a58fc77b06d0bb142c2e61fcba4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844505, "uuid": "20bf72dd-ee5b-4ce1-8984-9e784054f6cf", "comment": "Malware payload (RedLineStealer)", "value": "f7886a50a2f9c0e553ca5f3263993dff9328a5a7927da09367e3222f056ec32e0eb4a0f701481b488fd32fb5267e5554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844505, "uuid": "b9531029-bb04-4561-9cd0-b381eda12627", "value": "T11784DF00BBE0D034F5B752F849B6D3ACB63E7AA15B60A0CB12D426EA5775AD0DD3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844505, "uuid": "e67a7484-0b7e-4d51-8e0a-356ff23de8b5", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844505, "uuid": "a8b43e1d-1873-4c3b-b195-48cb16a48dbf", "value": "6144:kexzTwaVLQ5CcQXJsa6OyPE9SXVk1BQ4X+OZd7vniBqJWBxZL2:kexQaVIClsa6OyKSXVkXQ4X+cJ+qJW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844505, "uuid": "109e4b99-313f-43ec-b6c5-f3b7ba668aa8", "value": 406082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844505, "uuid": "3355e1da-889d-4108-a590-f0fc514ef625", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844505, "uuid": "3c5a62d6-410a-494e-871c-8ec3ba742eb2", "value": "1ddf8e4908e590308dd662cba6ded6bc0edebae1ec934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47049e84-6052-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639866703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866703, "uuid": "404edff7-34af-4bd0-a3f4-6ec58556e7dd", "comment": "Malware payload (Mirai)", "value": "62c779e3947851635149aa267d3a566c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866703, "uuid": "adbe315f-4bbe-49d9-b32e-96f5b75e8d2c", "comment": "Malware payload (Mirai)", "value": "2079a8e05e71812590a33ab8c9b92d41a9b2610651f3dba800ae751239e2c9bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866703, "uuid": "30465870-5d56-4e4d-b669-8b5f3941b0cc", "comment": "Malware payload (Mirai)", "value": "10ca7800c558074b103478da6cc238b4ccf627b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866703, "uuid": "9c653e29-e2b6-48d9-ace2-403b4407763f", "comment": "Malware payload (Mirai)", "value": "6c2f83e3293946b02057fa8e57240a991c5d93e65150cd5025d9e27e53e17e1e4b0045c2bac73475eda409cd7396ea3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866703, "uuid": "3fc370cd-e082-40bb-9794-be790a18df29", "value": "T1F9E38536B7619E77D80ECE7305A985121C8C998702D92B6FB2B4E51CEB6BC4F08D3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866703, "uuid": "be69c0d1-27d8-4d2c-8f2f-723772771183", "value": "3072:dctc9p13lnLU2PiXYqyCc4VyMVGuouTmrThPaLEne7rNb:d9XlnLU2PiIqyZ4VRDouTmrThPaLEneN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639866703, "uuid": "f01e3ede-6cbb-40d4-aac8-2e5f914bfc99", "value": 155477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639866703, "uuid": "516b3d35-d47b-4a64-b8c5-edb2b7c4ffb4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866703, "uuid": "ae1e554b-7c57-46fd-ba61-c6b2f910426d", "value": "62c779e3947851635149aa267d3a566c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b5ba06-5fe8-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639821366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639821366, "uuid": "4358ac83-5f2b-4d07-bf3b-2bacf49ffa3e", "comment": "Malware payload (RedLineStealer)", "value": "dca5a74f596527e34f9136617dad0cfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639821366, "uuid": "149f9de8-acbe-4eb1-be40-b7a195b05e3b", "comment": "Malware payload (RedLineStealer)", "value": "214687a5d174c156e9eb9c70f9c3996078a588f628b9d1d03da930a0617d2c48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639821366, "uuid": "4fe04a5a-7ba2-49ef-ae8c-96ba55f8d622", "comment": "Malware payload (RedLineStealer)", "value": "7e63f31a32d683b47743f697172e7fbfc7f8af3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639821366, "uuid": "bc9f1b69-1128-43c5-a149-0b2c0015c68c", "comment": "Malware payload (RedLineStealer)", "value": "5c24b500779335863602cd9a61e25c2097a8681d576167e5273f024ad3c77b1e649b985fdffd34722048f868b9627623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639821366, "uuid": "2a18f301-0ada-4845-bbfb-c1fcfd9e196c", "value": "T1EB649E00BBE0C435F4B712F449B6D3B9A53E79A16B6491CB62D626EE47346E0EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639821366, "uuid": "fa8c5435-a67a-46ed-bfe8-a3925a704619", "value": "cd2e8aca313b88a16bc7b305a3f26143", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639821366, "uuid": "6db3e950-2aa0-418b-bf47-51eb797040ad", "value": "6144:HYh2aiqf69CYC/PEkiJr1t/Ma4P3MiahNu9UJnB:iVPEkgr1t/MjMiahNZlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639821366, "uuid": "7913e280-6739-4e37-8e23-62005725c372", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639821366, "uuid": "2b1a0c6f-ec78-40fd-8a5a-fcea6d9333de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639821366, "uuid": "1c351b79-01f3-407f-9519-a947022321de", "value": "dca5a74f596527e34f9136617dad0cfe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db84e04-602a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639849588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639849588, "uuid": "a315d3df-090e-4ca0-bc06-a03325af3058", "comment": "Malware payload (RedLineStealer)", "value": "1903d35ebd74a48955d4576c1710c613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639849588, "uuid": "2a4f51e8-c274-41f5-8199-f5d6f0a356aa", "comment": "Malware payload (RedLineStealer)", "value": "239765eab4f95dcf54a2bec368302599784b9f82fa192b79cb0726c53496f644", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639849588, "uuid": "acf2f562-6421-4cd8-99f3-14d8e8c0e636", "comment": "Malware payload (RedLineStealer)", "value": "b8048b7c27934d7cf290cf759f74ef3829e97375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639849588, "uuid": "9ea4089a-42ee-4fbf-9c66-54905f5d8219", "comment": "Malware payload (RedLineStealer)", "value": "2c2400db5b072e7465a2042526875eaed75dfaf983facdcfa1119b423a2ac43dfa2e702b849eacc3d4ceb370e3f228d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639849588, "uuid": "227829c5-2144-456c-9ddc-a04edecbb9e0", "value": "T16A84CF00BBE0D035F5B762F44D7693ADA53E7AA16B34A4CB22C026DA57746E0EC7134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639849588, "uuid": "cb174cc2-d64e-40cf-ad38-1864fa60f5be", "value": "fffb3573e6a31c80ef6af28a69351bf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639849588, "uuid": "6c3c823d-23bb-43e9-b607-d8e2878b6477", "value": "6144:ibsXkAifDileIs174iSmL+w9gAV38Mv/k+8KEF9qxBZZaD2xRza:8VDile5X6AV38W/k+xzbZZIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639849588, "uuid": "19559cfe-4935-461a-b805-39dcafce0986", "value": 407089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639849588, "uuid": "d1a5061e-0ff5-442f-9231-c7734b2e6787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639849588, "uuid": "5d930464-2b7b-453e-ab2e-a2be335e9877", "value": "239765eab4f95dcf54a2bec368302599784b9f82fa192.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fca7bd-5fee-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1639823812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639823812, "uuid": "2f6a217f-14a1-4a29-8578-5206c1a90fde", "comment": "Malware payload (CryptBot)", "value": "6f6df17ecbcbdce8c857e85a368801a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639823812, "uuid": "543ae48f-4cdc-43d6-ae30-9cea993d190e", "comment": "Malware payload (CryptBot)", "value": "23ae7c16bd46eb8cb7a8c34e6d903c0bb613628245a9471db6f31fd27b12e06d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639823812, "uuid": "aa8c2821-3a9c-4c57-9354-691051619b5e", "comment": "Malware payload (CryptBot)", "value": "03491534e6c3fc9627899be5f9d7b053da57dfab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639823812, "uuid": "8d10976a-6354-4ecd-891b-0f6c551f537b", "comment": "Malware payload (CryptBot)", "value": "a2c37ed89a11fe9ddec7b45110b5fffd3081c3f82a8a4da2e39ad160ff4561bd7c4fbdeafd43584dd6f26ed45d096f1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639823812, "uuid": "faa84ce6-bbf4-4387-8277-627dee570bec", "value": "T1B084BF00BBA0D439F1F712F84979D3BDA53E7AA16B3495CB52D522EA06396E4EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639823812, "uuid": "3d71b7be-c9fa-4da5-aa86-62a85fbfd044", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639823812, "uuid": "e47c01ae-3773-4955-b4aa-f8dbd1981e3f", "value": "6144:1JL2zuqtHus10K7muQk0QT6XYkLZiZ0tMROvfrmVZf5gdGpY9wNsBbG+YNQlDVnq:qzuuOY0Emv2cYkLZiZ0tMROyIrUXuRsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639823812, "uuid": "ca68d45a-ce24-412e-936d-4486506578c6", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639823812, "uuid": "61c42184-6ee6-4db2-992c-97dcde1783d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639823812, "uuid": "91370a24-8464-4790-8e43-04e46d867232", "value": "6f6df17ecbcbdce8c857e85a368801a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57aad1dc-600c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639836666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836666, "uuid": "f2c7230f-3724-4a31-9a62-044ea2476e6f", "comment": "Malware payload (RedLineStealer)", "value": "b59eb35e6f79d3e3fa89caf9eecb0b3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836666, "uuid": "522f999a-80a4-4ddc-b22c-eb2bd52fe2df", "comment": "Malware payload (RedLineStealer)", "value": "2458c9d976618c06853a103a7f6d509c2f704cd44f1e45770202ed98362d63c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836666, "uuid": "c27f0291-08ce-4d8f-bff6-4efc946c1246", "comment": "Malware payload (RedLineStealer)", "value": "67bee3122b510728f9a995521c66c436e1b70dea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836666, "uuid": "c78340ce-fd71-4f9d-8aa4-11c3d5b600c0", "comment": "Malware payload (RedLineStealer)", "value": "c60677f3e06a0d556d5e47ef693df8e4f27217c4b7d953cbff60508ccbc35e77045151ca202e6a38bf878f36cb98cc8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836666, "uuid": "8c6b0fb9-31c1-4653-90fa-2d66ac7cc48d", "value": "T125549D00ABA0D035F5BB92F449B693BD6A3F79A16B7490CB51D116EA0734AE1EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836666, "uuid": "128ac474-a37b-4f63-a64f-03068b03433d", "value": "e00af8f1ad8949415054b06be51fa3d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836666, "uuid": "e268cfbd-f4d2-4b1d-bd71-81ceff5980fb", "value": "6144:QH7rqT4SjIsUvKz2129tcpP0MOxSenNcjrH:g3uUvG2129tg0MOxSMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639836666, "uuid": "b9e91497-cde2-40a1-837f-c18ceca5cfb7", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639836666, "uuid": "72b35a2d-ceb6-4210-bd5e-e498865a159d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836666, "uuid": "007d192e-2d89-4eb6-aef8-14514ffe859a", "value": "b59eb35e6f79d3e3fa89caf9eecb0b3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4495fa81-5fe0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639817736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817736, "uuid": "64428b68-f9c3-4a44-b90c-4d94cced9334", "comment": "Malware payload", "value": "2db77b8b220598dfa597f4e1ff2808fa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817736, "uuid": "b66069b6-4bdd-4d78-95ad-b54db1176d02", "comment": "Malware payload", "value": "25e9f582a241937a762559ed5acc97fa18e5018e5b66e869d81c4cdc9ab48e73", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817736, "uuid": "b0e2455a-5ef7-4617-a3d4-871e59a2d862", "comment": "Malware payload", "value": "8bdb4b0993caf1f0704f0afd927de73b0b78dbe8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817736, "uuid": "10a675dc-524d-4897-8965-c21239882c12", "comment": "Malware payload", "value": "036584ac3f256ab32b6d5abdb44a65441754e133fe57bcb9807d680fe8b12838ee0712e7a319e6d3b655cfa7bc0aa22f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817736, "uuid": "13e44abb-a94d-4266-bd1e-115d31e33353", "value": "T15A017029895EC390C5E6C929E3E51913C5EF00105938CD5DE576C7E86F06568D3EC369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817736, "uuid": "f8ad7a54-f884-493a-a196-fa69459013ad", "value": "12:lruN1txnGJh0HJ+kLt6NGQpc07lFA3oIM4aA62L7njnMcvpc97LyFL6VyF5R:pvkH5qlFA30HArZlFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817736, "uuid": "94f23013-5cd5-4fbf-98d8-91c566104437", "value": 702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817736, "uuid": "76efa2fc-e168-465e-a605-129064894ff5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817736, "uuid": "8ca46643-fd5a-4100-8abc-0750a2a66a8f", "value": "IMG2903133767.jpg.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce11afc-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639844164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844164, "uuid": "ea4386de-2260-4ff2-a475-c003fff70ed1", "comment": "Malware payload (RedLineStealer)", "value": "b857582800934d7f5a187ffa21164ba5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844164, "uuid": "f99f8490-38be-4fa0-b83d-0748c2fa9822", "comment": "Malware payload (RedLineStealer)", "value": "266cc5a5ade7be8cc2fc1de535a1d0368de56696e1c38cc3b5266f6f9f5d582d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844164, "uuid": "2cf9d270-ba71-4cf9-bc04-33ec8d730bef", "comment": "Malware payload (RedLineStealer)", "value": "bc256e814bf084f199bed5bfeb30c5ac7817ffbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844164, "uuid": "37dd761f-1fba-403b-98f2-438888ea8603", "comment": "Malware payload (RedLineStealer)", "value": "7b3ed972a6feb2788f973692fe7f9f7c0be070ed0bf8a24bbc1a6c420e4cc5de194f385bceb198949042eb92a12e959e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844164, "uuid": "de58754e-3d07-4546-9e0f-2202e0ac42e2", "value": "T1A984DF00BBE0D034F5B752F849B6D3ACB63E7AA15B60A0CB12D426EA5775AD0DD3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844164, "uuid": "e2d74a3c-8a21-4f84-b6d5-802ae797d0a5", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844164, "uuid": "0b7dbeaf-10d8-40fa-976a-f05c11ba2ed0", "value": "6144:kexzTwaVLQ5CcQXJsa6OyPE9SXVk1BQ4X+OZd7vniBqJWBxZL2:kexQaVIClsa6OyKSXVkXQ4X+cJ+qJW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844164, "uuid": "f880f17d-a1eb-44c3-8b40-6ce02e412ed6", "value": 406038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844164, "uuid": "1a4d40ae-d4ea-4903-ae3f-83426cfdd867", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844164, "uuid": "04bca3d6-39ff-47c9-addc-8772ea875bd2", "value": "b857582800934d7f5a187ffa21164ba5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b599c91-5fe0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639817828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817828, "uuid": "d5dd2924-36d8-4870-a67f-e28e08fdd554", "comment": "Malware payload (AgentTesla)", "value": "e32278753a926dcc2b25ee385f498419", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817828, "uuid": "7a2c74ca-36d0-449a-b752-7f4ce113201b", "comment": "Malware payload (AgentTesla)", "value": "2867108a9ab4aae43744ab5f9d374aacf6dea8deec9222b3be47a75a44e74604", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817828, "uuid": "b0971696-ff5d-4b0e-a030-c5621846594d", "comment": "Malware payload (AgentTesla)", "value": "d908ddbedc4f556cdf0dc731be77ff56566c617a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817828, "uuid": "20131405-d0b7-469d-afe6-3ad5a3a9235f", "comment": "Malware payload (AgentTesla)", "value": "a96a31367cab9e4b2487f7e226f14d8009c87f746cb7caa0e4af49a75513085d138bf709ef09ed2f5e93dc42b33ae86c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817828, "uuid": "db6c3abc-c362-4100-ad06-8606f471dfab", "value": "T149B4129466E0DB5EC0750BF9203455E197F02A617523CF0B9D9E82DECE273825E227EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817828, "uuid": "df30af08-e71f-4fa0-9fc6-d416b5874feb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817828, "uuid": "7eb201d4-96f6-4b4e-8345-6a232f498ba1", "value": "12288:eduSK3PJazmL2Lu7KWvwccE0zQ3gWkmyyy1pWyHtGG:e4SK3PimL1sE0z6kdPGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817828, "uuid": "6145a94a-40bf-4db3-85db-b13f731b6069", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817828, "uuid": "c61555cf-5c00-491c-bb47-b9814d86b235", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817828, "uuid": "9d16c02b-fdc8-4369-9680-4aa1439d3fb0", "value": "e32278753a926dcc2b25ee385f498419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d522406-5f9f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639789968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789968, "uuid": "25696bc0-db9d-487e-99f9-444a13457e04", "comment": "Malware payload", "value": "4390d399afd725a8d849675b8fdd0dbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789968, "uuid": "04e5a199-65be-49e2-a3e9-180be47f8fc7", "comment": "Malware payload", "value": "292b707a54efbc8e512e80a540f31299296db655edc8ad2bd0ebfc771729d8e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789968, "uuid": "9ff9db85-9966-49dc-89da-cb39b3853430", "comment": "Malware payload", "value": "7d99747b2f0c930c2d6d682af8ece18075e3f677", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789968, "uuid": "4d02d9e6-85e1-4161-b183-5b53950f9153", "comment": "Malware payload", "value": "c88038fb338960d32ad553255e944c4f1b4cd81abe55c2e0a088e5020ebacb99b00b08b5708db7508480ba49abfe4d02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789968, "uuid": "059db35b-6385-48eb-8f55-fe0e8af64f7e", "value": "T16105E0E4C54C74F7E0B75B36807A4B381A6D6D721A35B60A8134CD9EDA8EFCD102E58E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789968, "uuid": "13bf0d1a-d6dd-4689-8d88-aa8bcbdaadea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789968, "uuid": "ba6e1f7a-becb-4ef2-aef3-4ac4c86b9ebe", "value": "24576:3CTL4SKap21POwfjtsbALLXzp59nx/fUw6CgTyT:3CT/Ks21GLbIDlSbCgTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639789968, "uuid": "471385b7-9797-49bd-abd6-5674417575c1", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639789968, "uuid": "553ce6e2-a68c-4354-9224-a37706882610", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789968, "uuid": "ad189fcb-128d-4e3f-a4ee-61d28e20afb9", "value": "4390d399afd725a8d849675b8fdd0dbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b53cae-601c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639843636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843636, "uuid": "6cddc492-4027-409b-afda-2aa49e701e96", "comment": "Malware payload (Mirai)", "value": "1fd6ff4b6bc2c5042c8b51cf5444ede9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843636, "uuid": "e5d12363-b3be-48f9-ab5b-bf1f5dbce829", "comment": "Malware payload (Mirai)", "value": "294d842bded3d6b6c0cd8bbd7923dc0ef5ee88b67c8396d0b80e07b7f12aae42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843636, "uuid": "058cf343-e7e5-4972-be4f-ca4f7a2a5ebb", "comment": "Malware payload (Mirai)", "value": "c5f71773fcf4201d7d56360144191aa2dfff02ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843636, "uuid": "fb3e2802-2262-4a57-bb02-307a8ced7160", "comment": "Malware payload (Mirai)", "value": "9c176de7df445c7ae60a0988c096f02cc531007a0f97fdd5b840ca9d99f0f6384c043abe7a7039cda0f96c33a21abbb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843636, "uuid": "58209e6e-9a58-4cb1-8d57-e591045b5190", "value": "T1E6430165C706B9C2CAF244B67E2EBA45569D6F71537F722B4FA4170C02C21833378A3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843636, "uuid": "68c010da-d800-40b4-b17c-0699c58b0315", "value": "768:jdXkAhT8YFFm0P7KnHxCYKqY/9eK7pMrqhorhGjx0uTAzv9q3UELiDWBoKztLzJi:WA9MRCnqYl3p2q+NGN0wAiL3tzDImJiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639843636, "uuid": "30389ba7-4478-4b15-ab86-e8c5c6ca5a91", "value": 58160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639843636, "uuid": "10cf5ca9-de2a-4768-920a-10e938ac2567", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843636, "uuid": "78470d8b-989e-4b39-b55c-8e22997f97d6", "value": "1fd6ff4b6bc2c5042c8b51cf5444ede9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0385557b-5ff4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639826217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639826217, "uuid": "e2227a13-e65c-45f2-83fb-2523dae239e9", "comment": "Malware payload (AgentTesla)", "value": "6358349624524c778b178716690c3ed0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639826217, "uuid": "cfc9907d-b464-4b34-8083-c5fb2f200c47", "comment": "Malware payload (AgentTesla)", "value": "2d85d471ad1d32fccd8a586d9c7a960d0a77812b5e551fcdd16fc8bf1f15924a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639826217, "uuid": "c01e77a6-61cf-40a3-9578-960d33cdbc31", "comment": "Malware payload (AgentTesla)", "value": "a979d1ebde41000c2f967749cb7da793f3d893d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639826217, "uuid": "e54ccf59-2ba7-44e3-a126-9966db2d88c7", "comment": "Malware payload (AgentTesla)", "value": "2bd6243c664b6a82f97fe783105cc5cb2fac68e379401c497d8b60ec48eaae531f0fca12e7e4b2be1991d7b0fe652489", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639826217, "uuid": "e2dc102d-804f-4589-9321-41e6723c0501", "value": "T17EB412C873A8DB1AC17143FA1476A4D5CFB06232B212EF9A1E5BD2D995137C92F12387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639826217, "uuid": "8e0a8563-8b19-410d-94ef-dc257bd56042", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639826217, "uuid": "10026a2d-dae4-4cb7-967f-ae226944fee8", "value": "12288:R+pxk+fkHx+2qmmaSyCn9V0ysEuSK3pkkyyy1j+Q:Apxk+QFAaSPnLsfSK3pkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639826217, "uuid": "539f4844-37ba-49b9-bc5c-58ecfa2d2251", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639826217, "uuid": "8b79c5f6-16b7-4f6a-b187-1dc7c05cdba5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639826217, "uuid": "38c45b58-bebe-4396-87a2-6c91b4339617", "value": "Invoice_DDTN.201-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61adfc60-5fe0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639817785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817785, "uuid": "01e6c135-5e5e-461f-bef7-016f63e11684", "comment": "Malware payload", "value": "5ae83be8df046a101b01d00111d8644a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817785, "uuid": "52528a9b-c64c-4ff3-ac0a-71d6484166d4", "comment": "Malware payload", "value": "2ed10e0e48bdd575f561bd212010ea0f86c1ffc7598870b465e9513ebb5863d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817785, "uuid": "aceb8545-1e79-44ae-97c7-f79af364c434", "comment": "Malware payload", "value": "ae87554acb9df6173c8ffadd89667f5c755700c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817785, "uuid": "11522d22-0f20-48bf-910a-5bd1074e1869", "comment": "Malware payload", "value": "9123efc86c5b400ac3e4f910b90a15c1dc38e20a8e0cd1131ba01b1837b75e68e5113176e61df376ce91ef4681a51a30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817785, "uuid": "7f90fb69-cba0-42ea-90f2-0e2d2ca81cfd", "value": "T162E1C6069BA402B3E5A40BF069B51C0DDA7D6673572196DFEA37C609BA61321E4033DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817785, "uuid": "8424937b-f380-454b-85ed-f434c914ba2e", "value": "589ae557bb35b4ed70db6ad0a2c00caf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817785, "uuid": "5c6fc6f0-8ed4-44be-a834-00446b14aca9", "value": "96:S0A84Lacmi9bwMTs4uWiQa/ePtboynzxMLkWSoqQCtk:S1LnmdnWyeP1oyn9MLkWSo2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817785, "uuid": "36fa7f51-4416-4dfb-b5e5-6bdbd000a19f", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817785, "uuid": "e9f68282-d700-4491-ace3-e1d7dd409444", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817785, "uuid": "7feb388b-c86d-434d-870c-222a04b79fcc", "value": "p.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdde4640-5fe0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639817940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817940, "uuid": "111f6fab-3099-4a7e-a7ba-469b607c13ec", "comment": "Malware payload (Mirai)", "value": "2a8dee6b5f338019e828b49282a1f3db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817940, "uuid": "a83908d5-f39d-45cd-833c-d473f4bf3c76", "comment": "Malware payload (Mirai)", "value": "308dbea999b67c122dcab04247e4d9ee30d79c5c75e9163e02490f6636ba41dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817940, "uuid": "d6203dfc-7aee-4410-9704-b42bc4879411", "comment": "Malware payload (Mirai)", "value": "32819e8ffdde5ac4ac5f69f80682f0c2c00ff220", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817940, "uuid": "721c7865-988b-4e72-8b34-1073bd8ad864", "comment": "Malware payload (Mirai)", "value": "1c16c0a9f2cdd73cd1499800c6d6413be95116c193f44feabf70ccaca571260d171cf668c685de161b99b5f288cf3b73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817940, "uuid": "1e65116d-aaf9-4e80-9acd-d602fd804b9a", "value": "T1DBA3C71E6E158F7CF79D833447B78F219688338B2AE2D145E15CDA015EB028E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817940, "uuid": "89d001c0-1226-45b2-9804-3e3f01f624b7", "value": "3072:RucT7B75EV7Ubc/6jQ6GdHKvqzoNa0jLmCu:Ruc3d5+/SGNKyea0jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817940, "uuid": "cd61f664-9a6d-40e6-a2d9-75539351f41c", "value": 101148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817940, "uuid": "a733aab5-baa5-48fb-93e7-824485c6f474", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817940, "uuid": "caf13791-885e-4bf7-8651-aa324c504ef1", "value": "2a8dee6b5f338019e828b49282a1f3db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7791d55e-601e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639844451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844451, "uuid": "38804bb1-2311-4da4-a52e-8575cd2b07b1", "comment": "Malware payload (Mirai)", "value": "c2c6a81fa195fd19dee6f6cd45d635ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844451, "uuid": "874b47cf-db5b-4b88-9a93-aa5e312ba94f", "comment": "Malware payload (Mirai)", "value": "31234c8b4171b6db702c3a0bc493ee2a4c08a3c868a0f614c586ca7b64bb5480", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844451, "uuid": "d1d64329-02db-46b4-b075-502ba0686b49", "comment": "Malware payload (Mirai)", "value": "16b1256e1071ef363eb78f338f2a18e81e7c5f1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844451, "uuid": "672770b6-55d5-44f5-85b6-9747d01d31a6", "comment": "Malware payload (Mirai)", "value": "2fabf554e55a569e9f68fa24b18fa224a66545d1cb009470b4518117a43a5b5fff27babc7bcb7f33222718b9ffac9ade", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844451, "uuid": "02a05901-8948-4f01-9495-1024e52708d9", "value": "T1C3C2E0B90F040995DA12E5FD22B31BC62E7A0EF45497AC88F98151763ED308DAC5BED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844451, "uuid": "a27d49af-07de-4fa4-8e82-2e73bb61903a", "value": "768:QlKJXi2YAix+ob2BJS14PQxptOIPhJgGlzDpuWu:QlKJ29kJ1PQ7VEWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844451, "uuid": "4964adaf-6b87-4b75-8f91-72a59758003e", "value": 28108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844451, "uuid": "d3d09213-ca6d-4658-8c1d-3636c610f334", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844451, "uuid": "efd4621b-084e-497f-92cf-00b89c04f5ee", "value": "c2c6a81fa195fd19dee6f6cd45d635ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4892d63d-5feb-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639822468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639822468, "uuid": "d508e8b0-787a-4edc-b95b-432d7d9416f8", "comment": "Malware payload (Quakbot)", "value": "067de2c58a8fb03902b4dbc2fd01e15e", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639822468, "uuid": "25efd172-da56-4599-95fb-9c5f5f2a1fd0", "comment": "Malware payload (Quakbot)", "value": "3306882403faeb5e4b0dbb6a7c68e1136f70bdce272aea6a1161128ddaf30819", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639822468, "uuid": "98323b5c-78da-4450-a669-f249d25ea2df", "comment": "Malware payload (Quakbot)", "value": "b803e6b57b9bf6cb5008ea4688cc2a0135c30d07", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639822468, "uuid": "86aa2a52-9299-4675-b4a9-bdee0161e89c", "comment": "Malware payload (Quakbot)", "value": "9e93895ec7fb2512b1265da9e3ad25efff0b3668aabb4c5276c9fd3e1a0278ffad23ad1dc59499ee1c4f1de5eb87a63f", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639822468, "uuid": "dbc4ef07-f286-4f93-a4d2-6366b6c32d76", "value": "T171140209783CE8DFCB2B2532D608BFA7821B5060D9C17C2DA5C9784C5E51EBE7A8D58D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639822468, "uuid": "28537b95-a3f1-4940-af71-9b7419fb04c6", "value": "3072:OFcfEIz6t8weEGc33rk590Du99wpFlUz7o8NXKRlzpG7/UQXIqdtKcmIDYPIZE8o:OFcfEw6R9537k5WSOeME6rGj/m/58DDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639822468, "uuid": "dd681fb2-1b6a-46f9-be35-f0efdc0081e6", "value": 207249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639822468, "uuid": "15a7be76-3d57-4208-be29-a0d90f0d6a86", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639822468, "uuid": "1c7ee094-a818-4abe-8043-409fa727e8d8", "value": "BH-26947836.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b729ac10-5fe0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639817929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817929, "uuid": "06015993-c84e-430e-b1da-572877a69f90", "comment": "Malware payload (RedLineStealer)", "value": "547d03a9e0805b23a27d92b8f93c85d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817929, "uuid": "e0a0ae8f-3c58-4250-b337-cb1798a55073", "comment": "Malware payload (RedLineStealer)", "value": "337436e6e0d05430b7ea701871735f68d3df1e9aaca2dd3e1b4074bac5e9c6f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817929, "uuid": "c5440829-85e6-49cc-bbfd-aa88c3bb2d42", "comment": "Malware payload (RedLineStealer)", "value": "a84e46eb1e9e0694e1c33b9effa8078310c184dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817929, "uuid": "41fc118e-1ee5-4221-bed3-f2d51e690256", "comment": "Malware payload (RedLineStealer)", "value": "d62d7260965c7da94051aed6382df71275ffb815934d60d8b8256eea84718f2366c513297ba3ef76c6ce590759ab4b93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817929, "uuid": "87a83d4e-aab3-4f7c-8009-3ca29aa712c4", "value": "T136A4AE69B1D18E78D6861976B09BC0AC43D2A79423B2F7CEFD2B12532E0B351CC457E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817929, "uuid": "09e03b2c-2f35-4f95-8696-f24a4cea2d89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817929, "uuid": "870af9f5-442c-406b-b087-d6dbd1b34516", "value": "12288:jOWkQF26DxV+/O2I0607+7qZlE5XBLTwgt2uX5Lsu:jVNxIu0l+LBttnX5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817929, "uuid": "eec62738-0fca-4fd5-b98b-9fadf5c6b2f6", "value": 480496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817929, "uuid": "ad62526e-6848-4b9d-a22c-feb2ebddcb2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817929, "uuid": "9c715e79-f1c2-4af0-8291-3b46c10eb9f5", "value": "547d03a9e0805b23a27d92b8f93c85d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64b9074-5fe1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639818330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818330, "uuid": "1fd6ad07-a365-4d72-b85d-1cbbc1554a10", "comment": "Malware payload (RedLineStealer)", "value": "a04cc088c8b684cf6822e9a5f70be36f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818330, "uuid": "5638682d-d447-4222-ba5f-7acb1c85805b", "comment": "Malware payload (RedLineStealer)", "value": "33ba74ef9c6a96c68a0f95f518df17cfe61126d9605c483100661752440c47ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818330, "uuid": "50113c44-6239-48e5-a574-a7026a88c370", "comment": "Malware payload (RedLineStealer)", "value": "791392da2b0bc8085109bfed56c5e8103b6ecf4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818330, "uuid": "788276ba-93fb-4ece-a31e-b8c47729c7b2", "comment": "Malware payload (RedLineStealer)", "value": "0c899746456dc73e6417d070983cbe28f1b83a8c3cc8c0e96cd35fdc964c7e81992cbe0dea9a76cc6f2a538637f4b6ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818330, "uuid": "da708c8c-6527-4ce0-9a01-61c482afb746", "value": "T15B34CF2435C1C1B2D4B7113084E5CBB59F793066077696D7BBDD2BBAAF202E1A3362C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818330, "uuid": "7e233840-e60d-4966-ae67-c836cd34877c", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818330, "uuid": "a155b8b0-0571-49ff-a2ee-ba9870bb0566", "value": "6144:BDKW1Lgbdl0TBBvjc/nmju0mXjRgpxUdhcITdK:xh1Lk70Tnvjcv90mXSpxMhcI5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639818330, "uuid": "51b3316c-a592-4c48-a7ff-450c54323103", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639818330, "uuid": "12abc2a3-0b5e-4001-99b5-7a656ad6e360", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818330, "uuid": "1b2911ad-d9fc-496b-ab1d-b1f8cf582b6a", "value": "a04cc088c8b684cf6822e9a5f70be36f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a33db3-600d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639837015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837015, "uuid": "b4adab1e-2dba-4822-bffb-21976a4ec65c", "comment": "Malware payload (RedLineStealer)", "value": "bfb96f49e08ba58a36a01a8d9f290894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837015, "uuid": "71280d61-e627-474d-9cde-53058accfa7e", "comment": "Malware payload (RedLineStealer)", "value": "33dbcd449054ac6c2580e7d8384f40425f685f554402fe4c30ca2ed83938fdc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837015, "uuid": "d6d1347b-696f-4ae7-899e-4d803ddd63b2", "comment": "Malware payload (RedLineStealer)", "value": "89cebdac8c188733c4aa002c4186d43b4bf01f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837015, "uuid": "4f1a8060-a3c8-47c0-bafb-85dd79cfc5e2", "comment": "Malware payload (RedLineStealer)", "value": "6db723c06d6f994230e4c4ddf0720c64c6411dc607a02470d716c02d7f4c0980c5035c54055973b4c9bed24a9f56b6c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837015, "uuid": "4c54bb5e-7e91-4b03-9c21-01c93193a945", "value": "T13794DF00ABE0C034F5B752F449B6D3ADB63E79A21B7494CF62D456EA4634AE0EC32357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837015, "uuid": "d67a6bc3-3dd7-4d30-9cd9-75130bafae81", "value": "97510e08b27860260a6b4085182271af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837015, "uuid": "f70e6212-4ab1-499c-b815-8564af92c7df", "value": "6144:G/H4UvwYogRhavtZSh7URusIGG+xdWnPbc4dtHMWJn:mYDQwVMh4IGG+xdWDc4dtHFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639837015, "uuid": "74e3d67c-504e-4f92-baa0-b04b2c513f56", "value": 419861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639837015, "uuid": "f5df95aa-d2cb-42bc-973d-a4581df93dc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837015, "uuid": "36e83c85-7766-49a0-b72e-23005a0bb47b", "value": "bfb96f49e08ba58a36a01a8d9f290894.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60480824-6054-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639867605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867605, "uuid": "ad7e03ca-23b9-4430-92e6-cb7eb3491a30", "comment": "Malware payload (Mirai)", "value": "353060d41ad98c80d0cbda161af0199c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867605, "uuid": "f4f5219e-6f86-4d76-943d-39b02958defa", "comment": "Malware payload (Mirai)", "value": "37dfc6473ccd77f2c29e99df130a0944590adc03e6b92a05a69398f5a33c4179", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867605, "uuid": "3ec0b82c-f85b-4cae-bb28-7890147eeecc", "comment": "Malware payload (Mirai)", "value": "c1a0ed318e8ce7aa380491f52eeb54489ba7d798", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867605, "uuid": "b1e4bb84-b77c-4838-b7af-6fabeba885f1", "comment": "Malware payload (Mirai)", "value": "bcebc86d7974163519aadd5eed3fe74eeacdfe66e0da72a902d274647c8dfd19411644a763db26140d32623eb975f922", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867605, "uuid": "48afeea6-022b-49d6-a246-8c045e4604bd", "value": "T151535CC9B8129E7CF6C7EABE88224F0DF921621150931B3BA66BFDC37D321599C12D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867605, "uuid": "a0bf69ac-a121-4dce-a23e-6af5b1620f6c", "value": "1536:s7gFIMnoOIMKiVbas7Djmg1pf7Qc8KABCaiAcIqo:Rnsujfpfkzxcho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639867605, "uuid": "336eee35-1a9e-436c-aca8-d16afd73c96a", "value": 65888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639867605, "uuid": "97604ef7-32fc-4444-aee3-7df4e757ac2b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867605, "uuid": "132b15b4-4d27-4410-a796-a5a97d425664", "value": "353060d41ad98c80d0cbda161af0199c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09f30b7-5ff2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639825729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825729, "uuid": "3d333aa6-b535-4462-8870-208bbafd5aba", "comment": "Malware payload", "value": "e0203b51d87a8e639415c3f20a067edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825729, "uuid": "1863a4ac-a1d0-4bd4-ba79-9793079639c2", "comment": "Malware payload", "value": "395d7b7f9e1658b5172a839f8b29b0f6443140a3898271171315c93b25da800f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825729, "uuid": "93da3456-5da9-4b57-98f8-86e1f711d6ce", "comment": "Malware payload", "value": "ba5fac6b3eec5eac101c2861e9f2ba95dc5eda6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825729, "uuid": "c099f925-1f90-4aae-90ce-c919b06e324b", "comment": "Malware payload", "value": "98cc3786396a897a36de17ea075f028a849b6d1fb97761cd642f306eb99cf16c812bd98e4ef550a0efd934a66ee95c01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825729, "uuid": "54857e10-b438-46ec-93c9-3df1b3a99f54", "value": "T1E614D18573149175D99C0E31DC67CF6009393CA2EC612B3F3266BBDE6DB236026479AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825729, "uuid": "cd474c42-8285-43f3-9e01-4d4b19161a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825729, "uuid": "de88708f-2024-4e1c-8f47-aad526413d4b", "value": "3072:r7NdBApncN4BnPVOds2Vlt3hg7rXZQG0cg7JjkLNCIei3EnTGD2QS5RKr:GSkVz2LJGRglkLNnei36Qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639825729, "uuid": "c2c9bcf5-4f4d-41b8-a456-7ad8c1d848fd", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639825729, "uuid": "5fff6785-5a17-49d5-b7e3-96854e025ca7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825729, "uuid": "087edf13-9a20-4965-b48b-173b5a04cbca", "value": "e0203b51d87a8e639415c3f20a067edd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3dbdc6-601f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639844786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844786, "uuid": "7d82dcb2-7dbf-4baa-ae11-6852e5c172d2", "comment": "Malware payload (RedLineStealer)", "value": "cf2d25d75bdc8221864cebd81b85cf78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844786, "uuid": "eb91aca3-acca-428b-831a-036bec26ea43", "comment": "Malware payload (RedLineStealer)", "value": "399d11839141f68de663edd779fc1bba0e2eb848a5b7eefaf8c65008694b94cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844786, "uuid": "b3034ea6-ee3a-461c-802f-333f5fc291fb", "comment": "Malware payload (RedLineStealer)", "value": "3bcb44294c25dd045f7cb68ac41ae6c72fd41178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844786, "uuid": "04d12d93-1356-4ecd-a820-4f9ad9b3b552", "comment": "Malware payload (RedLineStealer)", "value": "01bb8ba3a0b599359bb164952fd7d64d6397b893ba098e7cbf55060fec4f0c39b88b9aba9b815e2e661a22425e5d69fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844786, "uuid": "a73f3a6c-8504-47dd-9ec6-202628b3d032", "value": "T15484DF00BBE0D034F5B752F849B6D3ACB63E7AA15B60A0CB12D426EA5775AD0DD3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844786, "uuid": "5bcd73a1-6cb6-4854-917a-8007516051de", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844786, "uuid": "804c37de-7f16-4798-a515-daeee628fa21", "value": "6144:kexzTwaVLQ5CcQXJsa6OyPE9SXVk1BQ4X+OZd7vniBqJWBxZL2:kexQaVIClsa6OyKSXVkXQ4X+cJ+qJW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844786, "uuid": "b6b7f4e7-4a1f-434c-9dd4-e70f2e437896", "value": 406050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844786, "uuid": "ef6b1f31-ec0d-490c-9f45-028501366ec7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844786, "uuid": "af090ff2-25da-413c-9d82-056e8187d2bc", "value": "cf2d25d75bdc8221864cebd81b85cf78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0aeb13d-5fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639805865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805865, "uuid": "50e294d1-7c76-4f5d-b7c9-1a788c6a8eb4", "comment": "Malware payload (RedLineStealer)", "value": "ec1105be312fd184ffc9d7f272d64b87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805865, "uuid": "8032ab6c-f0f8-4426-8321-214f8c26881f", "comment": "Malware payload (RedLineStealer)", "value": "39cd27e2d57db8bfedfc31413679e5c4cb27274a45c0acb98c0ad81905729ca5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805865, "uuid": "b7ff9a4c-c680-4ccd-a7ec-c817377ed88b", "comment": "Malware payload (RedLineStealer)", "value": "3c6b70ab854cc46448b55d8a057698c4568a85e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805865, "uuid": "b3512e13-05d5-4d53-ad6d-1ddbd7639286", "comment": "Malware payload (RedLineStealer)", "value": "4b3a76e73d9282c623d21f5ffcd279125dbfee14a2a11078ac8f8f12b81600588c88ec17813056dc2b7b77476a106a6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805865, "uuid": "27a93e74-8fd0-4aaa-83fc-2980785c593a", "value": "T12293D0109770C823E4B34A3129757B67AFFD952122718F4B03205A5D7DB32D2AA1FBB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805865, "uuid": "302b19ce-a7b5-43fb-9787-d09f3924dfa0", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805865, "uuid": "5cf4fc52-55e8-42c3-9664-516d30ab3d08", "value": "1536:O/T2X/jN2vxZz0DTHUpouMJbL7xE+1nkhA1gq5iAYFh7z1N60m5fLsP/DsSTH:ObG7N2kDTHUpouMJbL7PaWRuNs0m5fLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639805865, "uuid": "031484d5-05f0-41b1-bb60-a94bb17b14cb", "value": 94424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639805865, "uuid": "4361e414-8656-45ea-9b18-070f0e502f9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805865, "uuid": "1309cfc7-e8d4-4574-b711-3ed42149a0fc", "value": "SecuriteInfo.com.generic.ml.1574.24425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ac9990-601e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639844500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844500, "uuid": "732e21de-b12a-4d9b-89c8-2f6fb898e699", "comment": "Malware payload (RedLineStealer)", "value": "f8628d51dee3fc11cab1f2bacc1459b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844500, "uuid": "fbf2c5de-6751-4518-9f90-0efec91bb3cb", "comment": "Malware payload (RedLineStealer)", "value": "3a5ee0f38713dc6892d62fc71b443cd939f49a8e8d43b3f541cc78c2d06ce1df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844500, "uuid": "958c1e77-abbb-4c69-a2f4-03f68560637b", "comment": "Malware payload (RedLineStealer)", "value": "1e354c69003be874cf31293dce232a7ab29964d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844500, "uuid": "484cd566-5b88-434b-8020-4515630c162a", "comment": "Malware payload (RedLineStealer)", "value": "816a8712ea3352e68bf5b34db4ae3f73b2e26cf75ee67bc25f3e4c6d8538a9a02237953741fffdf537df875430c9dfbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844500, "uuid": "9ae8eec0-5918-4a48-8b0d-04f2aa616a82", "value": "T14984DF00BBE0D034F5B752F849B6D3ACB63E7AA15B60A0CB12D426EA5775AD0DD3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844500, "uuid": "d696b635-80a5-4746-b13b-5086d617044b", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844500, "uuid": "95ce1ada-d818-44f7-b59d-492330d4745d", "value": "6144:kexzTwaVLQ5CcQXJsa6OyPE9SXVk1BQ4X+OZd7vniBqJWBxZL2:kexQaVIClsa6OyKSXVkXQ4X+cJ+qJW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844500, "uuid": "5d630f68-0635-45c4-8ca0-b76e89a082e0", "value": 406063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844500, "uuid": "f087d523-2f8d-4ab5-bd41-f31d6f6dab39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844500, "uuid": "0c688fc0-d49d-46fa-8d3f-1d1b426be3c1", "value": "f8628d51dee3fc11cab1f2bacc1459b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e557295-6020-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639845348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845348, "uuid": "e67065d6-6b00-4c75-87a9-1e363ad24bf1", "comment": "Malware payload (CoinMiner)", "value": "28c9847c97decba42e5e3a6a96de3ae9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845348, "uuid": "ccfe40a1-e1e4-4eae-b064-88a1b30cadd8", "comment": "Malware payload (CoinMiner)", "value": "3c526afe65855251c3efdb5b3be2d24f21f86c5297a2b398bea7188cfc944f85", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845348, "uuid": "974f260d-d9b0-4ff9-8cde-f05fbfc626e0", "comment": "Malware payload (CoinMiner)", "value": "51e816aa7597e633780a812de463e790b1d76226", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845348, "uuid": "8ef63289-9e4c-4e38-adfe-ba33ee43abe0", "comment": "Malware payload (CoinMiner)", "value": "2d6ac3fca41a9048614850e1f1bb2187322487b9b413a987d8d2c3aeda0ec225b1feac481a478bd04d5d23cfbf135c73", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845348, "uuid": "3264b19e-eee0-440d-a536-0c4885b57b62", "value": "T149549D00B7A0D435F6B712F849B993AD793F79A1AB7090CB52D516EA1A74AF0DC3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845348, "uuid": "cbe3a66f-c41a-4150-a752-9ca118137fef", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845348, "uuid": "8290a5ed-0f21-4a2c-afdb-bab948b6f428", "value": "6144:vSBFa1vBz/WTxQtvaWqZvphLuBQ1r4BHe:Kqz/WtQtvapZj6Q1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639845348, "uuid": "dd8de575-18a7-4578-bf40-c5bab31d1655", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639845348, "uuid": "dd1e2fc1-61b2-4100-8dee-47716be64d1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845348, "uuid": "98c14493-ea00-4d9a-9df3-4a6ea86ca683", "value": "28c9847c97decba42e5e3a6a96de3ae9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125e2901-5ffd-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639830108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830108, "uuid": "2ad59134-b07d-46c9-842b-509462b5f3ef", "comment": "Malware payload (Gafgyt)", "value": "e0d203a68c3fca0e09d107c5497cea5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830108, "uuid": "483f1100-8022-4015-81cf-1a01f1df5618", "comment": "Malware payload (Gafgyt)", "value": "3cb3cb20fe458a2456c8c9a32859e69a24a03260c467853de995de99415e64ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830108, "uuid": "150add6c-074b-452d-8f37-53a365d2fa80", "comment": "Malware payload (Gafgyt)", "value": "cd7146b716eb48e2a91f49210b6b16e52343a02c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830108, "uuid": "b5eabb10-8d6c-484e-befc-5d4c610a09ad", "comment": "Malware payload (Gafgyt)", "value": "dbc87055135d0e2fac80ab56fd9ccf9ec50e58b2a2b3f61d7505ae6bbf186df81a7a6c32363be553ac97704de557174b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830108, "uuid": "be761e02-33db-48e8-8ba3-5ce4d9fb5b8f", "value": "T10BA33B41FC41872BC3D327BAEB8E479D3B365A9467D733116A346EB42BC17882E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830108, "uuid": "c4d74b73-f139-4234-9bb6-77388521d479", "value": "3072:0ZxbJhYyLtJQtiCZ0ATmByqQ4DPdRXxme:GYyxWtiCVmByqQ4DPdRXxme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639830108, "uuid": "4218439c-9cd8-4a5e-86f5-d9f76a5ab7cf", "value": 105205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639830108, "uuid": "3687bd77-4374-41ba-b14e-37e19c79980a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830108, "uuid": "b72fdecf-e7b8-47fe-adfc-4b8878758ca1", "value": "e0d203a68c3fca0e09d107c5497cea5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87fc289c-5fe0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639817850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817850, "uuid": "42f95f6d-ff53-4350-bcae-e08e6d6d49d4", "comment": "Malware payload (AgentTesla)", "value": "3d722739c644ffa8d900aba2e3b1a393", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817850, "uuid": "dd2e3052-766b-40ac-a206-ee4640614ab4", "comment": "Malware payload (AgentTesla)", "value": "3cfcd1f17964ccc961760915dc1c28f9f8ca1e0cd0ed5704dcabc927deec5635", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817850, "uuid": "9615ad50-778a-4ee9-a338-51c89176e1c1", "comment": "Malware payload (AgentTesla)", "value": "81ab6a230b4c0aae361ecbffaf41360652c80452", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817850, "uuid": "51395e2a-dff6-4934-9ec4-7530400a15bc", "comment": "Malware payload (AgentTesla)", "value": "fd9f5c6b2ffcd58da4caba5f0aeca1739dd5ae2566366c60d5a377da516573624c772be48bdd9392919719cebaecd1c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817850, "uuid": "91fb1281-6609-4181-ad24-73ab26a7d19e", "value": "T1CCB412A857B0DB5FC0BF03FA103990918BB167A12313CF4B5A5D95DB851278A0E23BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817850, "uuid": "e96f4bdf-408c-4da8-af85-b4cea1110d1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817850, "uuid": "2859f890-6d1d-4ee2-840e-f44d59b872ae", "value": "12288:DGXWvgWMHxRnKO3hUkQLTHi846xUFFDuSK3vkmyyy1pWyjtGG:DGXsnMRRUkgTHwf6SK3vkdjGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817850, "uuid": "f9286595-4dc4-4b5d-9dbe-24a2f67073f0", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817850, "uuid": "81785055-93a6-4dc3-b688-fc9184a83827", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817850, "uuid": "dc06693f-35f1-4f0a-a8d7-c5b70a8c297b", "value": "3d722739c644ffa8d900aba2e3b1a393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e719d9-5f9c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639788605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788605, "uuid": "6cf4c347-bf76-4931-bcc2-550409ba3400", "comment": "Malware payload (Mirai)", "value": "85bbe43c79bd76bda6c0151b0dc84c80", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788605, "uuid": "7d7d6b24-722f-4df8-9b52-1735013cd86e", "comment": "Malware payload (Mirai)", "value": "3d069596dab4c4e66afe0e9049dc34520bc006363a043551328d04c226b36aad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788605, "uuid": "93bf8f5f-7128-4b1d-b711-01c8d2e8ae90", "comment": "Malware payload (Mirai)", "value": "dd2d4585bf228f0e9641ab278d3b1657b631987a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788605, "uuid": "10b65dc5-f5f5-4661-812d-f77c48db8737", "comment": "Malware payload (Mirai)", "value": "fe8cb2fe6a132430862210fa9b3a8f12a2be157f87a8ef6938b92da857cb122ad0575ec0b6ce71f9735719195c06199b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639788605, "uuid": "20b2dae0-9321-4806-9237-1c3f0c4dc175", "value": "T176334AC5D9C7EDF9EC110572306B9FB39ABAE5BF2054EA83D39969329E02602D10735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639788605, "uuid": "16647b35-ddc5-4e09-9caa-ae92238d7a1f", "value": "768:ZIsROoWHDBQzUVUAReTsXtOU5h0zVM7aKSJl2qDk+ahYd3:ZHRuDBQznARdXfqpK+bDk+a+d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639788605, "uuid": "42fdb931-5306-40d8-9f78-b7107bfbe6fe", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639788605, "uuid": "3741c8a4-0673-4804-bd65-6eb76b19c7a5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639788605, "uuid": "54f5641a-ad41-49c7-bd39-71c3ab81de7c", "value": "apep.x86-20211218-0050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f52f31-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639844171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844171, "uuid": "b8bfc354-5f69-4353-bc64-8dde80f46e09", "comment": "Malware payload (RedLineStealer)", "value": "a88247536b9af537ecf6578b2a7b3c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844171, "uuid": "486a21a2-2ff5-473d-9671-1a8c86a1f8f5", "comment": "Malware payload (RedLineStealer)", "value": "3d8c5dc7efc47cdd8128124d09ff1316bf60f4d600b8e7ffa793de9fcd32faf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844171, "uuid": "1431c81c-2ac9-4a34-85a5-5c5301f5b0aa", "comment": "Malware payload (RedLineStealer)", "value": "13b5ba5ea1ef89000a86de462f42d6ae37731ce0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844171, "uuid": "cc27db1c-9d05-4479-98f9-d8fda3916718", "comment": "Malware payload (RedLineStealer)", "value": "220c1775c5ccc9cd7a227a8b7b09e5c21cbac8627ce7b4c2e41a3a2ad78096413cbfea2e2b657d96663d0966360b8ccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844171, "uuid": "6b0f2a80-fc24-46cf-8b31-f5058e941d0e", "value": "T1A284DF00BBE0D034F5B752F849B6D3ACB63E7AA15B60A0CB12D426EA5775AD0DD3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844171, "uuid": "06acc57e-72f5-470f-a35e-855a101782bc", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844171, "uuid": "90bd0695-1a3e-44e7-9d48-e18f5ef1a2b2", "value": "6144:kexzTwaVLQ5CcQXJsa6OyPE9SXVk1BQ4X+OZd7vniBqJWBxZL2:kexQaVIClsa6OyKSXVkXQ4X+cJ+qJW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844171, "uuid": "1564aa58-221d-4e1a-ba31-70ae924ca999", "value": 406069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844171, "uuid": "ad487c9d-bd2a-405d-a787-20cfe656ef93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844171, "uuid": "3878f81e-9b57-404d-8786-68a3e387e233", "value": "a88247536b9af537ecf6578b2a7b3c4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9451b801-5fe1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639818300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818300, "uuid": "78f9eeb6-1104-417e-be71-b188d1b575e8", "comment": "Malware payload (RedLineStealer)", "value": "743f552162e8959725c5c70715285500", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818300, "uuid": "4eeb00eb-75bb-40e2-8a4b-26d7e03336f4", "comment": "Malware payload (RedLineStealer)", "value": "3dbd5487b19aa019bade16d9061195230b742a45ddb2e411d0e6b7fac6778e17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818300, "uuid": "3df70603-c88a-48bb-a6fa-5019c8d1448b", "comment": "Malware payload (RedLineStealer)", "value": "dbe026d99092bec815874ee5b8474d8f0a5ca5ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818300, "uuid": "79b5791e-31c0-4dd7-9a09-acd38d7a50f7", "comment": "Malware payload (RedLineStealer)", "value": "372b7698692b1b78367682958e86d5e939e657ce4c3ecea0736f5e597ae3f24f9706ebe7258d4f3c65fce07ee4df6f5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818300, "uuid": "89682c37-e39e-40aa-9554-e530b8d9e01e", "value": "T133B34B6077CCD914E7BE4E75B8B1519883F4F0132911DB4F1EC654FE1EA2B80AA12AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818300, "uuid": "5e631e47-d5d8-4c3b-87e7-9b8b549f453a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818300, "uuid": "07c6509e-dda6-4e7d-89d7-934d87c99fc1", "value": "1536:ZmxG0A1h+HDoeuL4KZ7mv06VodjY22bZDKX/Jjd6bx4J9200TQ:ZmxLAeHDNuLH6vu8N2JEs89Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639818300, "uuid": "c1b1b253-5d79-4283-87d1-f417d2e51231", "value": 108792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639818300, "uuid": "c0a03c99-5b81-442e-8a29-530086462623", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818300, "uuid": "c9e326da-222b-4799-9b73-d18a1c6b9a1f", "value": "743f552162e8959725c5c70715285500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb42ccf-6024-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639847223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639847223, "uuid": "5fb678b0-8f3b-4006-9583-ec56eb01a874", "comment": "Malware payload (DCRat)", "value": "8d5f9fac6d34b4ba93abab5ca9287e22", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639847223, "uuid": "76795ba5-f547-42eb-904a-a4de2135c915", "comment": "Malware payload (DCRat)", "value": "3eb88ccf98c7ffb98a9d5bbe833afba24569faa7055285b7718484fcb96d03c6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639847223, "uuid": "d2a867e0-2c2d-4e8f-bc4a-eab3369d0710", "comment": "Malware payload (DCRat)", "value": "24b527e1a70035eb8fa52d3ab33b50faefcd774e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639847223, "uuid": "8f532518-5a3d-4dc1-867a-354290e004fd", "comment": "Malware payload (DCRat)", "value": "c75964c70df71de8c738187a3974c9b1a02b9f49c5936a0430cbb7f5556a1af63c6aaded4ec624909308bbb9a4851df5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639847223, "uuid": "9ff55b6b-033e-47cd-8b90-3d5dd1720e8e", "value": "T17A549D00A6A0D036F1B752F859B9E3BCB93F79A16B7491CB12D116EE5634AE0EC70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639847223, "uuid": "ca3f1a1f-e140-4ac7-95ea-58f514f8a8f1", "value": "fffb3573e6a31c80ef6af28a69351bf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639847223, "uuid": "2e04e8a1-7ff9-48cb-8d97-70c4298609cb", "value": "6144:1gHgTAg2LOXG8adyTiyZXVB28reF4cxOq:1Wrg2LYG8aYTHf28reWcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639847223, "uuid": "9ffce327-1ebc-4b9d-bae2-e9e0577cb00d", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639847223, "uuid": "a0a7d936-2fc4-4c26-b8fa-c450c97097dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639847223, "uuid": "32ad0cfd-90dc-4489-8865-8636bae792a6", "value": "8d5f9fac6d34b4ba93abab5ca9287e22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c67eb6-6020-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639845411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845411, "uuid": "0c58e38b-5153-4693-b0a3-08b348379888", "comment": "Malware payload (RedLineStealer)", "value": "8654dbd15a6d99cb42fbb3f02620ceb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845411, "uuid": "47bc5f53-b025-4275-90dd-d5ccaee1dcc7", "comment": "Malware payload (RedLineStealer)", "value": "3f60cfb9ecacbd32e81a2ae526f629585b35a5070c4158ddc76b5916322c251d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845411, "uuid": "a4c4cfa8-5dd4-434b-94f1-c19d413bd157", "comment": "Malware payload (RedLineStealer)", "value": "477333525d602ca483587896083d09a296efa1ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845411, "uuid": "5c6b0cd8-0858-4568-a962-9e00e7f69f73", "comment": "Malware payload (RedLineStealer)", "value": "26690caf222cae4e1bebdfb7b7e1f00350159ac6dd4f3974010030be49f22a12b23e6c5d6545e3ccfa2cd2754e747d2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845411, "uuid": "c4b373ca-f227-44fd-98cd-dc8da613e202", "value": "T1E784DF00BBE0D034F5B752F849B6D3ACB63E7AA15B60A0CB12D426EA5775AD0DD3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845411, "uuid": "2ac252df-4bff-4bf7-a65f-7a2407fbc225", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845411, "uuid": "dd510409-f850-4c10-beb4-ac612298450a", "value": "6144:kexzTwaVLQ5CcQXJsa6OyPE9SXVk1BQ4X+OZd7vniBqJWBxZL2:kexQaVIClsa6OyKSXVkXQ4X+cJ+qJW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639845411, "uuid": "8cfcd3dd-1065-4c83-b7ff-861eb66237f3", "value": 406060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639845411, "uuid": "8dc5784e-3b06-40c6-b88a-b5115c8948be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845411, "uuid": "cb42af5a-9fb6-441c-9f12-279ee3fb1257", "value": "8654dbd15a6d99cb42fbb3f02620ceb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bdbf730-601a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639842767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842767, "uuid": "0a41a864-6792-491d-ad53-d310e91a5e9a", "comment": "Malware payload (Mirai)", "value": "e9bdacdab585d4b8748e1dafbf698817", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842767, "uuid": "f40bf692-fc43-4114-b022-af6fc0ce04d2", "comment": "Malware payload (Mirai)", "value": "40ed0a0275de955175da8a3c8393398684a60578e64888cb3a5f5617dda00085", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842767, "uuid": "9d5169ae-7f82-4d68-b7ac-4be4ab81943f", "comment": "Malware payload (Mirai)", "value": "587e947f3cc2486dc6b9c88ae8f2743431d80e6c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842767, "uuid": "ccec9f32-e06f-4e8e-8d69-a42ef9731232", "comment": "Malware payload (Mirai)", "value": "027c3642f72bffa43c5f7ccef609ec50414b0b251ed9780f451eed546af1c8b47f91022e728788b7c629810e50d3d51d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842767, "uuid": "10360f5d-69f0-4a58-b44e-a4f6d99a1fe9", "value": "T1A7F2E168930085BEDC2E803E32D937F99D7745F26371210FA2A1556BDE6631A7072EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842767, "uuid": "93d5c137-3ca4-47da-bf89-735aa2179786", "value": "768:4oCNWYdyDMklX/jhPiS0t7A9gdkOgqOnBJgGlzDpUYsZp:4DFdaMaXc7AIOTVqYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639842767, "uuid": "ab57322e-153a-4f56-9913-40e299ec538c", "value": 35044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639842767, "uuid": "399175df-f3a3-4ef7-8e02-34e84b4043b5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842767, "uuid": "c65838ed-ea8c-45c9-a2f9-72c8990f3220", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fd1fcb-5f97-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639786547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639786547, "uuid": "09de9fa4-d95a-46b4-ab5e-c5fd0fa48c0f", "comment": "Malware payload (RedLineStealer)", "value": "a361d0ab7facb9cb9d4f4508c45e7514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639786547, "uuid": "e2c7339f-8ccf-4ba1-925c-112281dc44a4", "comment": "Malware payload (RedLineStealer)", "value": "41f98a33b862b72dfa91c3f7757f5d3760418582809a310f1a2d52e3012e2f5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639786547, "uuid": "e2922555-a688-404a-8cfc-72e60d192e40", "comment": "Malware payload (RedLineStealer)", "value": "1cef8d3c3003278d875338ee0426467d5a5e151d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639786547, "uuid": "c483c084-91c3-4f0c-9146-7a6bddd2c826", "comment": "Malware payload (RedLineStealer)", "value": "1139dadcfba739c3afc002c3a19db84f31258032cee5a23baca61daa4bf279645fabdc308b0dd4a5fb0bff0a878cab4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639786547, "uuid": "5515a09d-5522-4860-be07-407936fcd2f4", "value": "T1457633E766B43D23E59F8071EA3C49A268B81FC001468AD1E7C76D8D294E674B01F76F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639786547, "uuid": "ee614c96-b407-4b38-944d-cb26a7e04482", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639786547, "uuid": "7a3da9f6-a4c7-40bb-bb00-9b2eab4f2cef", "value": "196608:Jh5scqaiAWAEQRUC9loenRY9YSyWytAe6D:JaAfuC/oeRUdyLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639786547, "uuid": "224c4f7b-279e-454a-a379-fb2755723fd2", "value": 7636428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639786547, "uuid": "d21f0baf-10c8-490f-9946-38911f2e51ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639786547, "uuid": "49cbd538-bf0c-4fbd-8739-9f21e885c7b0", "value": "a361d0ab7facb9cb9d4f4508c45e7514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3de835c-604b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639863906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863906, "uuid": "454368ea-831d-41c4-aa1e-a83a35d2c008", "comment": "Malware payload (Mirai)", "value": "b536ac5063a047863e64a9e91f2ea1ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863906, "uuid": "3a804d0e-73d1-43be-9409-eae1b9d425d6", "comment": "Malware payload (Mirai)", "value": "44825ee342b036acf0805a94f0c8e18d6a7c83b4f60bc63bbcaa0a9f611c31fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863906, "uuid": "9b608e96-8384-4af9-adcf-98ae7ab9e537", "comment": "Malware payload (Mirai)", "value": "d5b2344cc11a7de21bc7906e35e06c9a9b4ac29e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863906, "uuid": "cb8df60e-e94c-4306-8ffa-3ad93ddc0ae1", "comment": "Malware payload (Mirai)", "value": "66bfc0c15f655de600fe53b53cf45a1e94255d744126eeb207669df4c8afba8e5bd679ea082c40b9eda8c4410054880b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863906, "uuid": "794850f2-2ca4-4a63-b751-74d279d64efe", "value": "T151B34B63AE9A8C27D4A4FE3A91FB8370F0B3478520780B2D7D230D4EDB3575525676A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863906, "uuid": "86a74f1b-0ffd-4df6-8edc-0d72f8756b9f", "value": "3072:6+WueYbrbM0JclbatbVq9sbExW7M8GZlRvtuywE5LmN6fNKZwMjzN8O5GITO1:6+WqM0JclbatbVq9sbExW7M8GZlRvtu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639863906, "uuid": "020cbdf1-274f-4728-8335-ca594980b7de", "value": 107956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639863906, "uuid": "5c60c503-b40b-4c02-a717-b0b2dee39046", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863906, "uuid": "ce8ed5c0-8a82-4bd5-b1c4-4163b37f60e2", "value": "b536ac5063a047863e64a9e91f2ea1ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98a98bd-604d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639864721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864721, "uuid": "12ccfd36-b408-422f-9895-952ac5fd703f", "comment": "Malware payload", "value": "ae72d3f74514ce222a4da33f2b759fca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864721, "uuid": "d1ff82cf-18a1-4efb-8b1b-ed4688b73ff3", "comment": "Malware payload", "value": "44d3715b74d4162d3407fc4dcff4dbd67eb390452700cd2628a63399cd39979d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864721, "uuid": "2d8550fb-eb7a-4833-813d-db80c2f30d7e", "comment": "Malware payload", "value": "c13033d73efbbd1305866ce4c43791579647807d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864721, "uuid": "39c32ff4-0f49-4f03-aafc-6378d1f53755", "comment": "Malware payload", "value": "8d43b5f891573b3e0267353b93e9d1c7760620a79f35add2e44b9ffea86927ccda07630312381e13a1b1ae188c2cbcfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864721, "uuid": "54406cbd-2e6d-4f61-969f-bc6c7ad814d5", "value": "T194A6339273C4A273F817C630CADB4206E93ABF7097B4908E5BBC1B7D59759638B14B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864721, "uuid": "0ab399d9-5b8e-479a-ab52-ef2e65ddff36", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864721, "uuid": "f3f7701c-d3fa-495b-b7da-50e7935284b6", "value": "196608:2LGcy7Y9Yq6jHn0iVh1D6ArdxJDGdkcQDf7ll4o2vigCDznVtM8WH1:Bcyk6q64iVOAr31G+cQ/rX6vUpix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639864721, "uuid": "c6b3cf86-0f6b-4345-8cc1-ecf270778478", "value": 10386442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639864721, "uuid": "4bd42c93-a80d-423f-bed6-eb4341ba9b07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864721, "uuid": "de13575e-36d3-4bc0-bc48-cecc62a7ba31", "value": "ae72d3f74514ce222a4da33f2b759fca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7b4d9c-6001-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639831839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639831839, "uuid": "cdeb5d85-5afc-4d33-a1e4-b5b70395a01c", "comment": "Malware payload", "value": "ef7de8e17a46bbb875ff5b48a5111f75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639831839, "uuid": "6a9a710c-6fb1-4243-9053-3147197876eb", "comment": "Malware payload", "value": "4563e5ab64572adb62bc0e4e6c472b4c6485c9e5af3aa40dc17d84170c442e82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639831839, "uuid": "2b3d73c2-0b4e-47e0-8dcf-a76766d3c09c", "comment": "Malware payload", "value": "1758ad8c4574dc8aba71ef4e541dd78579853826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639831839, "uuid": "a65245b7-2d46-40d3-865f-243a242bdc5e", "comment": "Malware payload", "value": "ccb73bb9d4e9e13c01a8749e7a8927bd1365f098954424a24481a9c3f1f7701de64f345f8e0d1fb840ef5eea845a617f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639831839, "uuid": "955b2bfb-0540-44e4-a154-75a94ae03ebb", "value": "T1B6D633B725C1EAE2CA7973F2AE55244006326ABF19815A21F43F5FE38A8214DF7F1345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639831839, "uuid": "a859d3d3-6b52-4b11-b0ee-38412da483fb", "value": "71f86d478ce18ebf5f499dcb0317dd4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639831839, "uuid": "46cbd785-06f9-4f67-87b4-ed6db6591cde", "value": "393216:4FRDuf4arU6YVpw/EtYBEUvX78WXl59k:ERDwzrULTlUP78WXlHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639831839, "uuid": "59abb3ce-3e02-4ff9-875d-4b7df3b0cfed", "value": 12615680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639831839, "uuid": "704bd449-f0a2-4fb6-a39c-03c9ad9ed920", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639831839, "uuid": "1aef0670-ba20-42f2-9561-d615833e1917", "value": "imgengine.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde3e9b1-5fdf-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639817564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817564, "uuid": "3e46bb52-b208-4ce0-af5a-f0047dae3443", "comment": "Malware payload (RedLineStealer)", "value": "93db4d17d9669ff93c54a3785f7a21db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817564, "uuid": "99ac46ad-8371-4227-90ff-4763f930e50f", "comment": "Malware payload (RedLineStealer)", "value": "45752903cbc98f5dd07c94dea481eabf17a7b2b659a60fdfa619fea7f7eef2e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817564, "uuid": "01c8cddf-4f3b-4444-8aec-9d06d2d1fdb2", "comment": "Malware payload (RedLineStealer)", "value": "fc5b536d924a0d1dc61628101599a97b86f31b7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817564, "uuid": "e5a22b26-6c74-4f00-b907-d84370e97a7a", "comment": "Malware payload (RedLineStealer)", "value": "fa2ddcf20d63190f05f0d35d66ff2a6734da04a17e6b1309aafb71709c9fc25f0e13b9837136e53e1ac378c194abf518", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817564, "uuid": "14ebcad6-7b76-42da-93af-6981f978f03d", "value": "T1DB94DF04BBA0D034F5B712F44DB6D3A8753FBAA26B2494CF62D526DA4A346E4DC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817564, "uuid": "651c649b-3b2d-40af-8f35-785e3b0df274", "value": "cd2e8aca313b88a16bc7b305a3f26143", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817564, "uuid": "bbb4a693-3f00-4e6b-bff5-e5bdbb6376d1", "value": "6144:xe7JNLtZXhjwNjndQBvVDFcK5ykXWxpyk11EcQx06SnBz:oJNLFwhd4VDFrykXWxpyKEcQx07B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817564, "uuid": "0198a776-7187-407d-b8eb-2d25f3363a3e", "value": 419901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817564, "uuid": "a406ba2e-b3e6-449d-b29e-441d297abd7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817564, "uuid": "10688c3c-42e9-4509-8b01-74eab2fec203", "value": "93db4d17d9669ff93c54a3785f7a21db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2bd464-6002-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639832592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639832592, "uuid": "6907f6ec-b9b5-444c-b79b-25e73cc40ee5", "comment": "Malware payload", "value": "b99c4684f7eac1f2af37e6de609e936c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639832592, "uuid": "8ead9318-6801-4c87-82b1-0dca1b6c6cb8", "comment": "Malware payload", "value": "460b096aaf535b0b8f0224da0f04c7f7997c62bf715839a8012c1e1154a38984", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639832592, "uuid": "02fd8a7e-6d84-4dd6-9547-193b0dcbc115", "comment": "Malware payload", "value": "5cbec4c736541179b6394d8a56074fb5254e3fc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639832592, "uuid": "7febfc08-6a4d-4f0a-80e2-cd33d9892283", "comment": "Malware payload", "value": "2d5dd6e074c09079b3d60c80d9985794e871a1674fdab98b9085dded21a82ad87cddbe51dab7d842da700e8a5a3c32c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639832592, "uuid": "17fb4c01-c22e-4c4f-8598-722c15f03520", "value": "T169E53A03F89551E5C0AEE231C6A592537A7278A8173023D73B50EEBA2F73BD46E79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639832592, "uuid": "e4eb60a6-3ff6-4e54-9467-95c7a7263da6", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639832592, "uuid": "d4b31b00-6de7-4e98-bde0-0adb4236d83f", "value": "49152:a2gvvg8IWjrb/ThvO90dL3BmAFd4A64nsfJ0uj5cTQmk9OigmQyScCgAUIOGwTqB:a212ujOTgAiffIRwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639832592, "uuid": "b3065880-c193-4265-a7f2-878d485fce5c", "value": 3190272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639832592, "uuid": "168a0f5d-cb65-42a1-ae85-50880d1c4ac1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639832592, "uuid": "28163a32-05b4-4b90-b5a2-e59b905ea86d", "value": "ransomware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9a2a44-6052-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639866709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866709, "uuid": "5c7b7a1c-19a5-48e3-995b-0f73b6c0abb0", "comment": "Malware payload (Mirai)", "value": "6d5e431f986849a81440a78328376029", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866709, "uuid": "90770753-0705-4f6b-a9cb-9bc64df1a641", "comment": "Malware payload (Mirai)", "value": "4626757d3facdfd18ead51ec7b8850df1fd4d66b6287ddaedb4b8cdc3cf1aec3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866709, "uuid": "1b3c6cb8-75c3-43b8-aabf-84da64b9ca0d", "comment": "Malware payload (Mirai)", "value": "f0b7af2bdf7a297423510dd8abaf8e99a851262a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866709, "uuid": "50d94f06-22af-462e-8f87-6b3cb8d3ad97", "comment": "Malware payload (Mirai)", "value": "48eb0d5c27fb6883a6f88edb84ead1c6d3e6bfae25f06fe48be265231f84f8461e61a5b8beb5904b1a595077e57bbb4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866709, "uuid": "74af4a87-eaf1-4dfd-8517-bd31a3a43d98", "value": "T1DCB3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866709, "uuid": "d03fee8e-e96f-43b6-9fd5-78bb98e3970f", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZecmm/QcuLB126DNb:YuFX0GIk1MHyphpmm/QcuLB126DNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639866709, "uuid": "ab6dae46-828b-4e39-bb26-d268f83d8095", "value": 118091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639866709, "uuid": "3d5e3152-5676-4954-a87a-3531e4223d04", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866709, "uuid": "dd2b5d11-8f96-4071-ab5e-a056d0dc6dde", "value": "6d5e431f986849a81440a78328376029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df64adfd-6024-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639847202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639847202, "uuid": "f5e4af6e-2c10-4632-a63b-9af3a20cfef9", "comment": "Malware payload (RedLineStealer)", "value": "dce9395a8c33b309ea9156f2f411193e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639847202, "uuid": "b7a072b4-5e4b-48a3-95e0-35c77a2d3e0c", "comment": "Malware payload (RedLineStealer)", "value": "46cb157a5907d5bc4e3740d5381da23f91607ad7e55a308bffc2c1cd3e74a2d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639847202, "uuid": "acf1e6a6-e3d6-4b25-b33a-b7e63752f88c", "comment": "Malware payload (RedLineStealer)", "value": "2cbfd507c7408d670bbb600bf15274de35514df2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639847202, "uuid": "929f3cbb-4833-4f13-a67f-b2e6bb1d4148", "comment": "Malware payload (RedLineStealer)", "value": "60ddc31a94c766422fae9ddff228f0419259598892a285ca8a086689bea23d01c616206507fc5eca78d83875daa07923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639847202, "uuid": "79e9ace5-ee77-45c2-a59b-607512d14dde", "value": "T14C84DF00BBE0D034F5B752F849B6D3ACB63E7AA15B60A0CB12D426EA5775AD0DD3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639847202, "uuid": "0eedfe65-efea-4c28-91ab-0bc067beecc2", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639847202, "uuid": "3714cf5a-2c1c-486c-9a32-2073c7755f4b", "value": "6144:kexzTwaVLQ5CcQXJsa6OyPE9SXVk1BQ4X+OZd7vniBqJWBxZL2:kexQaVIClsa6OyKSXVkXQ4X+cJ+qJW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639847202, "uuid": "42534731-f798-4f20-a73c-d0c43c9ea8f5", "value": 406073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639847202, "uuid": "57bd9b98-5c3a-4d61-972b-c444028ee7f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639847202, "uuid": "15bf8fe5-7979-47f1-9f45-bef93044ebd5", "value": "dce9395a8c33b309ea9156f2f411193e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfcce1c-5fc2-11ec-9275-42010a9c0029", "comment": "Malware payload (GCleaner)", "timestamp": 1639805161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805161, "uuid": "6510dcf5-8ff4-4fd2-bd85-fbf75bd1021d", "comment": "Malware payload (GCleaner)", "value": "aa88b9b2f738c62fbaedc19802aa05c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805161, "uuid": "de0d1e3d-82f2-4084-b4fd-7998be20095e", "comment": "Malware payload (GCleaner)", "value": "46eb7b113f08caedc20b3b15cc04af0b9ac671d547afda4edce2d5a131929e29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805161, "uuid": "c8f0974c-9904-44c3-8406-52068c5d2a38", "comment": "Malware payload (GCleaner)", "value": "178020e586e365f47c2d5e2c10b33dc6de8d7b90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805161, "uuid": "00a56295-a909-4407-a73a-e042e63b2044", "comment": "Malware payload (GCleaner)", "value": "eb82292c109da72d261290ea764bbfcad7d546b9d5dedc01d5be69eb8fcbcfdb251613f3fff7d4f186ad6b26237da6dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805161, "uuid": "bbfd7fd0-4309-4451-b942-f697abd4e979", "value": "T1C67633017A7290FDDF46927C4A997772D515020C57278AAFFB94CC8C9FAA99F80CAC43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805161, "uuid": "ec75dbd4-176d-479a-b561-7eea15958e86", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805161, "uuid": "9520bd6c-b52a-4738-ba57-ecdeedadd66e", "value": "196608:xuLUCgEO8Bz2Ne5OV7qBUiuaf6Fw8ap4EM/Pjr:xWdgP9Ne5OVGdulwRpTM3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639805161, "uuid": "fc588a0d-98ee-436a-95cf-902ac4e22b93", "value": 7594983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639805161, "uuid": "633d6487-5472-4c77-a66f-ab536fb85b5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805161, "uuid": "2610da32-c023-450e-b5a3-a97382464ba0", "value": "aa88b9b2f738c62fbaedc19802aa05c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac51315-601e-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639844456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844456, "uuid": "7f981ffd-3a4c-4486-bae0-763fa5dcc0a0", "comment": "Malware payload (Gafgyt)", "value": "3c09bd8271f9c50881a6300eba04ace2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844456, "uuid": "296371e0-7771-47c1-8069-654202233512", "comment": "Malware payload (Gafgyt)", "value": "4718a5027c4aaf32a01596347420c91c14259ad4ff80ffa38c9c0e7a708a90c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844456, "uuid": "d6ce0702-c25a-4786-8550-d6a586d0d273", "comment": "Malware payload (Gafgyt)", "value": "14202f40b9e96b6771e11c5d3a298428fdac1dd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844456, "uuid": "f15ff9fa-b0e4-45cb-8fad-c6d912ef7932", "comment": "Malware payload (Gafgyt)", "value": "1fe05341f7f109d78e112ec291e70cdd27b77a500e4e4844b5e8785bbc15987867751b1ec1aeda7faa63c7d4ea6b1945", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844456, "uuid": "99e8cd84-17d7-4af6-a5ab-d2e3144aae7a", "value": "T15B735C85F4018E7CF587EABA44264E0ABC3022919BE30F2BA677FDD36C731696D06D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844456, "uuid": "066cfa50-d842-4dae-9c4b-1aadb0906656", "value": "1536:PWpfrQZxU7JbdCfNVXNJMcB6LL48c2c4DdC4EltCrsiC:PIvyNbm/zg4iIIiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844456, "uuid": "bf459883-311d-4cfa-a510-d5f80e581fac", "value": 76984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844456, "uuid": "ea73f2b5-ea97-4527-8597-4ff01b63e866", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844456, "uuid": "3d988b2a-79dc-4af4-88c6-49cc2bb11a3e", "value": "3c09bd8271f9c50881a6300eba04ace2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec623b9-5fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639805862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805862, "uuid": "92c5dba0-5a74-451b-a7ca-ad03a5a66f34", "comment": "Malware payload (RedLineStealer)", "value": "ccfcf8bb4d0336c10ec44edb386c61a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805862, "uuid": "670e5cd2-3b93-4d06-a073-197b0e5f5ba4", "comment": "Malware payload (RedLineStealer)", "value": "473145d3c53473d449718f52b445112ab16366285dbc798a4e3a658010f96545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805862, "uuid": "a97e1cc3-5276-4ee4-ad52-b1f36ea78dc4", "comment": "Malware payload (RedLineStealer)", "value": "badf3c1857c3c31b5616ffa5b81de4d6b4bfea9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805862, "uuid": "10387d53-ea29-4b59-b7d6-9833357a3eae", "comment": "Malware payload (RedLineStealer)", "value": "1c23605a44a57f333dfb31ec7218c6e1841e5a4a6c3880852540281400fb01a140682a1aead022a9730c27298da2c607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805862, "uuid": "4e576a49-e9aa-4f79-8997-8f24844fcbb3", "value": "T136C4D4383AEA5019F2B3FF759AE875DADA6FF6633703A15E105103864B13A81DDC1239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805862, "uuid": "485bcf63-6455-4ca2-8e6a-0f7eb8c36e1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805862, "uuid": "86d96e2c-a4d6-4968-b4ef-28c2ef407541", "value": "12288:ggU1PXuM6bIiEkz9usNaacyjwp+x7GeS2L7gKQhXwsFk:ggs68i1QzQgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639805862, "uuid": "909e84ca-9a8b-40a9-b33f-ecb4c3644484", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639805862, "uuid": "a77ad577-ef72-496a-855f-bad201d34dc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805862, "uuid": "9fd222de-b41a-4a0f-a8d6-fcf1d53ddd21", "value": "SecuriteInfo.com.Trojan.Siggen16.711.26772.20649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de136847-6032-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1639853213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639853213, "uuid": "f909b031-6b64-4c6d-a170-a605ef28708e", "comment": "Malware payload (QuasarRAT)", "value": "07bf7e2b60058908f6f03f8d8db3e24f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639853213, "uuid": "a5295534-a1ce-4d44-9579-5a12a1ed5e68", "comment": "Malware payload (QuasarRAT)", "value": "482e07d3f892882ed8921d6a0c9fa231d3d712643bf3ec92282ea956e5d0fc59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639853213, "uuid": "c55e324d-831e-400d-92a4-ea70a7e5aa2a", "comment": "Malware payload (QuasarRAT)", "value": "8c7905f82426815a8d2cee425c1fa1c967a0e943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639853213, "uuid": "a8a6cf1f-42b2-4005-9564-63d30a67d8db", "comment": "Malware payload (QuasarRAT)", "value": "7a82854fd76b8a39a13778c29478c81b3ca3976c9408ef57bdff572cbbda2f1ee66b0d87cd2d804627ebcfe151364106", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639853213, "uuid": "684aff5c-62b9-428f-a045-acc72a7f86e3", "value": "T1AEE32A22FF98866FD1AE02BBF09307218334D1C77502F7974B58A6A97E0B74C5D906A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639853213, "uuid": "e7a01330-b177-41b6-848a-7631d62c8565", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639853213, "uuid": "1b97c246-0b1b-4c54-b21c-cc19bfe3ce70", "value": "1536:ius0hO9AvvPXxO6ZVch1reofCvoArVFV8B3d/9XlRHbeXrp1FReADdgqg/aORVdo:ir0RXxOEGuwArXidtvjkT3Rie/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639853213, "uuid": "b6b32cb0-adf7-4898-82f7-c35a78477f93", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639853213, "uuid": "5d6b07db-3698-4497-853d-008f8fb3b4d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639853213, "uuid": "3dcf9dec-4f22-4655-bf4e-732f95e72bf6", "value": "8c7905f82426815a8d2cee425c1fa1c967a0e943.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567b1134-600e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639837523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837523, "uuid": "532b6182-3aab-4b3c-9b2c-45f15eed4abe", "comment": "Malware payload", "value": "792cef7a7b7a68ccd4348e7b17aae3a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837523, "uuid": "844fc064-2037-4b54-962e-e7729a232516", "comment": "Malware payload", "value": "4d0ebd85da282bb75b2439f9baa30c3ff3788e556c32713e48f786defe408eac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837523, "uuid": "0250335d-de5b-4946-94b5-4396745a5401", "comment": "Malware payload", "value": "9b90b4f292488b4b8df943f4937d4158f2c3d392", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837523, "uuid": "c3acf6df-3f9a-4ed6-9c3c-1f400a921e68", "comment": "Malware payload", "value": "015ce333b263b156e1298fe874e1536c381d7edf71f503cbf07cc4adb85b32092e02767e0fa8ef26e9567086f0fcd492", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837523, "uuid": "21ea7470-1ece-40c1-82dc-4ca836b10e19", "value": "T174D53381BA33A07BC859E3739195603E4ED11E06F887B54735A36AE49983B9CF3E35C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837523, "uuid": "34a6dd9f-9495-4e49-ba79-e442fb363c7e", "value": "42b27a080e9ee0252f310f33fbc7cafc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837523, "uuid": "13802fe0-14b8-4e1b-9291-0d6536d7103e", "value": "49152:+WzhAQy2352byFT6MFLbVdMyaITwKcJz+pDp539mmbbNThb390OQwP20mO4S2YkA:+0hpX52Op62RdeITjb5BbBR3z+3PBcmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639837523, "uuid": "8965673c-7812-4abc-8ed2-3c0b3eb69c1c", "value": 2806272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639837523, "uuid": "ab507d04-e230-4272-8816-209c1effae5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837523, "uuid": "b8d7ffe3-92af-40ce-b13b-02c5e4752b5f", "value": "792cef7a7b7a68ccd4348e7b17aae3a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a827e6b-5fa9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639794124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639794124, "uuid": "bccdd06b-7ca5-40a7-9fb8-3446e79b6e62", "comment": "Malware payload", "value": "c05f8b395c6356bf99aad9c84c13a867", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639794124, "uuid": "40cfafac-4b5a-48de-81b5-e08ddb8a486a", "comment": "Malware payload", "value": "4d15aa5d68b0e8b081c18d0ee5c06cc1758d17246a8d01b3c8ac48d1ef07610b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639794124, "uuid": "04b0bd95-0f34-4eed-8289-3859423956b2", "comment": "Malware payload", "value": "f1ac8fb3ef5a35a9c7ae11c3a56b84b90fb4a82b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639794124, "uuid": "1b578087-e537-4067-8bd5-cedda54337cd", "comment": "Malware payload", "value": "55673eac70b6ee90ad1c0e1f2c7a90b33281643f343d008261680dd11c98e9b00c6c25494971bd3f8c14b9496e669976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639794124, "uuid": "70b4bc5c-e366-4192-a3d9-0822680a63b1", "value": "T165E54B13F89146E5C0ADE230C66992537A7278A9173023D73B50EFBA2F36BD46E79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639794124, "uuid": "0e8c1ddf-0b53-4373-b1ae-635c2d8b4a24", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639794124, "uuid": "b69f7cd5-6bbb-4680-82e1-0e5e618345d2", "value": "49152:5gFr7gSNSZrb/ThvO90dL3BmAFd4A64nsfJaBR7c/D9JAndQYgoN6O3gAUIOGwTP:5g5yB1c7adpMIRwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639794124, "uuid": "8aad8014-f198-478c-8121-5496ba4559b7", "value": 3190272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639794124, "uuid": "5d9dda22-e5e1-4aa4-8c5b-242301a182e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639794124, "uuid": "d48018aa-e1b2-400c-9cd9-81e0a542a0c6", "value": "4d15aa5d68b0e8b081c18d0ee5c06cc1758d17246a8d01b3c8ac48d1ef07610b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc18c34c-604b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639863893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863893, "uuid": "56369354-1c40-4217-8305-67e692d2018a", "comment": "Malware payload", "value": "50599e9ac0a1f13fd64e14a16f7a909f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863893, "uuid": "5530d806-933d-4798-892e-63b16fee05e6", "comment": "Malware payload", "value": "4d4d856f20ba693221afbd1bf1255c725084365023e570d77b4bcffa0236b00e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863893, "uuid": "bc8e86cc-782c-4796-b912-bc33c58d29ab", "comment": "Malware payload", "value": "267b64e6652514b1ce973bc02f3fcf9f1b34a0b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863893, "uuid": "6338196d-044b-4bf7-8a8a-e06447d20548", "comment": "Malware payload", "value": "720459e5a050c769b4d7b45c5d42cada1421775c3a9147e3445c88d996c95950fc22a8db517ae1f37b022883d2ee5746", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863893, "uuid": "075aa795-d1ad-4414-88da-f2c38fe71fbd", "value": "T1C1F2F111E69C2C51C2F7BDF31862FB934FB116B42ABD86F245012B5688119776F04ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863893, "uuid": "41b37eed-778c-4b88-bb7b-f4e8c86f1309", "value": "768:ubz4xUxLpYRg84PiptFWSYVaBCbtCpD98Qr4uVcqgw02TWXm:M4xUx8gMFZ0Yf8Qr4u+qgw0cWXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639863893, "uuid": "9bf77058-536d-4a54-957a-befd189d0429", "value": 35184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639863893, "uuid": "96fa6141-639f-4ef6-9a3f-a3763f54a693", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863893, "uuid": "b40cec58-2fd6-411b-af46-c3e60ed28a81", "value": "50599e9ac0a1f13fd64e14a16f7a909f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7200a02f-5f9c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639788607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788607, "uuid": "688ca813-4903-409d-896c-7fbff5737d4d", "comment": "Malware payload (Mirai)", "value": "bd4aa660c4b329a37b316533d19bfd14", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788607, "uuid": "7f476eda-046b-41bc-ab37-cfe47afaeae7", "comment": "Malware payload (Mirai)", "value": "4e8d2550e2319c4b0572ff5fa824dabc16ad1d853f132f2e1e10b04184eba6a2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788607, "uuid": "0f972427-8da4-4de5-87d4-97590316b45f", "comment": "Malware payload (Mirai)", "value": "0c7873e210590b3fcda6bfc69c884d7540e29a41", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788607, "uuid": "045bb810-d9cb-41dc-ab78-f81665b170e5", "comment": "Malware payload (Mirai)", "value": "9e697d9dae82fd837269dcc2e9beb0c15eeda69faf7d40e4d92bdf92d191298e4efc90379731e76877a18a6da1885e5f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639788607, "uuid": "754d9c48-727a-4b8c-9a0d-9da8ecaf09ab", "value": "T1FB431956BC968A12C9C423B7FA2E018D332623D8E1EF33179D152F1177CA91F0E67695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639788607, "uuid": "ee798017-e40b-4280-be90-6eaab40576de", "value": "1536:5eFZ/meOSZMcpg2OqG4PJqaNcvp6cHiZnd:52Z/m4TcaGRZCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639788607, "uuid": "114110fe-1139-4701-b826-ce7acce9ed35", "value": 60152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639788607, "uuid": "4e948bc0-78bc-4ac5-a692-f3b5b2ea0e4b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639788607, "uuid": "3f612c62-6195-4899-bdd9-7857e5bebda9", "value": "apep.arm-20211218-0050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6f6af8-604b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639863598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863598, "uuid": "eec29ea4-1800-4eb3-a939-0cda6aa5fa6e", "comment": "Malware payload", "value": "b56b7a27fd509d39ce2185e0f7c94bca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863598, "uuid": "3d1e38cf-497a-445c-93e0-36992bfcc8ca", "comment": "Malware payload", "value": "4f4368e357e407f79326cb4e2f46ee8c264b5fd1b8647ff46a453fae39631f53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863598, "uuid": "400435ac-0683-4505-9817-29fa6a54275c", "comment": "Malware payload", "value": "af0d4a3a03fed4ab66c756fbe32099136e0c5577", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863598, "uuid": "e9150843-b0cb-45b3-aec8-3f66b72307bf", "comment": "Malware payload", "value": "2f67d6fed236034faec65995f914f143a383f28b55d5682ba8dc71baf5011eb013d07ad8aafc0e0b07893ecae2b3d096", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863598, "uuid": "57b78eb0-4b66-4b90-a114-e0b8731e44b4", "value": "T13BD5338239A37AC2DD4167B44B824043629FBA049FC5C389E31B99C58DEBD5D772BB1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863598, "uuid": "493587ee-22a8-4455-a857-c5bd4f4537f0", "value": "42b27a080e9ee0252f310f33fbc7cafc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863598, "uuid": "ed7f5555-5d4f-4efa-8372-2cfa67501ffa", "value": "49152:5o5zrhZ6zTpv+BHR+EmXLoJfSsN8wDb8VkKxZixO0eEKBfN:5INZ0wBHR+7XUJfSZe4VkdxOiKBfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639863598, "uuid": "bcf07eb5-caa3-448d-ba18-bd86a0cb4eab", "value": 2796544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639863598, "uuid": "b8483bab-2295-4879-9071-5217bbda02e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863598, "uuid": "49d6975d-dada-4b9f-a348-7a2a8ddd4dec", "value": "b56b7a27fd509d39ce2185e0f7c94bca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85222a14-601a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639842756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842756, "uuid": "7ee474d9-8772-473a-b3a7-5d07a626a28a", "comment": "Malware payload (Mirai)", "value": "ec4235c83583b0dce01ceae316803b4a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842756, "uuid": "71e5ddc9-489c-49ac-9145-4768c589f3de", "comment": "Malware payload (Mirai)", "value": "4ff51a1b040a46a0f1c16410baeeebf4fde9c32dad35a349e954672b5ad39671", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842756, "uuid": "6d5c25ac-bdab-4e51-b22b-700ec9c75196", "comment": "Malware payload (Mirai)", "value": "cd68f2580643f3f38d48f832a161378f697ab865", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842756, "uuid": "10bb44a7-2078-425e-ba8f-a26899b965e8", "comment": "Malware payload (Mirai)", "value": "3e2a0b14c18575ad4451f30d97691db87ec4834e841df2be174caa692f29582b1efc99474ade3856730b604dc76078ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842756, "uuid": "9f4bcf8a-e080-4276-88f1-e29cdd3d441a", "value": "T1F3F2E07180E6CF5ADEAD95371C9FBBDF0990AB6285CD42A6FED0756AC8C0F1A1C09350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842756, "uuid": "f1575b56-fdba-43ab-863a-c820370d43c8", "value": "768:avoAuzF4QbiZEtvz1iECyu1vdDbMvZc8VnbcuyD7UfyqY:aAAaF4rZom7ZZ45Vnouy8qqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639842756, "uuid": "2c3111f1-44da-48dd-bc4d-f40f06751a05", "value": 34888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639842756, "uuid": "2fb345f1-3e46-4a53-973e-7fcc6afdc2f0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842756, "uuid": "c7b82376-4c11-4d80-83c4-1a4fc58c2330", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86bc9c1-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639844184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844184, "uuid": "fe9942e4-b3c4-4bd7-9b16-049c5394192a", "comment": "Malware payload (RedLineStealer)", "value": "d9337fcfaf0834f3b21b86f3e82bf3cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844184, "uuid": "432ccfe1-1633-4037-a4cf-a15c4763fb47", "comment": "Malware payload (RedLineStealer)", "value": "512cce5521eb9318fe0d2ef81c10af7b74257e71a3f412d2e3bd0e0f89c8ef2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844184, "uuid": "51f897ff-c5ef-4c10-a100-58e8c522264c", "comment": "Malware payload (RedLineStealer)", "value": "a4c7c80474487ec30470368799e9e49782a63664", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844184, "uuid": "afb361b7-aab9-405c-a189-f2d1cd0afbcb", "comment": "Malware payload (RedLineStealer)", "value": "636f2e8527f1ffa83b69f4a8156e523166e4ed4f0e442c138eec2c53e6f8a6af35bde89ee090c3674ec5cea2a04764be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844184, "uuid": "8a1d7523-c3a7-4253-9813-40f4cd85743b", "value": "T108549E00ABE0D435F1B796F4497A93BCB93E79A19B7490CB22D016FA5A746E0DC7034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844184, "uuid": "69eae0ff-c4c2-4438-a0a1-f10a9ab50413", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844184, "uuid": "e19c9917-adb2-4783-973e-2ef025c7053d", "value": "3072:C0rSyByQPeiwC1IZVhOW1IE/+86STtXwdX7Xau3Zv0sfM6U9Bhf0UbH/NztWD8:mR5QEWjSTtANbau3Zvlfq9Bh8UhxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844184, "uuid": "11dc2390-d5c1-475c-a3bd-72de03f8d8cb", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844184, "uuid": "9808752c-562e-4d25-a4a1-9c45ad3bff38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844184, "uuid": "e583c362-54b4-4483-8607-56db0d9c9a91", "value": "d9337fcfaf0834f3b21b86f3e82bf3cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0a85c0-601f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639844759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844759, "uuid": "df2c0728-ab7a-4cda-a12b-bf9742333f62", "comment": "Malware payload (Mirai)", "value": "12265925618e5b24f18e652df9cfab81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844759, "uuid": "4636b2e6-b856-4fad-8196-d89a3bd4ec45", "comment": "Malware payload (Mirai)", "value": "529a382b1b60185d26e49ab1507f0be1478d341e4cb1a221ebc0d907056aa57e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844759, "uuid": "1c7c5d2b-eb06-4cd9-8bd8-31e44ea90d35", "comment": "Malware payload (Mirai)", "value": "89ef1082f2a20f080a0bd5e15ba3722042df49c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844759, "uuid": "0e82d609-008e-4097-8534-c116093f6aae", "comment": "Malware payload (Mirai)", "value": "c933bb294ac127664d2f4f83b6a9d754b43fa7870ca5f10d04687c09a78b1dfca2bcfb15050449781e386c80325fb453", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844759, "uuid": "42675ba1-7ce8-43f7-a81e-636c0599c5c4", "value": "T1FB21419162D02EB8C8D850BFAE52431473749F84E0C33263A208B314FE2EE7D6C26047", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844759, "uuid": "5d7aadc6-b6a0-4e2c-b839-cc5cd5798f1e", "value": "24:BwmKGpa7Urz/jlf+5OXK1h2Vev3gRGFL9iMC/NBunlxrR+zfr1E:BwmKGpa7UrLZ81liNBunlxrsfr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844759, "uuid": "e235f890-e4ad-4d48-893a-358af6e81e67", "value": 1440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844759, "uuid": "9edf5a7c-df59-4dbd-a317-b68a51943ada", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844759, "uuid": "3cb7f085-839f-45fc-9ea1-78ac2e5e6383", "value": "12265925618e5b24f18e652df9cfab81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272992ed-5fcb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639808668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808668, "uuid": "0a9c55d0-a8e2-418f-94e1-0b0acea0868b", "comment": "Malware payload (Mirai)", "value": "4678f517fce795e36e7c62250157a47b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808668, "uuid": "9bb918b6-0575-42ec-bbce-8e2951a861a8", "comment": "Malware payload (Mirai)", "value": "53fe63425965a18f19bdc209878780d18ecd5fb02803e9267bb9c1decb3eb1a5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808668, "uuid": "a85a5f7a-0c0e-472f-9b38-a7e8ae1e6c2c", "comment": "Malware payload (Mirai)", "value": "33565f8bd33c01294d8d7071e834983a15afe298", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808668, "uuid": "123e6a11-bbb8-4c5d-854b-08d0b03e0019", "comment": "Malware payload (Mirai)", "value": "b5b5b6cc677a07dbbd67acd67ceda9d63d52221be0c1439a0980829f2575c840f26995d32e17875c80d584daebbd7a5e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639808668, "uuid": "9cfe18fc-cfe5-444e-a142-4e8d7bcfd8fd", "value": "T1B6B35B276151C5FBC48346B037CFA6916823F9FE0B62718737E87E682F268C99D59B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639808668, "uuid": "4c4a6376-cc8b-4f6c-8fcc-bb8d81049923", "value": "3072:ccn+Wjtfo/YxiKw/SE0Oe+MphaMaaDtjoKty8wdOM:KB/ZKw/J/MphaMJDtjoKty8wdOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639808668, "uuid": "edaef1ed-281d-4a60-a437-4ca64cfb27cb", "value": 108737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639808668, "uuid": "3e7ececd-426f-4d57-908e-5608ff618331", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639808668, "uuid": "35be2c07-fa60-4e11-8f26-64bc46600e9a", "value": "ill.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc507ca9-5fe2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639818796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818796, "uuid": "6ec069dc-3e22-4ccb-898e-ea471f0c2750", "comment": "Malware payload (RedLineStealer)", "value": "7cfffcedcd170e1be383dd1979875ab9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818796, "uuid": "bd727f55-f74b-48f6-8a33-76b44e741621", "comment": "Malware payload (RedLineStealer)", "value": "56132bf8c1be4feeeb6aec15656688659ee0c9861f94519da8b94ced1801f2b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818796, "uuid": "d1d06ea5-bde5-4ae8-9b02-8e79d368a87e", "comment": "Malware payload (RedLineStealer)", "value": "002355a3e3d83c5946c4df810df2bf7c5373bade", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818796, "uuid": "b7d8169c-76f9-4c5c-a9b3-8ca3dd876845", "comment": "Malware payload (RedLineStealer)", "value": "955c58265b6857de92db1fecbd16ed8ec619bf1027cb547c7df9bfd14b8a83c5b4da5d0e2a4bcb2439bf7ffdfd4283c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818796, "uuid": "18679bdd-0013-4768-b2fd-6e84d28d4444", "value": "T1D034CF2171C1C1B3C4B7003445E9DB799A7A30314B7A96D7B79D1BBA6E213E1A3362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818796, "uuid": "94a4585f-8800-427b-ba7b-3a8c7da2ee3e", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818796, "uuid": "7d7d02da-8686-4fe0-815d-b941edbb5da8", "value": "6144:4DKW1Lgbdl0TBBvjc/RgKWDebWQA4jm16:eh1Lk70Tnvjcp1dbhA4jH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639818796, "uuid": "839fa2a4-5ab3-4682-959e-c954e7f4780a", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639818796, "uuid": "e59b7320-6c1c-44d9-a3ea-a58e656a6391", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818796, "uuid": "8ec034a8-9c7e-423e-8c2f-777293054352", "value": "7cfffcedcd170e1be383dd1979875ab9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfabb380-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639844169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844169, "uuid": "155362f6-d4ef-4429-9c00-5df3bb370488", "comment": "Malware payload (RedLineStealer)", "value": "d03b8cb844b7066d02bb83115f19717b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844169, "uuid": "28bea201-8a3d-4bbb-85fe-990349218975", "comment": "Malware payload (RedLineStealer)", "value": "5ab52cd3ead357359cb259a22121ae7d7cde20c5a830617a45329852ef356348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844169, "uuid": "88fbbd0e-c17a-44a0-9339-2e1330ba5019", "comment": "Malware payload (RedLineStealer)", "value": "304701fde18f83979b809b0d85e697071be1790e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844169, "uuid": "3c53edc8-6bd1-4ab8-88f2-f5d62c89bc45", "comment": "Malware payload (RedLineStealer)", "value": "c6cd8d87c46d70a1603931052daa0198d3f538ced570438bffbded9298a7f85791d7bd6a3a8295f15fd0783e2fb2f407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844169, "uuid": "45007706-0d35-41c7-bb07-ae72d95cf926", "value": "T12E84DF00BBE0D034F5B752F849B6D3ACB63E7AA15B60A0CB12D426EA5775AD0DD3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844169, "uuid": "a3f0d938-8d58-494c-89af-0371a89c7281", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844169, "uuid": "2d1fe6b7-d96b-4569-9489-40c6d834ed95", "value": "6144:kexzTwaVLQ5CcQXJsa6OyPE9SXVk1BQ4X+OZd7vniBqJWBxZL2:kexQaVIClsa6OyKSXVkXQ4X+cJ+qJW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844169, "uuid": "9e7cfd63-cd2d-455d-9e76-90ac6e178dbc", "value": 406022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844169, "uuid": "0e4bd56a-1f43-4c9a-8d26-6fb7213bfb60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844169, "uuid": "6f87c1e6-8c1b-47ec-b31c-bfb3ff5bdcb6", "value": "d03b8cb844b7066d02bb83115f19717b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5f59b0-6052-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639866687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866687, "uuid": "3aa98b31-d871-45bf-a79f-a71a414073ad", "comment": "Malware payload (Mirai)", "value": "af7ed5d7198dd0d69fbfaa5128b7536f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866687, "uuid": "748a41dc-688d-43d2-bf20-1a90758a69f6", "comment": "Malware payload (Mirai)", "value": "5c0992ce79d225b597e2b1c215418f6ea16939f262554ed6b4269d15a4f6fb97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866687, "uuid": "9920dddc-7fec-4166-a393-a53b801f0f30", "comment": "Malware payload (Mirai)", "value": "db706efb01843c241f37ce9f66559b2b7f824daf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866687, "uuid": "b9e95ed7-2e6c-449e-9f45-ed00f8fb6f4c", "comment": "Malware payload (Mirai)", "value": "3ab10b8fce11ceb571ac1fad039b9da112176848c9e1196ec908efff0fb3fedb681acfc87d5d0d6e6c972066ece3136b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866687, "uuid": "dbcbc969-9971-48f4-9188-4ba5ca6338fc", "value": "T138A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866687, "uuid": "38c4fa9b-3271-4e09-b24d-b327de71f58f", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fjFmmFVcqq0G27ZT:wJFv4Lm6AJ+4fjFmmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639866687, "uuid": "0f3393a1-84b9-4a55-9a21-706f1e915ce4", "value": 104139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639866687, "uuid": "dd1951f7-466e-47d2-bb0f-bfe83d5e6b4e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866687, "uuid": "f93cb072-3163-4621-a149-81866dad5d23", "value": "af7ed5d7198dd0d69fbfaa5128b7536f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a850dac-5fa9-11ec-9275-42010a9c0029", "comment": "Malware payload (TellYouThePass)", "timestamp": 1639794178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639794178, "uuid": "313dc365-7265-4882-9cb4-d96177819ac9", "comment": "Malware payload (TellYouThePass)", "value": "39a9b92a69a191db0a7e2bc1e78d55e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639794178, "uuid": "23121b3e-9d95-4c96-ad47-84aedc42d79e", "comment": "Malware payload (TellYouThePass)", "value": "5c8710638fad8eeac382b0323461892a3e1a8865da3625403769a4378622077e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639794178, "uuid": "619f2db3-b6f7-4cab-aff4-814db0f8f3df", "comment": "Malware payload (TellYouThePass)", "value": "f98f3df4ca58e7c82825b72ef0e87f5078c77b1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639794178, "uuid": "7ad16e99-9ab0-4d27-be2f-d9d66e77df09", "comment": "Malware payload (TellYouThePass)", "value": "9d121f285ed109b7e4202531d9ae5afbdd5097cc5943175a197d3484098fc5b615090dcf2c9a99257308cd37a040aba7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639794178, "uuid": "c87d466b-68be-4e3f-8dcf-0a1ffc636f49", "value": "T10B163A43FC9194E9C1BED130CAA692527B7178881B3023D32F90AAB62B77BD45E7D354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639794178, "uuid": "d36873c3-912f-49f1-8360-b4b8f4db97c4", "value": "49152:LIT2pJ9rb/TuvO90dL3BmAFd4A64nsfJOKVgCYiOLRBKsaOqSg86EIVfWqnXguo7:LI6sE0LtqXDHWOOOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639794178, "uuid": "9d926ce7-f60b-40ec-9d39-e19b38f6900b", "value": 4132864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639794178, "uuid": "e1a1d02d-9540-40d2-8a8a-abbd7cc56bb0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639794178, "uuid": "70c0fb93-fcc3-4bfb-928b-8d3d68d6f186", "value": "5c8710638fad8eeac382b0323461892a3e1a8865da3625403769a4378622077e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585b505e-5fdf-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639817340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817340, "uuid": "dd165e8a-d399-4237-8ef7-c1814543f5c9", "comment": "Malware payload (Vjw0rm)", "value": "e1e8e8d7eab50c5c7c992513fe43bc63", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817340, "uuid": "487e68e1-e394-45c2-9685-d721ec04ad46", "comment": "Malware payload (Vjw0rm)", "value": "5eaab9e827b716035e360a5c77bb1f2c4aa155dc6f269543109eeef4bbb51eac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817340, "uuid": "a50ff1fb-04a1-4302-93db-562f0be093ad", "comment": "Malware payload (Vjw0rm)", "value": "1592f75c7ad4875cfb78e5ba1c811e5482af1157", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817340, "uuid": "40f966da-a20d-466c-b1b0-43a3c29ea1b4", "comment": "Malware payload (Vjw0rm)", "value": "3cba4eb525a7cd753aaab55ebafdea2236fe7c3f8fe799e8b7d83aab81d5ff3d9a912a8347e9fc9a8bdf81e8479747eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817340, "uuid": "48e6d4b0-df48-49c9-9687-f26b80df91e8", "value": "T1555355C06BC5FC92134B6B777B17B0F5EA2A0DA431C449AFE004B860F4ED95AE5E9670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817340, "uuid": "d0cc0719-1b54-4558-bbce-98833d973986", "value": "1536:YVKcLnEH8cobchPOZRz9/RVles17ldYknP2Z:YVK0EH89bqOZRJ/RKs17lr2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817340, "uuid": "0a129e31-7437-4d5d-930e-dd9348b91931", "value": 66183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817340, "uuid": "bb4b41ac-c63c-4d44-a9ce-5b32dae3e8ab", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817340, "uuid": "b856ebbd-58a8-4889-a339-246c3d34585f", "value": "QUG920MNSJ204.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d2c37a-6057-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639868745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868745, "uuid": "3af9ec6c-f866-49b6-8738-8aaf3b353b25", "comment": "Malware payload", "value": "5559e9f5e1645f8554ea020a29a5a3ee", "object_relation": "md5", "Tag": [ { "name": "AtomSilo", "colour": "#ED044D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868745, "uuid": "2988a6d7-e34d-4a05-b875-c8fc9a227da4", "comment": "Malware payload", "value": "5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4", "object_relation": "sha256", "Tag": [ { "name": "AtomSilo", "colour": "#ED044D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868745, "uuid": "155f92dd-fd2f-4647-89b1-63f4a674a9b3", "comment": "Malware payload", "value": "d74bd70862707cd2c7ab946903f6fa0aab066151", "object_relation": "sha1", "Tag": [ { "name": "AtomSilo", "colour": "#ED044D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868745, "uuid": "7b74f313-9e57-4c0e-bc3d-2da83721d2a1", "comment": "Malware payload", "value": "10427dcdd835f87a6feff1edcfb04c178fed55030a4d49ed6ac595fb5128503f7e5f4418e62ef26d84d19789be7e3ea3", "object_relation": "sha3-384", "Tag": [ { "name": "AtomSilo", "colour": "#ED044D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639868745, "uuid": "411e8379-1f78-433f-96f5-a9e7a4f0e2f4", "value": "T1ED5622FEB260375CC01A8D249433BD49B1B5652F45BAC5AEB2DF32A07F6B420E652F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639868745, "uuid": "d7c9976a-dcc5-4400-8df0-de505d5cf304", "value": "4fb24a31e05bcb3f1ec23d88b5dc5e10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639868745, "uuid": "90d604ca-0e5c-4115-bf08-81669498cb68", "value": "98304:YqqGLqEfydHgelcdpKCEAlFcyXSbSOK8AvpDggzc8LeAf5pNR0N75E6:dpLqEWJcd0CEzyibGpDpRRpYtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639868745, "uuid": "73cad8bc-5b43-49e6-96dd-0283b950f609", "value": 6242816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639868745, "uuid": "1e2ad7a1-f8ea-4372-a602-a821c5e5a288", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639868745, "uuid": "59bc7c78-cf60-419d-a4c0-4499bd4f8045", "value": "5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfec70b-600d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639837294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837294, "uuid": "565d496a-8821-4db3-9bb5-70b1d89459da", "comment": "Malware payload (RedLineStealer)", "value": "b51a4806b9b0b93bcae3ea84f5c49cf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837294, "uuid": "b73560a9-c230-40c3-9a90-99fae235adc9", "comment": "Malware payload (RedLineStealer)", "value": "61cc44ce3e8f1145432ef6d941f5a0ca4d0f32cf580ccd632e0e61d659aacd17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837294, "uuid": "730c10a8-b871-4574-864b-8a108f0fa204", "comment": "Malware payload (RedLineStealer)", "value": "3723baf57f0698d19115a4442c33adf900f94ea0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837294, "uuid": "7bc4a4d9-6edb-400c-8f57-9b2609eb813f", "comment": "Malware payload (RedLineStealer)", "value": "5db11354a36046f1db241e85e3a9d183fe284b71014d513400044151894c4eca7b117203943d515fb75297319b0e0600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837294, "uuid": "01cba46e-9462-41a2-b114-932ceaf422d7", "value": "T13794DF006BE0C034F1B752F449BAD3A9752E7AF26B34A5CB53D126EA56356E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837294, "uuid": "0ec91363-9dba-4c28-acb1-39cc8ed90b3c", "value": "4ee83624426d72301d5dc28b390adabc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837294, "uuid": "886ed644-d423-42b2-9e50-f551092e63f5", "value": "12288:QOHOqFFCzvGUHZ1olS7wAxlSoEYInaHqL:nFHW/4SioEYfKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639837294, "uuid": "37b9bea4-c4f1-4603-a81e-9d6579a2cb0f", "value": 420916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639837294, "uuid": "1237ce89-edb5-440d-85bb-0b9facb4ad45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837294, "uuid": "b93d668a-6eff-4e44-8185-a26eef4ceda9", "value": "b51a4806b9b0b93bcae3ea84f5c49cf9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a5f2b7-5fe0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639817946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817946, "uuid": "8a61d474-96fe-47f6-a785-9153c20ee6b0", "comment": "Malware payload (Mirai)", "value": "abe1220ed08ec390aedbf41f0c136dc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817946, "uuid": "ec8bde0c-8424-4ee1-94f1-8838272ec79c", "comment": "Malware payload (Mirai)", "value": "62d81f909791c2787eb4789df927b0731c87c36f501fe092d150940640facbb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817946, "uuid": "4ec0e7ad-d46d-4c09-b4ac-18fe4e341c45", "comment": "Malware payload (Mirai)", "value": "5a9e042d487524575896d6ed15a500cec55be03e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817946, "uuid": "838ccee5-af5e-43eb-b00e-0c34efcd6cb6", "comment": "Malware payload (Mirai)", "value": "9f8a8641d4c9d0e7ed5263474438a88e3b88eb10ad7ab581dad78692a8e19320ac14f2eb32a625e3cf1d84a3289bfbc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817946, "uuid": "9558e774-d33b-4e29-bd55-fd49371a118d", "value": "T10CA3C516BF310FF7E8ABCD3719A51705198C650A22F97B35BA34D818F64B25F1AE3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817946, "uuid": "8b5e2ca9-4d6d-4bd7-b146-2cd5a913e8c8", "value": "1536:RvMKs9oRHbfZT7EQYEWiGJCvBqe1CsaooKfALVZPpzKAx:RvMKs9oRHbfJ7fW5JsBfVULV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817946, "uuid": "ca2ee353-8b07-4443-a409-a95c83a87483", "value": 105116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817946, "uuid": "590e6bcb-e677-4e0a-a950-c0affe2cda86", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817946, "uuid": "100f14cb-5fd5-41ae-8262-b69dce3cb274", "value": "abe1220ed08ec390aedbf41f0c136dc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871dc582-601a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639842759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842759, "uuid": "cd5370c3-eef6-4e89-aea4-b3bf64f2e7ee", "comment": "Malware payload (Mirai)", "value": "30da5debca06a6566774b57d4f2b2039", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842759, "uuid": "00261352-b4c3-4274-8afe-6fe9ca797958", "comment": "Malware payload (Mirai)", "value": "62fb510d8e07016eb6b84095cf5ad06fc39063866e2c0bab55093d415c78ae3a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842759, "uuid": "d2d7ef2b-c109-4d76-9258-8b8050cb2e35", "comment": "Malware payload (Mirai)", "value": "5be37935af7ae882352aa6f2336764af12e262ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842759, "uuid": "9fcfe6da-dc3e-4f7d-a056-3e6405fefa3c", "comment": "Malware payload (Mirai)", "value": "a56a52fcc2ab8c5049ca825334be4ef400d2fe2b1e006b8772be7fd87634801a2cb29a32bad822dd38a32f0220a99898", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842759, "uuid": "ee55db05-ac3f-4442-9fc5-120a17441f68", "value": "T151030111C786A466D2F21C31D6AE444B403F25B1D0F96C7032A609FEEDC878B9BEDA18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842759, "uuid": "199a2d64-4ee9-436c-aef9-9324c1f0aca6", "value": "768:uUZgyV1aRUZ3/2cwCnNWgHtEIbm8OQ/AZe3lhrq3UIUI:QwsEHtz1rke1aT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639842759, "uuid": "4b5b7c11-5bfe-44c4-b4de-1943448b61e3", "value": 37912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639842759, "uuid": "0522dc64-8908-4d5d-be67-36680ffd1f37", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842759, "uuid": "e424316e-ba05-4648-9886-b896db4c90c3", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19f3d04-5fd5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639813249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813249, "uuid": "3ce4f3ba-65a3-48ed-9577-e42a45f63471", "comment": "Malware payload (RedLineStealer)", "value": "6c65ee8bd24f383e556c0daab80d0fcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813249, "uuid": "6cd9e296-3507-48dd-a884-bfae03e11af1", "comment": "Malware payload (RedLineStealer)", "value": "63182b1a23476536ec86e724c407f4680f349dd22442ad510c0024c23a9a5727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813249, "uuid": "672852b2-245c-45d2-a4df-a1e6515dc30f", "comment": "Malware payload (RedLineStealer)", "value": "bb46aae89ea0ebd2dc395c19c493b70e15d65491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813249, "uuid": "9e787346-20a1-4f7e-8344-483244381479", "comment": "Malware payload (RedLineStealer)", "value": "5e1263f89139e6298fd73973eaff34dd4c9928117ae1678fb3b6e976f8a17551a7596273203ee692939c5af9f4ae345d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813249, "uuid": "936aa771-d606-4136-9d5f-e7d8fb9c86c7", "value": "T1FB649E00A7E0C431F5B712F44DBAD3AD752EBAA16B6591CB52D51AEE1738AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813249, "uuid": "e8373fe8-5e53-4d75-82bb-a246f2dea56f", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813249, "uuid": "41840a26-1ad9-4f35-b651-19fc4ca4598b", "value": "6144:d0pO51LYuX0MAcMzyyu1a9+OG0+MGs1zMF9nt:EO5JYuX0MBMzDu1a9+OKMGs1zaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639813249, "uuid": "dacad122-bf4b-4d77-9db5-3b6c5c2f4cca", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639813249, "uuid": "71dfd73d-8a72-4b69-a50c-9bb05ad120ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813249, "uuid": "a613d699-653e-44b8-b687-7e3affb9914b", "value": "6c65ee8bd24f383e556c0daab80d0fcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0340b8b0-5ffd-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639830082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830082, "uuid": "5c3989b0-bb57-4d9b-9729-de5e1a81cdd5", "comment": "Malware payload (Gafgyt)", "value": "501636e521a18decf72e19ad75bb3617", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830082, "uuid": "982c8b90-a63b-48aa-9d50-37cc58e48ef8", "comment": "Malware payload (Gafgyt)", "value": "63b1af6954ad41a2119cfadd8259bd5999f3112c83ea92d1f712ffbd3c700594", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830082, "uuid": "f95de3e7-0426-4ba4-88f0-3555ea367363", "comment": "Malware payload (Gafgyt)", "value": "d4095fa1b2ec12a614fd201818a902e0d64c378a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830082, "uuid": "fff6431d-ecae-4e9d-bc1e-55528d4c88f9", "comment": "Malware payload (Gafgyt)", "value": "a3648d4866778d28b84566c633130827b3fc6fa42b8fa0b516be0fcc5abac1f4611acaaf316324c856ffb6de5a3add9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830082, "uuid": "f72cb252-5be0-48fe-a339-d75e595b6e9b", "value": "T16BD3951ABB618EB7DC1FCE37099A4501108DA58A12D97F6FB2B4C96CE74B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830082, "uuid": "64711d56-9ab2-4553-88ce-ae44f90ac7bc", "value": "1536:z/3q/eT8s7j7OWYBZYfDoortkFIMm1z8dhFCEg/pimW30MFB1DfqzV9/:zC61GCtP1z8fFU/pimWEMFB1DyzV9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639830082, "uuid": "c39dc257-ff56-4717-8a2d-bcbf35b3a81a", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639830082, "uuid": "05c73f02-02f3-48f2-86db-3209fcdc8a28", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830082, "uuid": "e87d5c5f-5f97-4497-9fed-57330d3195ea", "value": "501636e521a18decf72e19ad75bb3617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4aa600-5fd7-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1639813829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813829, "uuid": "fcba4866-be02-4925-8bcb-38c7041c7625", "comment": "Malware payload (Amadey)", "value": "227f369cdc49c8104fb2561a99074b05", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813829, "uuid": "2b164825-127f-4c99-9315-cbc4898de821", "comment": "Malware payload (Amadey)", "value": "63e937774424d76298755427b96f2c4056f236407ea412764844f3e9cdfc8eac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813829, "uuid": "640036a2-7380-452c-b5a2-d15c0f2bf6ec", "comment": "Malware payload (Amadey)", "value": "4c5c0d8c707898be42080eb03bd547cdce3c2286", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813829, "uuid": "95a719f8-9b72-43ad-b2b5-6a8cdda07705", "comment": "Malware payload (Amadey)", "value": "e3481af051130b687cf639b45b0e4fc8f3b552673553d81bb76b9b81fc8aa10b1d2aeae8c4c131163791749ac7ac0644", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813829, "uuid": "aa33af1e-ab32-4868-b356-2a1412c3a79b", "value": "T177649E006BE0C435F5B762F459B6D3AD653EB9E1AB64A0CB52D516EE0738AE0EC70307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813829, "uuid": "23fc5992-f161-4985-8ea5-9429224ad8c3", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813829, "uuid": "a384dee3-7bce-464e-9a57-3ab044870598", "value": "6144:XYzhb8pS09WcCl3Tny91/Y+OGQJMGscQXCCXq0n:I4pF8dl3Ty91/Y+ORMGscQpXqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639813829, "uuid": "680f4c27-8e4b-42d1-8d18-199e302dfac5", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639813829, "uuid": "61b131d9-6a58-4508-a00f-84b24927a0fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813829, "uuid": "c4f59c9a-cdb9-44b9-be5e-b5f67fae5691", "value": "227f369cdc49c8104fb2561a99074b05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c1cbc3-5fd9-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639814913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814913, "uuid": "eec9bc46-5707-4694-8ace-96c0e7ecdaa9", "comment": "Malware payload (SnakeKeylogger)", "value": "4b296a9ed346f882f4fc3fe7de3a7a51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814913, "uuid": "95e5238b-93b1-404c-9068-a0034fb45a31", "comment": "Malware payload (SnakeKeylogger)", "value": "67a972f19afbe34966e9dba6097a01280ac66e4c12911e65b4ba8d2f3a69416f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814913, "uuid": "04b36132-e211-44ef-b657-4550553c6542", "comment": "Malware payload (SnakeKeylogger)", "value": "2545770af8dd458240518d81ff33305a9c2d1124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814913, "uuid": "328af716-5387-49f3-9c7b-6ba34fbd3dcb", "comment": "Malware payload (SnakeKeylogger)", "value": "fdaf0b47e6b23be04f3e633ef96156bb62c0a6f1e1eecb5d698665ab9ae3b4e177c0a1bd15759ce58000a3fb394eba1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814913, "uuid": "3a7c01f5-17f7-4bc8-8d90-683aa2ffba89", "value": "T1875523E6F2A93907C56F40F9D182429A47F1A53F2963F3C4DD81AAC1654F3E05B406EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814913, "uuid": "769e7b5c-4693-49ea-8050-efa4054f8de9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814913, "uuid": "6c1ac4b9-9afa-4469-be10-0dcc9d801c43", "value": "24576:qrCItNNkot4+4hdrH3zWO6tn6tGin02BXnK9BfgvpcEMNe6+U:qrCet43rWR2Gi02lnKshvae63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639814913, "uuid": "ac3213b9-9cbb-4392-869b-297e6de25e95", "value": 1294848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639814913, "uuid": "e9138a24-d4bd-479f-a6a5-d4bffb6cb875", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814913, "uuid": "85aa89ec-f9ff-488b-948d-2b3090019a39", "value": "4b296a9ed346f882f4fc3fe7de3a7a51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abfb286c-5f9e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639789563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789563, "uuid": "c253a502-4d8a-4712-bad3-a33b844c9a5f", "comment": "Malware payload (RedLineStealer)", "value": "9d5ed7bee935e486970332132dddc3ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789563, "uuid": "e82f5eab-3315-4f32-814a-081e0b743856", "comment": "Malware payload (RedLineStealer)", "value": "6816dd50b149090375a632d46dc79d88d8c1c7ec28a7495bdf15e7480748eda1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789563, "uuid": "fa7915df-582a-4e20-b8c1-4bce23b9dcb0", "comment": "Malware payload (RedLineStealer)", "value": "cecc7e477a613417c6737449ce4ff9288e7624c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789563, "uuid": "13368b5c-111c-42e8-9868-a7139089be4a", "comment": "Malware payload (RedLineStealer)", "value": "dfd517773dc7248b22a9fe2b02ad731d0b0d437d54fafcb0af9632c08c8a0de086b005e34eca3e737d4f24256279c2ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789563, "uuid": "b84856a4-8c0d-4d21-82d3-4dc5a58e1e91", "value": "T1F07533EA91C09E54D2DE26F8022E6DEC325BD52D858D44FB7DF16E43A4B8C2BA50713C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789563, "uuid": "75de8f4e-41d1-4ec2-9d9e-170472d9ea31", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789563, "uuid": "9fdd4be0-c0c4-48bc-8570-38145ad05e7b", "value": "49152:6i2wVIFJ6p8H0Tkw4jKrP/4zLALmhwNaW6a:zMFvHvw4jKrPyLA1wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639789563, "uuid": "61f94c9f-dfa2-4abb-b32b-a8d97a554d0d", "value": 1688576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639789563, "uuid": "e7575665-000f-4018-a926-e44cf2eff408", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789563, "uuid": "31b5bf1a-b16e-459b-b2dc-218e43f3f884", "value": "9d5ed7bee935e486970332132dddc3ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33dfbf57-6053-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639867101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867101, "uuid": "62bb9507-8597-4345-a9f9-d0f9cf094f93", "comment": "Malware payload (Mirai)", "value": "665f01678b71663e70ec3ef4447c51be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867101, "uuid": "61f6b537-365a-4750-b395-024afa07259f", "comment": "Malware payload (Mirai)", "value": "68b53beab96e3b4d2dd72eb027bfabf29484c8c4d49d017d9adede9fe9cecd26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867101, "uuid": "facfb5b9-5238-43de-9b13-1e8612993692", "comment": "Malware payload (Mirai)", "value": "62ba18e0bb7cb8a2dd9b3005075f9684f14e8425", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867101, "uuid": "bf17b32d-3d34-46f1-b71a-8896ae58648d", "comment": "Malware payload (Mirai)", "value": "11fab898e23856e836c990f55e83f106d93dc92a1964f03bbdf49df0625b5d7a5ab498fde43e35fcff2ed5725ce56c82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867101, "uuid": "e801214c-1532-4c48-a6e8-274ab5f1f48b", "value": "T17D532AC8A0D3E8F5EC14097D307ABB629E73F13FB176E99BC7E85573A801602910669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867101, "uuid": "170880ba-8358-48af-b0fe-cf775c679399", "value": "1536:VPvpWlXJcf4slZQLkAlVt2SWY/Pfd+700ngkMte:VMXJcf4slZQLkAlVt2SWY/Pfd00+dMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639867101, "uuid": "bf14e10c-51bb-430a-a488-ca7ff37680da", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639867101, "uuid": "ed91bc10-b6d3-44e6-a7fe-d9709849153d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867101, "uuid": "fc742c14-96f3-498c-be26-5f574847bf09", "value": "665f01678b71663e70ec3ef4447c51be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b01ab1e-603f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639858657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639858657, "uuid": "8af234de-c548-431d-b3c9-85979a850021", "comment": "Malware payload (RedLineStealer)", "value": "4c74c974c8a73d5fd7c9fb515a9619db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639858657, "uuid": "ab0a4a44-66e3-4f56-82ab-0306540d0b2b", "comment": "Malware payload (RedLineStealer)", "value": "6d65494911f19608e14df5c7fd271c1ce6564d04655391fbac54ddba6c682e63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639858657, "uuid": "0e621ef0-d5e0-463a-b59d-f8d9e4e493ba", "comment": "Malware payload (RedLineStealer)", "value": "3157d85238ecb516400afef51811733d639376c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639858657, "uuid": "0639ff31-7701-424a-a66b-e311461af3f3", "comment": "Malware payload (RedLineStealer)", "value": "7e62c8b623b938b6c10a3f47f52e73aab64329ad71949b4f2d7d16a662be09578c9dde5e99f03cf5dcf3d92e5513209c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639858657, "uuid": "3521333d-21c3-405d-8a14-9cd93f71b807", "value": "T103563301EC3D1C7AFFF46A3149C153F6EA51AD25AAA88D8E1F606318346564EC3B76C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639858657, "uuid": "1ca9d19d-90b2-4f8b-aad1-5da4ecccdb4d", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639858657, "uuid": "009591f5-684c-4ed1-8104-4391f66c1dca", "value": "98304:q7cGnmkbu9sSCggejHbs/4GCQ3hBt4iQqVVZ/6R+iZKc7fslD+A25ljI61SSpaYH:qNnmGjFsHbs/4GCQ3n5ja+iI1Wp1jpoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639858657, "uuid": "67820194-1568-4648-9b15-7d328a0aeafb", "value": 6024015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639858657, "uuid": "260b9364-442f-4c36-b766-68c20d40e782", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639858657, "uuid": "f7137b3f-9fe9-45c1-9b46-cf04e45647e0", "value": "6D65494911F19608E14DF5C7FD271C1CE6564D0465539.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fffaeb0-5fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639805864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805864, "uuid": "e2cf4d02-4978-4766-b405-35914b67aa61", "comment": "Malware payload (RedLineStealer)", "value": "f2f8a2b12cb2e41ffbe135b6ed9b5b7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805864, "uuid": "2b4a076e-f953-4f24-ad1a-33f03fa9a96c", "comment": "Malware payload (RedLineStealer)", "value": "6d969631ce713fc809012f3aa8fd56cf9ef564cc1c43d5ba85f06fddc749e4a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805864, "uuid": "7d49b617-f182-471c-bb7a-fa5fe99a498a", "comment": "Malware payload (RedLineStealer)", "value": "f7133a7435be0377a45d6a0bd0ef56bb0198e9be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805864, "uuid": "203c6301-7cdb-4640-881c-f16e8dc64804", "comment": "Malware payload (RedLineStealer)", "value": "8fbed3840fab1c192d33bdd2756205f04d59889177f878265c1d60d2ff80512e5cf33e0cb9e9b3ebc7a23575a8c1e864", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805864, "uuid": "79ea728f-5f0b-4142-916d-084be16bbe7b", "value": "T11AC4F5383AFE5019F2B3EF759AE874A69A6FF7733703A55E105003860A13A81DDD1639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805864, "uuid": "8c9a905e-7304-451c-9427-e7b5fc75d351", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805864, "uuid": "c16916bb-47f9-4ecb-b3a6-85ad0c14e847", "value": "6144:5RZmeBqZRvZq9fRubqgJcL+okUesWafbPIInsTZrlTTPyDvu6t2Kekt6:5RZXQ50L7esWibIIn4ZrlTTPyDv8Kek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639805864, "uuid": "4b89d0de-421d-48ea-96e9-1fe24c9b7290", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639805864, "uuid": "d5363934-2161-4efc-a36a-e145764182b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805864, "uuid": "1b3408b9-5409-41d5-8ee0-f1469a5b14a3", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.7997.5410.9843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d22ba0-5f9e-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639789551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789551, "uuid": "b204a361-5d19-429b-bcbf-811339f07dea", "comment": "Malware payload (AveMariaRAT)", "value": "b29356d4f0a7f9ddbe655f01f50ca5e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789551, "uuid": "e46d27d2-77b1-4947-a13b-b2deead518d9", "comment": "Malware payload (AveMariaRAT)", "value": "6e3697534ba86f5b34761646c3f7a04ba9e9cd20026462cdb84ff04a9949fa9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789551, "uuid": "62d3204e-ab21-4dd7-9ab9-bdc80cabc0b1", "comment": "Malware payload (AveMariaRAT)", "value": "974cc6bfb5e8491f60c5968897f6284f2ac769ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789551, "uuid": "74552926-e790-4b7a-8fae-c790474ee295", "comment": "Malware payload (AveMariaRAT)", "value": "ed6a6269fa602e6c520bb4a4bee9eeffe81514deb7b7621ae034d39cc2e7a70830255a11e9ec35bfbf1385e482304823", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789551, "uuid": "20a81534-998e-4292-a1fc-8682863b51fa", "value": "T169652B60A3A51111E597A77F73A08B90C8AE3C409D6E97CF4E460AD6CA3D2F479087F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789551, "uuid": "68e180c3-a39e-4813-ab1d-f898c2366ea7", "value": "94f6bec6c84332e1dd4bb2feb01e6131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789551, "uuid": "862afc54-3c5e-4326-b58c-3b4783810f4b", "value": "12288:Vwp6fK786QaQN3wbnmED4pa7+oivBpgO:VS67wbnmrvDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639789551, "uuid": "34b2e56d-0d85-478e-bba8-568c4916e3f5", "value": 1532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639789551, "uuid": "a8e4c0f4-9931-4b10-88f1-5e4fe5652387", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789551, "uuid": "b4e26b5a-d7af-4481-9d41-7c33cfaee3a1", "value": "b29356d4f0a7f9ddbe655f01f50ca5e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0aae29-601a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639842764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842764, "uuid": "ab4a9be6-73fe-4fe3-b54b-9a9860290753", "comment": "Malware payload (Mirai)", "value": "ed4d3bccf181208a89d6064ef929b041", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842764, "uuid": "ed0153ea-4429-417c-9766-e2e1078b797e", "comment": "Malware payload (Mirai)", "value": "6f2a6fd0f0f36f77f9e88f245750f9c18cdb8166a34526b7440ad7d2b8d6cf55", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842764, "uuid": "3acfdbe7-d50f-4e4b-92da-34fd558b20b8", "comment": "Malware payload (Mirai)", "value": "43b3bc7a13f02ad6a7d5fc8bde589ef4eb4e2431", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842764, "uuid": "5cf74c29-599b-434d-a7aa-59b17978c820", "comment": "Malware payload (Mirai)", "value": "37441d508f27e055ee3b2313cd8ad76ecd2ca6db24e653e8739cd65fdb8db00e12509f2505c670f877195a1a3807beb4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842764, "uuid": "2afdb363-a3c1-4bac-abf0-f31da238824a", "value": "T127430271ED0236B594F08CB1E6FE45CE938B1775F8E1B240EA5154B4BAC3185673E413", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842764, "uuid": "f60a693b-5ac4-4ccf-aa5f-287bc542078e", "value": "1536:15x4Bm+SPsAkAIniS+KGQPwJ0tTAJRem/d3ok1gU:1h+SPDkAIniSSQoJ02z71gU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639842764, "uuid": "0b7f033b-b1ad-4d41-b577-9c23cdd9ef7a", "value": 57948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639842764, "uuid": "3ecc7263-1947-4eeb-9455-b2156c1cb261", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842764, "uuid": "7da5fb2d-92f9-4cc9-a790-ee5ebdf4fae8", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ff7ec5-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639844079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844079, "uuid": "628be23f-dd12-4446-ad4f-1e76b8afcd4b", "comment": "Malware payload (Mirai)", "value": "f5ff14c362fdf921c52a1039d4a53468", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844079, "uuid": "47ff29e8-3fb7-45a0-a3e0-192142b1b71e", "comment": "Malware payload (Mirai)", "value": "708ccfdd32e8d022dda4d378945a8bca9ef5befdb547c02af26b809033081d2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844079, "uuid": "f6296a87-a887-4a59-992e-9c966cd69d36", "comment": "Malware payload (Mirai)", "value": "cbffabd721ce59c426e435f82d9eb1e55d54a13f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844079, "uuid": "d715eba0-e49e-4838-a599-2d06290b4919", "comment": "Malware payload (Mirai)", "value": "ac4157efbab61c36fc26de1c843012aa54f121ff41ed65362b5a29fc7db58d30ccaf3409f67dd0cca5ef005822fe2e57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844079, "uuid": "de3babc4-5abd-4c7d-b50e-92ecb0586565", "value": "T171D2D181008A7121DEF53C33E538455E624F1B7CF1A135A721A84A2D53EE86E49EE98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844079, "uuid": "776a660d-615c-4472-b6da-b6108d9b5716", "value": "768:i7JRJXxek2kSg3cT/m35IMrE/grJrcu3UG:iTJr2XgOM5IMrQgrp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844079, "uuid": "88104afa-5945-410d-89bc-5cff143e91de", "value": 29884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844079, "uuid": "19bad1a2-00ca-4ae7-9199-ef18fbcbbb4b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844079, "uuid": "84108400-4b92-4345-9e5a-655c04bb1f90", "value": "f5ff14c362fdf921c52a1039d4a53468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af43558-601a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639842604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842604, "uuid": "050400d4-e523-4f28-9d8c-0b31d64d2792", "comment": "Malware payload (Mirai)", "value": "6e546ecb43254d8e3d86d4b18413ab58", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842604, "uuid": "4206fafa-2773-40f5-ab4a-af653be94903", "comment": "Malware payload (Mirai)", "value": "70d4e6960791c58f3875b7d0137b48a1ab6a99992f496093d21354f276b8f313", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842604, "uuid": "2228a664-1cab-4710-8002-a3078455e3eb", "comment": "Malware payload (Mirai)", "value": "ac90727fabae50e9b3985f8218f66c406b267865", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842604, "uuid": "450b5f7c-8afa-43ab-9140-c2f385aea426", "comment": "Malware payload (Mirai)", "value": "4569c0906f38c90e130ad2118867df8d7205962fcf5c22f2aa2569041ae1d1573b335df54f301e94af07c12716568f06", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842604, "uuid": "15bee9ae-a6ff-4270-a0e1-3ae427e8cdde", "value": "T12333F1F999E85058D6D62A37B634C49FF238F6F4605DF3A562210B19BF510CF80B8647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842604, "uuid": "a1b1db69-749f-41d1-a11d-173a5918fb26", "value": "768:3CyJRmnmKL4CxMSb8P4+CRfCAHWku3DjJhL82zlrLEJh0wpq3UirN7kgBFnt6z1E:ZRG0CxM2HNcrbzjJtZxfEI7rBFsCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639842604, "uuid": "8b08b790-42f1-4165-89ea-18d4292c2a0c", "value": 54300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639842604, "uuid": "5dc102e1-6d27-493d-9761-fd29b1c3890b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842604, "uuid": "baca381f-3810-48f8-acdb-dacdc9991100", "value": "Fourloko.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce58e054-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639844167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844167, "uuid": "811b80f2-49b7-421a-aedc-941ae5b63646", "comment": "Malware payload (RedLineStealer)", "value": "8a32cf5b8664b67d6aeb2e2b6b6ed377", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844167, "uuid": "bc6dca5c-0831-4bf0-a1ce-51d8b578dac8", "comment": "Malware payload (RedLineStealer)", "value": "71445cf788e1e48e285c1d485d2f6f6b0f7ba3594afa0967dad16908479639a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844167, "uuid": "bfa988f5-8900-467a-8908-e9dbff0231be", "comment": "Malware payload (RedLineStealer)", "value": "e55bb785ecda49ec7419b5ef09a9420df6179e0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844167, "uuid": "6ff1e83f-dc2b-49ef-a9c7-fab19ad1874d", "comment": "Malware payload (RedLineStealer)", "value": "5690493140b5eb820c3a6fa6f135cdb8d144be89878b429febd40c4fe5feaa9b249c36308db188585451d0b16812d086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844167, "uuid": "71466c0d-7fcb-4851-b880-e0725a7a6b08", "value": "T11B84DF00BBE0D034F5B752F849B6D3ACB63E7AA15B60A0CB12D426EA5775AD0DD3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844167, "uuid": "2434ee57-05f3-4683-9d88-19a449c22fb1", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844167, "uuid": "0a7cddbf-89cb-401c-9d2e-afc9f9afa17a", "value": "6144:kexzTwaVLQ5CcQXJsa6OyPE9SXVk1BQ4X+OZd7vniBqJWBxZL2:kexQaVIClsa6OyKSXVkXQ4X+cJ+qJW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844167, "uuid": "a940302b-2e89-4d7b-9daa-9bb6d977561a", "value": 406023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844167, "uuid": "39033f7a-ef63-4286-babf-fb18c1ea1539", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844167, "uuid": "7c5b0788-52b6-445d-9d5f-9aef649cc6c2", "value": "8a32cf5b8664b67d6aeb2e2b6b6ed377.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71db275a-601e-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639844441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844441, "uuid": "c24ea945-dd4b-4844-a040-616058685748", "comment": "Malware payload (CoinMiner)", "value": "d7d3e7010b5ca02f3ef6592c0bce20ca", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844441, "uuid": "3072a312-cbd7-472b-ae07-4a0c0b5b6791", "comment": "Malware payload (CoinMiner)", "value": "7191f3b9360c7d5dfacae9517d5e47950df5fd8a49b6d1efd0baa7ae1cd87c1d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844441, "uuid": "bdcb1130-4a19-426b-9472-10ea9d54dd29", "comment": "Malware payload (CoinMiner)", "value": "ee820c458ee1f779fc61eb2aecd0310cde752e54", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844441, "uuid": "1f81e67e-a197-430d-a1f8-a2de5b22a363", "comment": "Malware payload (CoinMiner)", "value": "4c604c1a42c788f7dcbe8c58904628f0e2902375f578de67257730936384aaba7c308392d71d6ba51941f595d2fffa86", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844441, "uuid": "21bf6b8a-9b09-4312-a46d-6ada5f6559ed", "value": "T17D549D00BBA0C035F0B752F45DBA93BDB53E7AA1AB3190CB52D516EA5A74AE0DC70347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844441, "uuid": "5c80d861-43ff-41a9-a8e4-98bb50b72e59", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844441, "uuid": "c6025770-163f-4343-a18c-43af492f89c0", "value": "6144:7X2dPOOCIBwT9bPYaOOZv1kG5BUpbpdhh:72POaBwBbPYa9ZLDUpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844441, "uuid": "3c43aacf-841e-497b-9fdf-ac58e1c09e17", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844441, "uuid": "7915540a-4d07-464f-ac13-289fd3e281e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844441, "uuid": "05e62fae-b98b-4cba-aaa4-080a43af54a4", "value": "d7d3e7010b5ca02f3ef6592c0bce20ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99741fc1-601e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639844508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844508, "uuid": "92580cbf-3133-4f1d-9a74-70b2a2245ee1", "comment": "Malware payload (RedLineStealer)", "value": "9bcb259ed6ffd0e2402c6ac7f1017cd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844508, "uuid": "ba346994-2bcd-4960-b996-5325ea4aa71a", "comment": "Malware payload (RedLineStealer)", "value": "71ef9b2a362383443ecd7037d4460169188945a4531abd8aed2837c3928c13d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844508, "uuid": "647f3461-121b-47ca-b14f-fe20b6fb648f", "comment": "Malware payload (RedLineStealer)", "value": "cbd9abb79fb42de30c98080e68079997ac07540e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844508, "uuid": "a1c1811b-4530-4a27-9be8-88254851c2a2", "comment": "Malware payload (RedLineStealer)", "value": "f2365a4265de6a3ebc491bcd691a5b708d5a67d440a6c45d640948b99b2574a2b4cf04e7714eb5818c00fca88428f936", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844508, "uuid": "14690648-b571-40b9-8880-70da1f529f86", "value": "T19D84D000BBE0D034F5B742F449B693A9A93E7EE15B2490CB22D427EA57346E1EC71397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844508, "uuid": "f722afd9-940c-49ca-bc07-9f4565712987", "value": "e00af8f1ad8949415054b06be51fa3d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844508, "uuid": "7591fbb0-08aa-4671-a01b-18f8f82fd683", "value": "6144:g/Br34ad7Mhou5p034iK769u5iha3xt9iJlcpwK5zd7:wBpNMhrp039j9Qiha3xt9IcpwK5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844508, "uuid": "2add0caa-40d0-4bd9-82df-463b4670d77e", "value": 406549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844508, "uuid": "1f9cfe7b-8f11-458c-a3ba-a94f568bac08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844508, "uuid": "36521234-c8d2-43d5-9414-2d0df88b3399", "value": "9bcb259ed6ffd0e2402c6ac7f1017cd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a55c980-6053-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639867111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867111, "uuid": "f6ec422d-2608-48b3-8321-ea8dfb7e5263", "comment": "Malware payload (Mirai)", "value": "ce4c6c7ff76cf4f2290d20682a2de649", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867111, "uuid": "4475e796-b18a-4cc4-838b-2c686e67306e", "comment": "Malware payload (Mirai)", "value": "72bc31a4d972fc8bff44554cc693fb6446059724ac315888f7f5a0e8146e8936", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867111, "uuid": "61bdb4dc-193b-4b10-8bcb-0a76681eee09", "comment": "Malware payload (Mirai)", "value": "ebdc4aa6acda364c5f527e3d6b25e19d0301b8e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867111, "uuid": "6bccd389-7f56-44f7-acaf-b68e0b4be146", "comment": "Malware payload (Mirai)", "value": "c966eba5ef361c5fc1300c568724c8d47db8b8c626de35a0d654d1054b26df8df7efca0878dd5c0ea6d0d03d0888c8a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867111, "uuid": "0bdba82e-c52c-4cee-88b0-cfe4127cd3cb", "value": "T189535C02B3684E0BF9E61AF5343F1BD483AEED8025E4B585A90FD7464235F33459AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867111, "uuid": "29fdf08f-d650-4c46-9837-b2c5dc4f9ea9", "value": "768:zipbi/131WUsTETbl1T9Q9n5pY5eEgGsllk5MDoH0a26lBHW2tdFsDMUQSDAYThJ:zT93Egl1wYAzk5/+8NbK1DVNug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639867111, "uuid": "fa499b0b-8649-4e61-ada0-d4d68a9b6488", "value": 64188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639867111, "uuid": "a166f709-694a-48cd-bdb5-6c6bc8e30490", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867111, "uuid": "0e4a1665-1b31-4b30-b6f2-3a545a69458e", "value": "ce4c6c7ff76cf4f2290d20682a2de649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87738d2b-5ff2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639825580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825580, "uuid": "b23489c8-3400-479f-87b5-ae060f1aca52", "comment": "Malware payload (RedLineStealer)", "value": "4ecb793be8d8d411d3beac353b9b4ad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825580, "uuid": "40cbd6ed-a604-46e5-b33b-d515fc13de64", "comment": "Malware payload (RedLineStealer)", "value": "73a53f8b8068543cf8d1219a2fdc671ed53d3602ae6c5609b34dbb34521b0178", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825580, "uuid": "ccd79040-1dc1-4595-8e58-79bd0fc2783e", "comment": "Malware payload (RedLineStealer)", "value": "4bb839757cd08dae0c37d1b7704e9201f4b63246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825580, "uuid": "cf58f2c1-3e59-4077-861c-6bcebb1d636e", "comment": "Malware payload (RedLineStealer)", "value": "09084af6cf939f828ea84310d3041379b93ae2df15db618e20551f30e549eaf17a775aaca0d033c580d69cf82065274a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825580, "uuid": "6528a96d-0cb7-4a07-892d-8313d72fdc78", "value": "T1C494CF00BBE0C035F1B352F449B5C7A9653E7EB16B25A0CB62D427EA5A346E4EC7134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825580, "uuid": "465aa3c7-5a54-4b2d-bd4d-b7165688569a", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825580, "uuid": "85b36da2-8c16-4fe8-9dd5-492c73ba5851", "value": "12288:NPEibfxquEap9AhwQb7tMm4xWuBtUwadyUrHQ:NPEipN9AhwQHtmtUdyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639825580, "uuid": "068d92ec-7cb0-443a-a2ea-8a0d5edb694c", "value": 420875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639825580, "uuid": "9a878acb-634b-4d5b-bc49-61cb2a58a9d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825580, "uuid": "c50ba762-f83f-4ab7-a074-182d7ba40d5b", "value": "73a53f8b8068543cf8d1219a2fdc671ed53d3602ae6c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375adfe1-6053-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639867106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867106, "uuid": "ded5a631-fc1d-43e9-a815-9c23347942d5", "comment": "Malware payload (Mirai)", "value": "11cf2d507234fbacf6ab7a3b3fa88b91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867106, "uuid": "a7c02069-af4d-4a9b-87ab-1ce46c6a0a38", "comment": "Malware payload (Mirai)", "value": "74af0c090a51d814a006bd58a592b023127d994b6cb7409223df8e6bd06ba265", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867106, "uuid": "e1d834c3-2c2f-48c5-a8c7-4f2bcccdf0ac", "comment": "Malware payload (Mirai)", "value": "c78718eafdc1c524c866c1097e4fea677db16659", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867106, "uuid": "9aa19de2-67da-4355-b92c-d0db070fa90f", "comment": "Malware payload (Mirai)", "value": "c6ae3d2d2111b01ccc137b8cdc735389ff9ca306b19752950e82fe280e8fd6256a8409d0831e4e4ee828848cedb85931", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867106, "uuid": "df49ddb9-9a4b-4107-9211-d821317e8122", "value": "T11CA3F831A641D973D04306F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B561E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867106, "uuid": "63ee6052-b491-4fda-af7b-f11702e2139d", "value": "3072:VK1z13U6HzHoXRtmTUhQog7qmmFVcqq0G27ZT:VK7DDeKlog7qmmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639867106, "uuid": "e277ffbc-cddc-4624-aace-5ab7a33b36b4", "value": 100043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639867106, "uuid": "693fbb20-ca9e-40ba-adb8-da81d7b990f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867106, "uuid": "09524cdf-dd9e-4a44-8fcf-2626300dd8fe", "value": "11cf2d507234fbacf6ab7a3b3fa88b91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dbfa480-5fe1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639818316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818316, "uuid": "a07222ac-1ffe-4d9c-8243-40365bd39aeb", "comment": "Malware payload (RedLineStealer)", "value": "1b0332f5e16ca53771e891705610b780", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818316, "uuid": "8474a68f-4e8c-4635-b5d4-288d95498106", "comment": "Malware payload (RedLineStealer)", "value": "74c5701189877d6ff1cee769cfb34bd211feebbd4ad1e03c4f5c609dffe184ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818316, "uuid": "c06bff47-6140-4e88-848b-c8dd5dcec1df", "comment": "Malware payload (RedLineStealer)", "value": "b763b9f5c4f189b9ad29913b3eb8ec551dbe41a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818316, "uuid": "f5afd18e-aa43-413c-93a1-449031e67493", "comment": "Malware payload (RedLineStealer)", "value": "4e34434de0d4506828166d608cd3c523bc102a3e4817ba2e4c870f0021c3b36f8aa9e8eb24129e21639aafafd186dacf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818316, "uuid": "d91fd8fe-72e2-4ad0-b82e-950a13b0ed55", "value": "T1FEC4F42839FB9019F2B3EF759BE875A6CA5FF7633707A05E205103864A13A81DDD1239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818316, "uuid": "36717e96-ba11-4077-81a2-a914e6b6e5a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818316, "uuid": "207db142-6bbb-4c67-be2c-ed52c0bc37fb", "value": "12288:uGk52vWM8QxacHdGiGoPfeCyfttD3y5pJgOWCQXer6H:uP52vKQwcHdGiG6KqYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639818316, "uuid": "8e221751-1463-46a9-b8de-e8a2b661bf25", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639818316, "uuid": "30cbc43f-0133-4a6a-b7dd-85c0a292a83f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818316, "uuid": "9fc0a8b2-cae9-4786-b2cf-3cf0da0df21f", "value": "1b0332f5e16ca53771e891705610b780", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21feda82-600d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639837006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837006, "uuid": "5062eddc-82e0-4e1b-bd25-b8c9197c98b5", "comment": "Malware payload (RedLineStealer)", "value": "b91614e213d4903fd8475e50b9b959f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837006, "uuid": "7829a7f6-1e38-418d-b1ea-775ab8562c45", "comment": "Malware payload (RedLineStealer)", "value": "755b5b9cf4c175b6e65c5952cdb04864971a034bab3e9ec484d2f85d312a6436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837006, "uuid": "9974496f-15d2-4ef0-85ff-3d173becb287", "comment": "Malware payload (RedLineStealer)", "value": "66134a968dc3f50459eb42b3e11a3e2595b790d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837006, "uuid": "16b1f94f-6cb2-43d1-a802-32d107210083", "comment": "Malware payload (RedLineStealer)", "value": "c11fedab265dad7c6eb4522d89b67e0e80b3a3acd53b5df0e27c52520a8f17f1c6a58748b34d950f14cbe3f6c60708c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837006, "uuid": "480761c7-89ee-41f2-96af-cc622edd5fb6", "value": "T13D94DF00ABE0C034F5B752F449B6D3ADB63E79A21B7494CF62D456EA4634AE0EC32357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837006, "uuid": "fc9a2707-2969-40ca-8c9b-07851ec31fd4", "value": "97510e08b27860260a6b4085182271af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837006, "uuid": "e68e9872-961f-40cb-83d4-31a88ac54e36", "value": "6144:G/H4UvwYogRhavtZSh7URusIGG+xdWnPbc4dtHMWJn:mYDQwVMh4IGG+xdWDc4dtHFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639837006, "uuid": "02280063-a5a3-4645-a1aa-4e392b757e2c", "value": 419865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639837006, "uuid": "49863fe8-6872-4301-a3e4-e06eceb22c5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837006, "uuid": "5dc1b63d-d56f-47ca-a9dc-241c43043976", "value": "b91614e213d4903fd8475e50b9b959f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d61904-600f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639837875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837875, "uuid": "988e1401-be9d-4613-ad90-d7b2852b31d3", "comment": "Malware payload", "value": "e83517fe9b3f52c6e737fcc19419a8e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837875, "uuid": "870a3a91-e88f-4528-bed6-8ac825d6d70b", "comment": "Malware payload", "value": "75aa979f8875e3c4586d311d27612058c99e975649cd4ea26d0ee43d98888c8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837875, "uuid": "b764c43d-a230-45cf-a71e-400cd551d1d1", "comment": "Malware payload", "value": "04c6caae34bd9d7cac2377279e51371bd24e418e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837875, "uuid": "5ca69410-2abf-4e45-819b-ff297b1a31c4", "comment": "Malware payload", "value": "1adbd2aec0b313b9bad63497b3b91f88aebfd41f5d574c8e714126241c82881dafc4cc0b622cc2eed7942e0415270655", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837875, "uuid": "3a92c26d-7956-4111-99fe-d36b118906b1", "value": "T16746231413C1B2EDD163167999A401DCCD3B2C7E1860AAE30DDF7A9D19B32934E63E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837875, "uuid": "0372c201-1e04-4bd4-8dd1-5b8c4499fe28", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837875, "uuid": "1aed85af-6666-44f4-a3f0-0960d5c44d71", "value": "98304:0Z+Rc4hOpnFsxIgW7XufY6ypRsJqWLmWGYlFxocfzo7IiI6fG3ixC+u:0oRvwFf7XgjypGWNc70IiI6UTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639837875, "uuid": "2277cc30-d668-42b2-a907-0694811d2e8c", "value": 5693834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639837875, "uuid": "32a4d870-62b6-4382-b137-c3019f403811", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837875, "uuid": "1a2d892f-59b9-40d9-b4e4-eacc527eaff2", "value": "e83517fe9b3f52c6e737fcc19419a8e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22b4d2d-5f9f-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639789976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789976, "uuid": "a61e9a0d-3cea-4b2c-a7d3-b65c228c41b4", "comment": "Malware payload (ArkeiStealer)", "value": "0df3058a1ceedaf6208e8744fccf610a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789976, "uuid": "cf39f690-5c5b-4fac-8bbc-99fb13d629af", "comment": "Malware payload (ArkeiStealer)", "value": "76caac0e681418f51043b3cf19b7732021991b700df24766b590fc72ddf75e6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789976, "uuid": "3943a53e-42cb-4719-b176-2581cf4a6dac", "comment": "Malware payload (ArkeiStealer)", "value": "f8253b44753fa1000f55df31e70bc0eedd6c064f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789976, "uuid": "7e81e2e4-5301-43a9-8fb1-7d9aa9ca0348", "comment": "Malware payload (ArkeiStealer)", "value": "2d5930737539ade6d82ecc3a6176591c8b7fd59976ea7bef8cf0153d6265da27a357ddd18b3a0cbe7956e8db4a0919c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789976, "uuid": "151c269b-7c71-47bc-b144-1235a08c189d", "value": "T171F40100A690D035F5B783F44A7AD378A53E7DB2AB64A1CF62D613E952386E4EC70347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789976, "uuid": "0d9470b3-563a-484d-a1c6-77673c87a2bd", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789976, "uuid": "92bc9ca3-fe83-41b2-a8d4-d454cc52d1e7", "value": "12288:7r1/Z4quDmhVLQ6HZVJuVXhRCukIwx4zlaOQZT1xwLmr5UKsbJzHxJw9XlvL:fpZjuD0VRZViXCxIweRnQZTXVUXJwfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639789976, "uuid": "fba7d58d-cc8b-41fd-8b6e-63e8974088fe", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639789976, "uuid": "5873fa17-664f-4b3e-9216-6b306da45aa4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789976, "uuid": "4bc67d3e-2173-4a52-a6ef-0121f50f3d9b", "value": "0df3058a1ceedaf6208e8744fccf610a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9df98a-5fdf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639817403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817403, "uuid": "263590f2-62fd-4db5-b4af-fb03c4361c7d", "comment": "Malware payload (Mirai)", "value": "a23df0fdf3577a9707a61a3cb3be5b68", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817403, "uuid": "efc18f0c-ec56-4e70-af9c-65c5b0318adc", "comment": "Malware payload (Mirai)", "value": "76fa1d28b0b9394c612770a3cd809b9ac59674bfd95508a1173ac5aaf22b8251", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817403, "uuid": "6f432817-0916-4afe-abe6-fdb2acea971a", "comment": "Malware payload (Mirai)", "value": "36032f8e1e6681eee6bca5eb763c3eaca1f991b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817403, "uuid": "fbbb3fec-49aa-4e42-adeb-e56755b2dc56", "comment": "Malware payload (Mirai)", "value": "ae2704bb2bcb4ef529980f9d7dc74b10222e1c4c143bf2105f0a0c4ec4a6c7966aa6cc814dbc6fb7a33df9cf6ce9b8c3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817403, "uuid": "684cd357-167e-4e57-9e45-e62f4a1a0fa9", "value": "T1ECE34D56EA818E13C4D527BAB9AF01893332A75493DB730689185FB43FC6B6F0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817403, "uuid": "39f71c0f-af3a-4935-adf0-d6af2b8758f5", "value": "3072:MgxYi2gojQeTWKrsRdx4KD+w/6HCPK0d27u+bn5mx61hXnu/IM/9wBqh:HxYi2gojvTWK4R4KJZ27u+bnExQXnIIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817403, "uuid": "3bb0b712-f566-495e-9f91-1a28c9b13866", "value": 156877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817403, "uuid": "f7582d47-51d8-402b-a3f2-c149cb7a0d8b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817403, "uuid": "24c70c28-346f-4cd7-977e-20904d4075e4", "value": "UnHAnaAW.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1777fd-6001-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639831901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639831901, "uuid": "c12161ea-b878-4a04-aeed-e0e10a499b75", "comment": "Malware payload", "value": "d1c43bb1c9758eee8d2643731af9be7f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639831901, "uuid": "2221a546-f324-40e0-854f-34d121b6048b", "comment": "Malware payload", "value": "77178a444840db24cd1398ba699419627ae1ab61bdecda746abd3dd415bccd44", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639831901, "uuid": "5d30f605-464f-4138-b629-10ddec91300a", "comment": "Malware payload", "value": "0614681917d21a1d06492583561643599d12d5ac", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639831901, "uuid": "2c39e41c-7c2a-4217-83ca-6fffb9481e3b", "comment": "Malware payload", "value": "524764dcce8d831462fe21f0bbaef3492985f85cbcf8111f69c1e89ac37d836db2b518b9ccff363422ae7555b60f5f2f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639831901, "uuid": "488e7a23-e762-441f-8f1b-0b219e618f24", "value": "T181C49E20B3CAC93BD2BB01702917D39B59687D2147B1D0DB62D86A8E1DF6DC1817BEB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639831901, "uuid": "71a687e0-46e2-416a-98ab-909fc6d3947e", "value": "12288:AnlHY5ATjJDJdQflxuOhr6IF3CP5pu1jLkHMt5Oz:AnpY5ATjJDJdMxuqjFt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639831901, "uuid": "41c4841d-89d3-4ff1-b7d4-00ed06ca2919", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639831901, "uuid": "6cafa547-08f6-4b27-bbcb-f068ebbeaac3", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639831901, "uuid": "482d6988-02bd-41cf-9df7-01d9c2ad444c", "value": "encomendas010-5u44cr2luF.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c19c48f-6059-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639869691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639869691, "uuid": "d2263405-0b8c-4f77-a3b2-92d9fefd7e26", "comment": "Malware payload (Mirai)", "value": "762b7b549c0fd7193682398f37a77af5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639869691, "uuid": "8c208460-d06c-49f2-924c-67f191706c0f", "comment": "Malware payload (Mirai)", "value": "7774862ffd360cce2f0c5ef7f7202d1bc310f5c8d66bd2f13d44492af8e00f90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639869691, "uuid": "5e87ef78-47ca-44b4-a6d1-b0d777ed688e", "comment": "Malware payload (Mirai)", "value": "d877a51e6886d1897fd9f85c918bf8cc00ccb862", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639869691, "uuid": "f0497359-8131-4b51-8725-9667e0f9ddd1", "comment": "Malware payload (Mirai)", "value": "3af7c16db5ede3d047f9b16cb9eb46c9a710d139826b9879b94ac5fbf53cee9e4fc2c180db5cccf7e4dbbddf13befde7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639869691, "uuid": "c711f0b8-dd98-425c-9520-124ac24a7eed", "value": "T1E5735C34A97A2E26C1D0B13F22FB8761B2E5260E25B4865D7CB60F4FFF2065464172B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639869691, "uuid": "4386ca1f-5f3e-4acd-885e-b355c3ea41bf", "value": "1536:Azvh+FNkgj5cXlkqFfjzYWcSHGhQxV6vVgFpqxfiFFm:LtIYWcS8vVfxf2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639869691, "uuid": "aac96136-d1d6-4cec-97d7-7a3e0c42dd33", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639869691, "uuid": "cdb7bbfa-103f-466c-b4b9-57fb011006d4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639869691, "uuid": "a984c803-b409-43ae-8c0e-53db03d6aa72", "value": "762b7b549c0fd7193682398f37a77af5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ab1e30-5fdf-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639817274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817274, "uuid": "ee51e067-b2e4-4675-a19b-c84110ae8ecd", "comment": "Malware payload (Vjw0rm)", "value": "0df3a8c017448979574150a7ec49268d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817274, "uuid": "bbede225-bf80-4fe5-a66b-4e01372c87a7", "comment": "Malware payload (Vjw0rm)", "value": "796e03ed9e5304d0a2bc4855b89282b0fe9f4522df8e27a3923e26e13e1e257d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817274, "uuid": "66062074-c8ce-4d3b-a5a6-eea009e3a90a", "comment": "Malware payload (Vjw0rm)", "value": "075ed41bbf2157cb4d1bfb64ad4029b30749294f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817274, "uuid": "5c608f3a-64ca-42f8-a5b6-4cb0e0ab6c86", "comment": "Malware payload (Vjw0rm)", "value": "84b7e1ca9b0adb4155a658b8bb78c7ac999141398b0449870b344070212a02c541187ffa90a87c15f9d9d94482065758", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817274, "uuid": "ae1f9d83-584b-468f-b6e7-d4e5aedce274", "value": "T1CEA48D90BAD466BEEDC665EB55A3420F67B8A11332051449F1D0FA303FF9FC4922BD1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817274, "uuid": "7ff57c20-60f2-477b-a38c-310e552762cf", "value": "6144:dg1OEuAXgqXfHTTTzedXkJdcuaxgINQYCzC2dxXx9ONOhLVYGtg0wr0:M9LhLVY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817274, "uuid": "0ac86149-a22e-4109-aef2-02092081fe94", "value": 455441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817274, "uuid": "21efabfe-e9a1-4181-a0e5-151ba33a5a6e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817274, "uuid": "f620810e-9966-47e6-9988-23934ffe82cf", "value": "IMG-17122021.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427bf6b0-600c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639836631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836631, "uuid": "5cff1a76-7a6f-426d-a377-543fb5ae525e", "comment": "Malware payload (RedLineStealer)", "value": "0cb983f738bf71a67f7ba00cbfd3770a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836631, "uuid": "d9be783e-bf41-474c-b903-58d870f65919", "comment": "Malware payload (RedLineStealer)", "value": "7972504035b05ba390f0e4083ef1d4ee7725ad5c581ab6beb730425f4b6945ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836631, "uuid": "79097e60-88d2-4c16-99fc-b25b1d37e23e", "comment": "Malware payload (RedLineStealer)", "value": "f31ed482b2226a3d9888332f829a4556bf8e3283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836631, "uuid": "40a49d4b-fdce-4e82-bbac-5a9ae8057d4b", "comment": "Malware payload (RedLineStealer)", "value": "bd65ae2c9fcfb1efabc2598e004020ed63b5787b347e495b87d795e46df636c1d229ada0aa9c1042548908ed18a10aa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836631, "uuid": "0d3ffa01-aa80-4dc3-85f9-8a62f7b266a9", "value": "T15764AE0067A0D436F5BB12F449B693BD753EB9A16B74A0CB22D516EE5739AE0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836631, "uuid": "8cbc0b66-14af-4907-8610-0edd12497b94", "value": "4ee83624426d72301d5dc28b390adabc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836631, "uuid": "1c3ac5a3-e933-494a-bcfa-fe8d877687ca", "value": "3072:SQ07Dx7y0eREnOs09KJTT/hX1F80+21+ACMUVGHp5sDoN6W31HBiVz7UHEAqBhsT:S3IEb0o5Y3GUVGJ51HBiV3HAqBOhaNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639836631, "uuid": "db2ad585-31ae-4a98-af99-a00e56da58fe", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639836631, "uuid": "6e0514b2-e1a1-4311-8dd1-ff4fbfa29d69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836631, "uuid": "7bc82ffb-0d94-4c8f-bc9e-6a9fa67b2aed", "value": "0cb983f738bf71a67f7ba00cbfd3770a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df41a913-5ffb-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639829592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829592, "uuid": "815fa4d8-512f-456f-b57f-d4041dc71d16", "comment": "Malware payload (Gafgyt)", "value": "3157379115d2fb581319d170becc437a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829592, "uuid": "d52d667c-678f-41ca-aca9-fba378f30f0a", "comment": "Malware payload (Gafgyt)", "value": "7a0171528939639233eb551736f9bbe11ccad65fdaada7411e0ca07cda271524", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829592, "uuid": "5615064e-f12e-4612-b8a3-d659a639413f", "comment": "Malware payload (Gafgyt)", "value": "861de0d1776f8c9f07b14e92a946b8e7f2aab453", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829592, "uuid": "410d1afc-220f-4fde-8e38-3347fef30a8f", "comment": "Malware payload (Gafgyt)", "value": "6ea185f2b64ff18d0979760a00fac2d3fec593140cfc16b7266451351f0d494141c7c576df2864aa83ceaeeb90f7e293", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829592, "uuid": "66314dcf-614f-46ee-9534-9bdddccc1474", "value": "T177F33A09F6408757C2E3277AE68F424E33339B94A3D733055938ABB43FC2B995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829592, "uuid": "fc2405ae-8b32-4c3f-afa8-6a03d947b38b", "value": "3072:EO7R3sZXTjFx+mladyVPXn0k4CbSJYM/9bimzwfBxpQ+xn:EOd3sZXfF8mlawP0DCbSuM/9WmzwfBxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639829592, "uuid": "8de1886a-b9e0-4427-8d50-591a285b7a3e", "value": 163672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639829592, "uuid": "dc9d30fa-9be9-412f-b23f-17f2e7341754", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829592, "uuid": "f4cd435b-4d83-408c-aff0-08229dd44a16", "value": "3157379115d2fb581319d170becc437a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d22218-6045-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639861309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639861309, "uuid": "41abaf4a-931d-4732-a5de-281202ba9e97", "comment": "Malware payload (AsyncRAT)", "value": "65293e3a7bca4ed28a60bc8b6cc82d8b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639861309, "uuid": "6029cdbb-b0ee-437a-ae97-6fcb924cfc6d", "comment": "Malware payload (AsyncRAT)", "value": "7ac6a1cb532419ac9bb9601f6eaaa0dce71aa039b0c0ae0d230f6f190adbde1f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639861309, "uuid": "c6eb4283-ffbd-4fe7-bb1c-647273503c3b", "comment": "Malware payload (AsyncRAT)", "value": "7f050a0b3852391137a8fbdd5993a0e6e8a8d539", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639861309, "uuid": "732eacf7-2ee6-4978-91a3-dfd0fa473392", "comment": "Malware payload (AsyncRAT)", "value": "93a00823d6747a4c25ec5f44824ca29d914f8cb24231c2594e0ecb126e1c209a9928ba401f2147e0e39da2db625c0695", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639861309, "uuid": "5b255c26-60ad-4c64-be0e-900f26dc7948", "value": "T1FD64C038AFFC4516C7D847BBA0EE41D08BB6B6537347E79620153AA46F023F2AD1611B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639861309, "uuid": "5847cdc3-7044-4314-b342-318174c23e61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639861309, "uuid": "3949e5e2-04b1-41b7-a22d-b7de3661b08a", "value": "6144:9wR27H4ZJWGLxgRS79PwDEEzlUPFY8k4VQZfyFMseBsA96:9wR6o5LWRI9PclUPFY8kgYfyCn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639861309, "uuid": "81b05886-3117-4a90-8436-2fae98a3821f", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639861309, "uuid": "3e1dc55b-9693-4e67-8b79-a36ed849977f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639861309, "uuid": "9f115d27-2d74-400c-927d-d3c49acacd07", "value": "65293e3a7bca4ed28a60bc8b6cc82d8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6daba1-5fd7-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639814158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814158, "uuid": "ef7ffc22-6c42-43ba-afee-611885ee4f3a", "comment": "Malware payload (RedLineStealer)", "value": "a59530536f012852798c13e29dbd36d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814158, "uuid": "3ea9284e-8455-4aa6-8e41-6e40e9a8c4fa", "comment": "Malware payload (RedLineStealer)", "value": "7cc3cce2c0769a5848eac353d5cec1c6381234347cab7b0d59ad8de240306da5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814158, "uuid": "cde7e643-0f5a-418a-af36-2ec8ca7cb0c7", "comment": "Malware payload (RedLineStealer)", "value": "29272c9da433c531caae73ac859ae03e34c40ce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814158, "uuid": "14d3d995-460e-478d-a378-510405f45214", "comment": "Malware payload (RedLineStealer)", "value": "db1c45ee6340c836295c8f8cc49ff4fa5f972babf81630c28197e0c79348487654b4276b2d96eef66e58f461ac0a00e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814158, "uuid": "5cb53eb0-4db9-4d7b-96b8-7795eb071bc7", "value": "T1E3649E00EBE0C435F5B752F849B693ACA53EB9A16B64A0CF52D516EE07386E4DC70327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814158, "uuid": "c572ac72-a564-425d-9bab-79a2c332436c", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814158, "uuid": "82f9fe0d-0a46-4a0e-989d-0b1bc101fda4", "value": "6144:dstyOz9aRkDZC//zw2vtV4HF2N7sqcx+fqxnFG:Xg9aRKZWzw2vtV4HFasqcx+uFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639814158, "uuid": "b48e8805-7510-4e41-8c14-0d4a4ca6f562", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639814158, "uuid": "47a258ef-6ef9-4b31-93ee-c41b182c3728", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814158, "uuid": "03afbb80-421a-4e90-b2b9-5e6aaf943a7c", "value": "a59530536f012852798c13e29dbd36d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65597dba-600c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639836689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836689, "uuid": "63cceeac-0b3e-48cf-bbe0-9d9be6412f81", "comment": "Malware payload (RedLineStealer)", "value": "3ae44fed21b674a063bd0858d42048a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836689, "uuid": "e9717bdb-7aee-4c02-b18f-bb144e53c4bc", "comment": "Malware payload (RedLineStealer)", "value": "7e0cfe380a83928873c3452771347e5917107e3fe97d0a386af9b7724326ca0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836689, "uuid": "41ef342f-b165-4f85-8056-e8332c57d7ac", "comment": "Malware payload (RedLineStealer)", "value": "e587c54e0cdaeab38a32299d68a14b3848cbe920", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836689, "uuid": "908a3bd7-8009-4e57-a68d-31d6869f63a4", "comment": "Malware payload (RedLineStealer)", "value": "4902d9af98316dc67c2912fa75e3485d76c0fcf8ebfd31778c67885732e787a061306bf981860718c2d83078090dd89d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836689, "uuid": "ba8d7543-95be-4775-9198-894fb9e3666c", "value": "T1CC84D000BBE0D034F5B742F449B693A9A93E7EE15B2490CB22D427EA57346E1EC71397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836689, "uuid": "475b48a2-bbd7-4415-a952-77994e94d519", "value": "e00af8f1ad8949415054b06be51fa3d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836689, "uuid": "673f47ea-6110-4044-a234-5a11026ed6ef", "value": "6144:g/Br34ad7Mhou5p034iK769u5iha3xt9iJlcpwK5zd7:wBpNMhrp039j9Qiha3xt9IcpwK5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639836689, "uuid": "b36eedcc-76de-450d-8940-a9996a4500c1", "value": 406551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639836689, "uuid": "be6c8da5-e531-4670-ac67-a0a107c1984c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836689, "uuid": "41e9a108-ee8f-44b1-909c-9247de0d7f4d", "value": "3ae44fed21b674a063bd0858d42048a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5f4241-5fc4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639805858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805858, "uuid": "4d68211f-b9da-46b7-a0d1-c035d99be423", "comment": "Malware payload", "value": "f56ec308fd1f14611d4c1a9eac95f3f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805858, "uuid": "f84f11e4-95cd-4612-8d5b-6675cdfb546d", "comment": "Malware payload", "value": "7e7cec532d0a1573ef8143e63966e5357c335086d75b8c560341a6c318834b17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805858, "uuid": "186990bf-7369-40b1-985d-c619cca103cf", "comment": "Malware payload", "value": "a2c41e887c0403ede06ff7801d4db731fdc54029", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805858, "uuid": "47896368-cc9e-4623-b3b3-024c5bf01d28", "comment": "Malware payload", "value": "91a3edaf86862f84791c4c6f1f0236d5e54049f10c7dfa5ca40b056a6d758f84f85909187914db1d462539194c2003ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805858, "uuid": "f8e024a2-1c03-4174-bcc9-c73dfff5e087", "value": "T1E6063342B148693BC7DC3739AF40C8B043749C8EAC1299B6A1F54D4B36EE1976272F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805858, "uuid": "c0a21849-e843-4c45-80c8-8e3599ee60e7", "value": "49152:550r+aZo0k3YV6puxUql99e2zDjC7NhG0JtEGLqgryZzRf7pwEYiPje5M8cEqGkP:/OZN4cxUqlOGmmEZLqgofWEZ0lTAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639805858, "uuid": "384b0d16-87be-4e98-b566-d4e24febddf0", "value": 3771392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639805858, "uuid": "5533fddf-a2ac-4805-b832-af1f80ca4bb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805858, "uuid": "2ff0b766-c066-4b33-96a3-0552861af322", "value": "SecuriteInfo.com.Trojan.Heur.031132C3.26186.16452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af20f1a1-5ff2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639825646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825646, "uuid": "97d831df-ec8e-4745-bf86-332329c9e6a6", "comment": "Malware payload (RedLineStealer)", "value": "cb1d4559a6ff4b4e3d62d56a4c01a319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825646, "uuid": "2d96d615-d71f-49e7-a3cc-b22e455dcc71", "comment": "Malware payload (RedLineStealer)", "value": "7f593164077154a1fdd97cf86e0d320262a26eceead40fc95bb5cb97ca5674f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825646, "uuid": "7e3d67e5-a894-4191-a3c3-3c6704fce726", "comment": "Malware payload (RedLineStealer)", "value": "2d2a9685cdd63b3aaf724e614760c7e31fdcafc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825646, "uuid": "060bc5a0-640f-4dc4-bbdf-aa85adab337d", "comment": "Malware payload (RedLineStealer)", "value": "ab0e0a3ed216421aedc3a32e0e961f1b10e6e0f48101e31bd2e6ca12034c7646c4f39f1bead679a0b4a005c15df96d51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825646, "uuid": "5c781d40-7dd5-4365-9f89-26e18a292ebf", "value": "T1D2E40292FE141ACFF42F8531C04696FE2570AC699AC4025F7169F63E0DB324365AFA6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825646, "uuid": "ac70c326-e735-4748-aea9-12a38380a496", "value": "def81bcd89fff56a072f7c109fd4635a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825646, "uuid": "5dcf82bc-6f8c-4cdb-b98b-0c1f40454396", "value": "12288:GQB0hTP9k6U9+q6ptcEFxl+KkJUW0cQ0mkVkt+HllWbJYvN:GfhTPa6i+ptcEFeK250DBkGtyWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639825646, "uuid": "f26d783b-eef8-493a-8b2e-7670754e29a4", "value": 680880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639825646, "uuid": "45df092c-ad62-41fb-bea6-0313cc4928a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825646, "uuid": "3b6700d6-b1bb-4a09-bb03-e66bd8efde74", "value": "cb1d4559a6ff4b4e3d62d56a4c01a319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45564c5-5ffb-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639829601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829601, "uuid": "81c643e0-1e2b-4cf3-a920-88f90f4eca94", "comment": "Malware payload (Gafgyt)", "value": "613ecf5c8ef3f63442c471272524adb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829601, "uuid": "a861588c-ea56-4850-a46a-8bf977b0d427", "comment": "Malware payload (Gafgyt)", "value": "7f9e25e8892fb2127dd662ec25a9eb244351880ce3cb7a3fd2d6c2fd6fa8a842", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829601, "uuid": "fcb5a27b-ae0f-4a92-84de-4f46fd8d6cec", "comment": "Malware payload (Gafgyt)", "value": "987a9549949f189e2199b093d911ed04bcb8ac0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829601, "uuid": "fa791305-e757-46ef-8678-b4f35214ea8a", "comment": "Malware payload (Gafgyt)", "value": "d44268c074c5c2659cbd2e9e1b2837e5c96cee80e9e9388ed5d15e702e2639630e5f0462f920ef375398b27b5582b831", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829601, "uuid": "8c09779b-5825-425e-87f7-3a0d7b2881b2", "value": "T1CED3952E7E22BFBEE168923107F35F70879521E637A19382E16CD6581E7118D1C9FB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829601, "uuid": "0bf40b48-90d1-431e-99a0-2101ead777f7", "value": "3072:PDE2O1ZeA0mZPt33tNqa/nzimWEMFB1DyzV9/:opZImZF3T/zimWEMFB1DyzV9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639829601, "uuid": "8cfb2b51-5d83-4374-804c-5b38be0aefd8", "value": 130464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639829601, "uuid": "42a98ff1-b490-4c7e-b09d-e19b469d6ba1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829601, "uuid": "d77144d6-4c60-4c50-a18e-14340e035738", "value": "613ecf5c8ef3f63442c471272524adb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076a204f-604b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639863590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863590, "uuid": "6b47087c-0d84-4a4e-a4d2-437e50d5dfea", "comment": "Malware payload", "value": "f38d26c4a394d3235d7f7c6d6a07b5a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863590, "uuid": "f6e564b2-7233-496b-b038-beb198dae123", "comment": "Malware payload", "value": "80290fef1f917517828287fceea4b548798791a3c9a41a16b4d28e4648ef440b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863590, "uuid": "d7a675b3-4ee6-44ea-95ff-f58a66d4d9da", "comment": "Malware payload", "value": "5312f6719029b6cf254f6e1f669b0fe140115195", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863590, "uuid": "dda33ab4-eccc-4b08-9441-412b5f765031", "comment": "Malware payload", "value": "af1864ff0be7aa665f2b2f8d29d33d4a437474aee3a8ca718bc926af47c7aad5ff57a76e1a989d6805e3ee3d7cd51f44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863590, "uuid": "ec945cb4-71bb-4d49-85a4-7c37f4df0e02", "value": "T124F2D01D160B64CCDDA6DABFF59A53A45DAB0A7B1213CC036C00F55BEE820723A727E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863590, "uuid": "35665354-9ab7-4c2c-8ea1-9778376fe939", "value": "768:/0d0BLh1XRKimt8HJWBhjxOBUs6DU6BFv3JgGlzDpxYsP:/eYh1hKiG8HWjxO6s6DU8vVrYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639863590, "uuid": "a3de464b-315a-4841-bab1-b204038a11f8", "value": 37296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639863590, "uuid": "0af6619a-e080-40da-a821-2e51910db5c0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863590, "uuid": "d829174b-6e75-4715-9524-7914b11078e0", "value": "f38d26c4a394d3235d7f7c6d6a07b5a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962844c5-5ff2-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639825604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825604, "uuid": "46c34684-ff91-4a6e-b652-1dd912ff06e2", "comment": "Malware payload (Formbook)", "value": "ab390a0b09d31cca8a0be0f489d00e57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825604, "uuid": "971e4068-502f-4a36-be6d-ac02e5a6b594", "comment": "Malware payload (Formbook)", "value": "821d7489d8ef08b8ebdfb08350ac7cf3ae8ac918b4a1aa4bcbbcc0ffbd668059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825604, "uuid": "03a9b13d-675a-4b6e-b4b0-a4640e9261a2", "comment": "Malware payload (Formbook)", "value": "7ecf244e0948a3e338f9a73643a42007dca042c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825604, "uuid": "ba11fece-6548-4ec9-853b-e6e04c626572", "comment": "Malware payload (Formbook)", "value": "1fedec92071148348bda9811ec72f4fb0402f7b35ff5f27adfedae2a5ee2ab7cec8d3973afd492e4c2112b9892817f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825604, "uuid": "19e9153b-a7bb-4233-8590-3ced078b5c07", "value": "T189A423166DD4F167DF3006721D9FBA77B7F3015400AAAD474BB9AEE72F286420B1C682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825604, "uuid": "f2aab821-7881-4872-803d-ab2c203b3e24", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825604, "uuid": "9ecd25a4-20f6-4029-8eb3-d61370eca548", "value": "12288:y2vHwBEnXlfYZQ9mA3hpOIOMRp+qt6DC7eJv:y2vQCnXJAInvBUC7mv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639825604, "uuid": "b64b7425-7ae7-48d1-b4fa-c7568920815d", "value": 468482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639825604, "uuid": "92380cc9-f3c7-4268-a9e2-1cddfb5e0ee3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825604, "uuid": "f65aeeb2-bb85-414f-a7dc-d58ba202e027", "value": "ab390a0b09d31cca8a0be0f489d00e57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2892447-5fb5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639799533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639799533, "uuid": "1024669d-d7c1-4ed1-ac64-ea4a4a73bc8d", "comment": "Malware payload (Formbook)", "value": "cdc132cf9e1e26ea0fed472472af893a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639799533, "uuid": "84011bbb-acbd-43b1-9923-bf1dd16c0cf0", "comment": "Malware payload (Formbook)", "value": "826b9ddd308b1e1df1e1e9ec256b8a0c6e458e69ac98389d057cf2bf830221a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639799533, "uuid": "ad049d48-392f-45d3-9f18-19fa11c46593", "comment": "Malware payload (Formbook)", "value": "a3aeb812011505c3e28ebba3565c78c73fb9c99a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639799533, "uuid": "bd5398d6-141d-4bfc-ab58-b297ab6aec13", "comment": "Malware payload (Formbook)", "value": "47982157fc3bf6817710245f1d3e471010135a8edc0cff18469b0d54b8024bdee7ae2c1f3c19e2ee50faea014c6a9765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639799533, "uuid": "44bcdc8d-a118-470f-98f3-432f0bcf9189", "value": "T108D4BE212A449BF1D83CB734D233154493F76A7B9F06FE9E7CE912DA4850F49C6A3A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639799533, "uuid": "be47af0e-abc4-4141-8d37-17c48df3e17b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639799533, "uuid": "0989002f-bba8-4273-80d4-935ed43701d8", "value": "12288:sTbZ5qzJIwVc2OhFF/wq7hQunFuyO0y5xMT86BwOSj9:sKJIwVuFF/wq7hQunFu5BgvKj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639799533, "uuid": "56bc67bf-d604-4163-bbe3-b92e07479291", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639799533, "uuid": "ff56f532-7efc-44fb-80ae-44528cbd22af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639799533, "uuid": "8c204972-3973-41ca-97e8-357b545cd813", "value": "Profoma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6b8f69-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639844108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844108, "uuid": "5536d72b-2af0-4849-b7ec-652763d06fe2", "comment": "Malware payload (Mirai)", "value": "0b64ce7bb9db3ffec728e5a7d8f9c451", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844108, "uuid": "cc7f5e41-47b2-4ab0-af22-d9ecad1cf77e", "comment": "Malware payload (Mirai)", "value": "82e91e9546888d5e4c9fad8ea1f205c98fd4070f0a515bc2712077e47d776534", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844108, "uuid": "219e4688-3ede-4ce8-a18d-b6b020432710", "comment": "Malware payload (Mirai)", "value": "3b5d48fa014b9a5ca51dd4f229ff3c7487e67d36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844108, "uuid": "65527426-6e4c-45e4-bb44-f4b65d1a43f6", "comment": "Malware payload (Mirai)", "value": "5c8e000fafc66dbe801dc03a9823066d33448f1e3c231b1b3815403398a42e1d6689b831be675f575be8ec37a78f7351", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844108, "uuid": "2217acef-e712-4cf8-9b28-ed910d050355", "value": "T1F5E2E0B8531D089ED939D1B413DA0F962EBC021AE403DD5779D666C0BEAE4EB7803BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844108, "uuid": "87a226c3-16e2-43dc-839d-680c073c4fa0", "value": "768:ogc55zJGciHFlH3s+yKNdEZxBcx33tN5PyJgGlzDpbuR1JL:ogcbJur3R+7OdX2VJut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844108, "uuid": "44930eba-33d8-48d9-84bb-42d73f66dbc4", "value": 33380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844108, "uuid": "61828554-cd7f-46f0-98d5-210b78a98013", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844108, "uuid": "3396f1e8-1562-4781-a50e-db4e55a31330", "value": "0b64ce7bb9db3ffec728e5a7d8f9c451", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0687ce3-5fd5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639813220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813220, "uuid": "f0aacb57-a696-4bad-8342-b60a6eb2d515", "comment": "Malware payload (RedLineStealer)", "value": "40d68e1a853a80806f6ac0a1662890c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813220, "uuid": "2ced64ad-a2df-4918-a958-28bc31de0627", "comment": "Malware payload (RedLineStealer)", "value": "8323b041e6d80d401329e76951ff41bdf30073011cf061765dc0a812b5bccfe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813220, "uuid": "18959275-1b54-484c-b02f-57afd3b6edd7", "comment": "Malware payload (RedLineStealer)", "value": "b923e4757723c42328f39e45f78ad7908d22c006", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813220, "uuid": "cb35654e-98d9-4319-975d-dcbabdfa871c", "comment": "Malware payload (RedLineStealer)", "value": "a3933d88b91f70b0d813b33480d07fd527353f8937b76d83addf96fe81f1a10d370bf59793c7a5eaad8a5c569cb653c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813220, "uuid": "63332873-4bca-4d5a-9d86-6ba62a694641", "value": "T16154AE00A7E0D435F1B712F449B6D3BDA52EB9A16B74A0CB52D516EE8738AE4EC70307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813220, "uuid": "bb2b098e-7f05-4064-a87e-007e48654f75", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813220, "uuid": "f03d542c-e8b9-4b38-aa09-cf7f5c0aa6ca", "value": "6144:izl/e7fzV5gHI0EnnS14c+OGOSpMqoJuMEbnHT8:wufzV550EnS14c+ONMMqoJuFD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639813220, "uuid": "e97518ee-88ea-48af-bfe0-0530f9c20082", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639813220, "uuid": "1633dd47-3600-4a0d-97ab-50cef4ffa104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813220, "uuid": "b52ba0ca-9ad7-4898-afd9-ddbde6432ecf", "value": "40d68e1a853a80806f6ac0a1662890c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da163af2-5ffb-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639829584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829584, "uuid": "3c9ad0ee-3f37-4682-a12f-0373a729963a", "comment": "Malware payload (Gafgyt)", "value": "683180131e1c783b85a84a0bb6713943", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829584, "uuid": "9d1b5879-f585-4d25-a502-01a66221b53e", "comment": "Malware payload (Gafgyt)", "value": "8348aa342850dae3a6ef9413d8c823d1ecdae24f3111c059b8bb11bca7f0a95d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829584, "uuid": "090a5b77-ff90-40df-9e28-e10b180d217f", "comment": "Malware payload (Gafgyt)", "value": "4e720f5b88d4d88d8619c8f0240ba5d7cafab3a9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829584, "uuid": "285bd37e-c424-43ad-b78e-d18e97d70163", "comment": "Malware payload (Gafgyt)", "value": "0dc40e24f754a59f56dee511d117ed461b65ee72542cd417795c7b51883d4b5840a70dd8e5445f46522bde9860dddecf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829584, "uuid": "60d79d31-7830-43d5-9945-06f90cf2907b", "value": "T1FAA34A27B392C77BC08752B41BDB9AB1D823B4B91B72720B33E47DB42B558C91D5AB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829584, "uuid": "ef640099-4bdd-403b-8388-8762a048c491", "value": "3072:/SDtGRX5TTITCmysDyv0Irn2Xq4Ip0Esm/+WOXFIaZM9e:1TITCmNfLhwtsm/+WOXFIaZM9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639829584, "uuid": "1b973eb3-fdc8-47c2-a4cd-3e84d8d201a4", "value": 99055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639829584, "uuid": "9d21fb0d-cad3-4008-b22b-dba73fb2a61c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829584, "uuid": "88f69a1b-dd04-4e31-a863-cbadc466a14d", "value": "683180131e1c783b85a84a0bb6713943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01851cd-600b-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639836358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836358, "uuid": "3650f0e5-465c-4bbb-8749-f43f74006707", "comment": "Malware payload (CoinMiner)", "value": "0f750ff92a98554cc1b3f1c381f5c386", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836358, "uuid": "4499ab66-9b31-43e9-b753-0e31251870d9", "comment": "Malware payload (CoinMiner)", "value": "83d0e70a23c542850312be419a86d0a77390d766ce8b5dd21ab0620c1aec75d3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836358, "uuid": "b2c7f4ca-84f2-4394-bb2c-0e586baef3c6", "comment": "Malware payload (CoinMiner)", "value": "730f6c6ae1b0705284b18a4665cae5ba195ba90e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836358, "uuid": "6faa3656-ed19-4341-a19b-39cbb6783a38", "comment": "Malware payload (CoinMiner)", "value": "e50cf59328aeb534fb950165abe79d24010346efe22d9d41add9f2eadb6075a4612f2e834c8f1749c406db1dda21d045", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836358, "uuid": "adb9d7d2-8eef-484d-a824-ea06829cf95c", "value": "T13D649E00BAE0D435F1BF12F849B593AD753EB9B26B2491CB62D156EE46346E4EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836358, "uuid": "682c24a8-a20e-4046-bcfd-01a08f101edf", "value": "cd2e8aca313b88a16bc7b305a3f26143", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836358, "uuid": "e073f0d0-39bb-4a49-b436-2e236bed1f3e", "value": "6144:P6WCJzuSMT8TCGFYmTVVDMqJbMeuNaGhOnB:CVJzuxT8eqYmTVVDMWMeuNaM6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639836358, "uuid": "7cdfff16-a54c-4f84-abc9-b26a4a6cd2d4", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639836358, "uuid": "62348ce8-c1b6-4823-a731-152b7a082641", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836358, "uuid": "597ee40e-6257-4cd2-9617-e458ca4dc14d", "value": "0f750ff92a98554cc1b3f1c381f5c386.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d7f39a-5ffb-11ec-9275-42010a9c0029", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1639829635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829635, "uuid": "a9f09e8a-7358-4582-bed8-83a8ed955fbe", "comment": "Malware payload (Worm.Ramnit)", "value": "b207a633de1de494e1e605d683ae0897", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829635, "uuid": "1bb9399f-0cf7-4117-863c-a75a471487e1", "comment": "Malware payload (Worm.Ramnit)", "value": "85e88e7bdd4657422a121146600c71250d68b44a82b9677856ffda9dbec07d98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829635, "uuid": "f767e580-0bc3-4dbc-b7bc-45f066bbc2fb", "comment": "Malware payload (Worm.Ramnit)", "value": "588841da1cede0e9bd2162df59cedcc4f99b11cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829635, "uuid": "e64e8f1b-d599-4247-a2fb-308848a92eae", "comment": "Malware payload (Worm.Ramnit)", "value": "62d6e9cf0ec525f4e9ecd23a2c14bdcd31b1275cb26a08066314773d6fc30f2ddbf95ae05ef60874ca47f5f1bc0090ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829635, "uuid": "3b1069ff-c6d5-4e4f-a56d-bf4e56ed8ba8", "value": "T17B44AE0F34EEC43AD78E06300AF66B396BFAA1900EA259C75B18FE5C5F31C569D23509", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829635, "uuid": "9067be3f-63f5-4eb2-8199-4dbbadb4f844", "value": "586061a75755e24da79948eb2cbe5f14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829635, "uuid": "4a25e9d1-37ef-42bc-8f7a-df5cb53b0114", "value": "3072:xI/qUWlg8RVOGFAbAsAVA9b/2YtSHf4JjeFocqrdtzULbq/zGCH:6/qZ+8RsmAbAsASb+YtTeFYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639829635, "uuid": "e934c3f1-96ac-475f-a712-ebd73e72cb60", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639829635, "uuid": "a089e6c2-f802-4a56-8de0-cbb57963f295", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829635, "uuid": "b4f26f52-c40f-4ed4-aa7e-037a47cbd5c9", "value": "b207a633de1de494e1e605d683ae0897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1d186c-5fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639805861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805861, "uuid": "f66478b9-1218-486e-9e0e-e52d7964db01", "comment": "Malware payload (RedLineStealer)", "value": "54fb6cb3fe87833b7afafda3951664de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805861, "uuid": "de02e802-c2df-4488-a7b9-63ec0c0a413b", "comment": "Malware payload (RedLineStealer)", "value": "85f80d0b0a27dc021b90746ae68fa202534dba28b53d415b1d390a12584c5ceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805861, "uuid": "9b677018-5aa1-47e4-8b67-758905a9869e", "comment": "Malware payload (RedLineStealer)", "value": "8532fe6c27a38faedd4c8e7ce25056fe5b11ba13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805861, "uuid": "a07bcd9b-ef52-43e5-aa57-33511106b080", "comment": "Malware payload (RedLineStealer)", "value": "012dd6b35d49ee0839714bdd2c77359b8c4046c1db748917b6ea1885cc42b3845bbb3332dbc38a21c50c9ab2fbe6c10c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805861, "uuid": "20d446e3-5ba3-4928-84fe-0cf6793a3c21", "value": "T10F159BEBEDD2C29CE98E077687F3B7054BB554D60F7B03F89304A5E04A891791B02B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805861, "uuid": "99c34aaa-6e24-479b-af22-c42c2051d0b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805861, "uuid": "5e86a7aa-afbe-4aa0-9819-5bcc0efe72f6", "value": "12288:goFNt1IqrUpwUDRqL4SREAEsAj7yMpGeJGutCEufmcw:Pa8UDck+ET2MpGeMEjcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639805861, "uuid": "ec0bb4b0-d916-4836-b0e1-f743e1a5572e", "value": 939912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639805861, "uuid": "95c42f36-28d4-47e9-9749-978559749dc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805861, "uuid": "e3ded1f6-d0aa-4030-bbe0-4b65b2f92cc6", "value": "SecuriteInfo.com.Trojan.GenericKD.47672918.11349.596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbd916a-600b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639836381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836381, "uuid": "da95444d-4c6d-4efa-971e-943ecfbbdc8b", "comment": "Malware payload (RedLineStealer)", "value": "d961c824966a109599e6d786b66503e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836381, "uuid": "f4b9de0f-1ff3-4f51-a106-86eb1fbf15d7", "comment": "Malware payload (RedLineStealer)", "value": "862955ebdf7e3769adee92e56525e3d8a4994f526f9bd67a17ff5f5750e2881f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836381, "uuid": "785b9bcf-299c-464a-8dbf-d8202710297a", "comment": "Malware payload (RedLineStealer)", "value": "57793da40934599cdaa17ba9a8dad979e50da2f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836381, "uuid": "9fc156c8-20a0-4a47-86d4-49924ee34f19", "comment": "Malware payload (RedLineStealer)", "value": "5cc1f1087e36648e8a3d59a349d5594759f49e85eed0a947db913e59a855cb77ea187ab86d463492c948f6c810ab4d78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836381, "uuid": "55899e7f-4f92-4431-89d3-3ef0a3d17fbf", "value": "T14394DF04BBA0D034F5B712F44DB6D3A8753FBAA26B2494CF62D526DA4A346E4DC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836381, "uuid": "326bebae-a1fb-4aec-a3b2-487669345412", "value": "cd2e8aca313b88a16bc7b305a3f26143", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836381, "uuid": "e2dc18b0-9a40-438a-9461-a1396680f2b8", "value": "6144:xe7JNLtZXhjwNjndQBvVDFcK5ykXWxpyk11EcQx06SnBz:oJNLFwhd4VDFrykXWxpyKEcQx07B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639836381, "uuid": "91eb12cc-0ebc-4969-888a-ebf64e73eb5a", "value": 419900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639836381, "uuid": "55d72f12-6dc3-457a-8875-9e5a416582f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836381, "uuid": "91c96aea-db14-485d-a15f-0e2c4c9a1011", "value": "d961c824966a109599e6d786b66503e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98213dc3-601c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639843646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843646, "uuid": "3fc99ae9-4c9f-4ac7-a566-f4fcd8b8b496", "comment": "Malware payload (Mirai)", "value": "81db63912994567481df44a40b870d82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843646, "uuid": "eb660ece-9aa8-4550-b518-3e6c54d77ca8", "comment": "Malware payload (Mirai)", "value": "8662b90fd3e1081fd8d9563e8ee4f857b829dea8914da751b7f4c942cf52fd27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843646, "uuid": "b6574cad-013a-4cfc-81b0-cffc2b949551", "comment": "Malware payload (Mirai)", "value": "c384be98f53234343490e0c6c75837906eaa840c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843646, "uuid": "5123f111-8eec-4ba3-848e-1a60338b181c", "comment": "Malware payload (Mirai)", "value": "2c96c2ec7cebc2c94eed4550f7178a22bef214cabd30f2b7aa3e7f623edf85e6d860c31e3ed1ba342fbd793637787d8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843646, "uuid": "3f1ff930-e37e-4ad6-9dec-87c4c53efb4f", "value": "T14DD2D080F3B22E83CDFA5D601C89D391FBE71EDDC782CA52B1E8A365581313693458D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843646, "uuid": "76fb2196-a924-4568-a7f1-93ad20fe1eb7", "value": "768:zRbRgPIxSCkifRfKcrVoMgGAwadAeSUi4uVcqgw098:zPgPNQfK5LGAjWbUi4u+qgw098", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639843646, "uuid": "2920f99a-2633-40ab-b340-230b7e4ba4e4", "value": 30616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639843646, "uuid": "b70d4712-f8e8-4c7b-bb4d-7f6bed3c3813", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843646, "uuid": "aab12b49-744a-47ae-ad79-e1ccdd0e317a", "value": "81db63912994567481df44a40b870d82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a144b1f6-5fe1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639818321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818321, "uuid": "a314db97-c006-4029-8c11-4a16119442cc", "comment": "Malware payload (Mirai)", "value": "f3e3f0979376419e0caff6af760ba45e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818321, "uuid": "09d63826-1953-43c0-958f-05f74565abaf", "comment": "Malware payload (Mirai)", "value": "8799f6ae1c5b2da018efd8be173ccbf475a5314f36c780307b0785dffaea3638", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818321, "uuid": "5cb8dc6a-d303-421e-97ef-1133e0a9082d", "comment": "Malware payload (Mirai)", "value": "980846b7a3cc2ebb94be3ff231397cd0cbdcf175", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818321, "uuid": "5b8c20a4-38ed-4d74-ba0c-fb99b0045f6a", "comment": "Malware payload (Mirai)", "value": "30da00ec597459cdb99d0a3cacd626df5e1835bf7518d378f152d90a26ad0eecf634f02819fbfca70406b450cc25e27e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818321, "uuid": "6cc0ec8b-734b-4b6c-9ffd-e9f0dcd83f31", "value": "T142734A4371280A47D5920AB4253F5BE083FFF99034E4BA89685FEB5A8635E771086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818321, "uuid": "53fecfcd-decf-4466-a20d-c0f0f8302419", "value": "1536:9ldfVco/Crhj11ss+Fvd6Mey8PRJDSzpI/fk:zghKFvJm0pI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639818321, "uuid": "00b64380-a0e1-4fee-9c27-8be29d9f98a1", "value": 77064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639818321, "uuid": "2246fbea-7dca-4877-8b0d-9ccd747164f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818321, "uuid": "58019aae-ff4d-46cb-b645-3d08a0610b0c", "value": "f3e3f0979376419e0caff6af760ba45e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41788ff-5f97-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639786543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639786543, "uuid": "36c51dba-3b1f-4986-9e46-9d6a93f84ef7", "comment": "Malware payload (RedLineStealer)", "value": "9d5681db3e4b042251d315921ee6bfab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639786543, "uuid": "25c806b7-837e-4cfa-b967-b45d221260de", "comment": "Malware payload (RedLineStealer)", "value": "87d84be094444c1391a02061ab75beb5227c1f6e22c8a92502b124b9f50a2df2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639786543, "uuid": "6313f54b-0530-43f6-a6d1-11d4dc8e3108", "comment": "Malware payload (RedLineStealer)", "value": "ac05caf7905e60d970ff9c020179ef9f88fdc54a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639786543, "uuid": "da74f432-d080-4486-a45d-64e895923b26", "comment": "Malware payload (RedLineStealer)", "value": "02a6c49a5972f70d2b44c816488799d5a48d16b6738ba0ab54d48076899eada97f1f083c33e9ed48a60fecd355072cef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639786543, "uuid": "4b7a443a-9ff0-4290-87e6-d1f0c7b3b4e8", "value": "T1F055CE51F28A8140DD7ED337456D9A034963BC1AB930182EF1CCBBC97FB2B41AD6617A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639786543, "uuid": "636cf99f-16cf-401f-9a3e-92a67390c3d2", "value": "4e771436c9d06001ecd2d7620d7ea302", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639786543, "uuid": "b72d3ca7-23ee-482c-8d52-d85b68369bd2", "value": "24576:QkBRQKgLtaw1C/eI1e4ezppT/u2Ek5ZGyLl0LU:QkPQn5h1CWIbYfT/u2zQyx0LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639786543, "uuid": "046b8575-f58a-4a6d-a75b-47ec23e45c0e", "value": 1388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639786543, "uuid": "91853710-6e4e-46fb-a3db-3c6312b2b3b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639786543, "uuid": "cc5d4994-f4a1-4832-b679-4dd7985a9759", "value": "9d5681db3e4b042251d315921ee6bfab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9497fb-601a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639842607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842607, "uuid": "e3bfe2f9-5fb1-4b4a-a128-0467fc3f6f1e", "comment": "Malware payload (Mirai)", "value": "f3393ae53429543a5e7e506c4d0bd711", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842607, "uuid": "0ae1693b-9aab-4357-ad1e-38dfde135193", "comment": "Malware payload (Mirai)", "value": "886317c5015620cb373176d65895a56018f049f0aab1344f3ca4874ab9d0294f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842607, "uuid": "b388397c-583d-427d-8700-8875fa953ff3", "comment": "Malware payload (Mirai)", "value": "46ecdd824e87bb4a0827c80a7bec724e71ba6419", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842607, "uuid": "03e076b7-c4f4-4dd8-9595-fa062f1e785f", "comment": "Malware payload (Mirai)", "value": "0128c62e6db926a417da4a5c9280099aced2634360a6fa8618171ec5133f783393f9b93e5359ad36c031acde7f3307f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842607, "uuid": "af0a64c4-0852-49f6-9895-505ddd8175c4", "value": "T159C2D1B17500BCF4C3B46474E97F561277CE1E39E8D821633921C6F1A9CA512E6BED41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842607, "uuid": "04cc49ff-f8f7-4e51-81f3-f2455f5616cc", "value": "384:QJt5CRkqF0JRhYOU26CUkU/E7rQwOzIMtuFVPrpLMifPF3B0Z1IhXrayDhI/7Hb2:QakRRAfh/EwwJiu/pLhB6yDW7fl3U4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639842607, "uuid": "41b7b0b2-d61c-4928-92f9-2763ff4e44a6", "value": 26180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639842607, "uuid": "6730af38-5fa8-46c5-9375-b9b8c2ef80a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842607, "uuid": "ce46477e-618d-4eab-a6bc-e28460ca9c95", "value": "Fourloko.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf3138d-5fbe-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639803121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803121, "uuid": "999c993e-a226-4c98-8e3d-b99a77c0ece9", "comment": "Malware payload (AgentTesla)", "value": "bb959e86db349b2eff660bad28de368d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803121, "uuid": "5ec801a4-7b9c-48b6-8a99-2a6597226f12", "comment": "Malware payload (AgentTesla)", "value": "8a327800ffb60ec64017091fe873d8416fc8aa6c0a33c866b36394465e6ae25e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803121, "uuid": "148d0247-1ea1-4a28-b72f-010aa611084d", "comment": "Malware payload (AgentTesla)", "value": "6615f9f4c2e19e588150ccba4f2b2d4296cabf47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803121, "uuid": "710f77b5-49b8-489f-86cd-f28cdf4800ff", "comment": "Malware payload (AgentTesla)", "value": "489803016ebdf5bad1f0a394de974aef37f202e10ced0e6066c215b8a79c171710f90c13e7bb7bbc4cdca2c0625e9302", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639803121, "uuid": "f21c9d36-97e8-4e4f-845e-7406f82719e0", "value": "T1AB35089D315171CEF877C876DA542D60EAD178FBC70B8247E067259A9A1E883EF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639803121, "uuid": "cc7c940a-f4ab-4825-b034-f99acd0421cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639803121, "uuid": "09683b86-f21d-4eb5-99bc-7307b3f72cfa", "value": "12288:k5eoq9uuAJ+11GhavLux9s+/lT9Rn4yui7O1a+OnuIM7lQzkJBY9rteh/ttlbOi3:k5eoy84kUvLvWR9dgiqrOzMXY/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639803121, "uuid": "93180646-8a1f-4830-ba8a-bea3ccfcae26", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639803121, "uuid": "37e86972-8c26-47b2-a2c8-28d6ef000b09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639803121, "uuid": "271d27d3-6602-46e5-b0c3-9b31cbb148d2", "value": "NEW PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b953f4-6055-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639868067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868067, "uuid": "0d6ffac3-2d10-4581-9f91-054e473c0f01", "comment": "Malware payload (Mirai)", "value": "be55ccdc4062c9799297a341b5e50b00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868067, "uuid": "b25ea383-d7f3-43d5-b481-9bb44065226f", "comment": "Malware payload (Mirai)", "value": "8b1f608dacf5c39f0556217e9293b4be191d6c582fa790b079df1cf0c7c7b88a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868067, "uuid": "e93de4fd-58b8-4510-85f6-822503f6aeff", "comment": "Malware payload (Mirai)", "value": "2c89c2a688dcfe80a8cbce8cdc1f45d48e7805c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868067, "uuid": "e6a27e0f-3829-4659-aaa0-37ddf4ddd53f", "comment": "Malware payload (Mirai)", "value": "b0376ba0d4d9356acf9787d4baf525316bcaeac9f00b7de4950fbc10ca1a7ec7d52eb1302f01ac290221088e63c82608", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639868067, "uuid": "ff76ef16-e769-4086-9cba-b5691f2050fd", "value": "T1DA6319827C80AA26C7D01777FA5F108E3314A7D8E1DA73478C152F9576DA81F0D6BB8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639868067, "uuid": "4b543042-6ebe-45d3-bf7a-3eff5651c79c", "value": "1536:VdsFWLasvi3gh5hnjvmJpzi0BA2tdENuJeZWjTjHJnV4M:7sFWLab8NKwuTj3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639868067, "uuid": "bb5cc903-836a-4580-ad8f-ce667a46e545", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639868067, "uuid": "881e0d9f-8f3f-449d-8fbb-632e8388ce14", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639868067, "uuid": "3721665d-a973-4633-a11d-85d03b5b88f6", "value": "be55ccdc4062c9799297a341b5e50b00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf3a91a-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639844188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844188, "uuid": "b65f6c95-6782-4843-b007-0f084a97abf4", "comment": "Malware payload (RedLineStealer)", "value": "b04832cc9e5c90f31821325c5f8a0ee5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844188, "uuid": "eebf9d9f-ee19-4ac3-83cd-8973136b35d3", "comment": "Malware payload (RedLineStealer)", "value": "8b9e0f5fe004e455146bc5f0ef6ae8e2d9645c9e5090a4cf044fa2fbe53a0f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844188, "uuid": "32d933a8-ab34-479f-a82d-22451d5b523a", "comment": "Malware payload (RedLineStealer)", "value": "ffb7d9cc17da2c4662bf654b2f8f07b4958d48fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844188, "uuid": "f6ef2401-042a-43a9-b4e1-ac0e5b01d67c", "comment": "Malware payload (RedLineStealer)", "value": "0b362bbae5b4c5a98544e85438256c344336a7aafa8503a300980889d8c630d4b31597d62d17df27f9657d2c1cb0aef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844188, "uuid": "6dab925b-e228-4a47-a89c-28b05fc70bd1", "value": "T14D549D00A7A0D035F0BB56F849BAD3AD753F7AA15B3490CB62D216EA5774AE0EC70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844188, "uuid": "15aa6710-b252-4fca-b118-8337a16776e0", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844188, "uuid": "5de88e0f-70d1-4445-9d3f-50902d479ceb", "value": "6144:wE6OE8a233EriGtTcwKXalQZvV4dFBJlG5C:wGE833UriGtAwKXaWZsPJlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844188, "uuid": "de609837-69d4-4b33-aa5a-cf0b80769d03", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844188, "uuid": "eca2120f-8704-4602-8974-df3dabfd676f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844188, "uuid": "aaedec98-5b2b-4913-a83e-7e0d85699bc6", "value": "b04832cc9e5c90f31821325c5f8a0ee5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c24b28-5fd7-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639813838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813838, "uuid": "c3cf9797-cce3-4d24-bb02-cff6a7748e93", "comment": "Malware payload (RedLineStealer)", "value": "9ae4187300defe4e7cd1b537ea36ef89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813838, "uuid": "178729f0-7ca2-48bf-b99d-9c746eedfeba", "comment": "Malware payload (RedLineStealer)", "value": "8c349dc2517af821206e68f318247f069156277fa7c67c5f8b80b5679081c348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813838, "uuid": "23421171-5d26-4219-908b-714ba8ee5404", "comment": "Malware payload (RedLineStealer)", "value": "4f8c94a10e4acb9bc006addca235484cc5b8ec14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813838, "uuid": "898a6278-83ba-4801-bc89-3037739489b9", "comment": "Malware payload (RedLineStealer)", "value": "bac6d9316d6c53844f2a305da7734d13083fb60cdc8fba8e3aa19c401a491d8db6d1ca199fcd4d4c2446869ccc88e0b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813838, "uuid": "02ceb524-8496-4773-8505-07802974bf57", "value": "T1C1F3BF3135ECC872DAA316704874DBD55E7AF8222670414B3768166E2F72ECC4AF636E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813838, "uuid": "de6497b5-c5da-4d12-93ce-6b882c6bc1bd", "value": "254f2d7d316c651aeb3e2ff6fd4504f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813838, "uuid": "af4b1cd6-9b5a-49fc-9933-3c23506750b7", "value": "3072:aSyqRXLeQiH7wGImBwbJ1BgdfbyfYWrxpzbgqruUTKbB:TyqVLuHZIhxYuzbgwuU2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639813838, "uuid": "0ff218de-dffa-46a0-9068-e8ea5da1b9e0", "value": 157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639813838, "uuid": "5b97ccf4-5e7a-4a2d-83a3-4a9c69f1bb7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813838, "uuid": "4d9e3e86-1f33-47f3-b04b-e5246ad6ed4a", "value": "9ae4187300defe4e7cd1b537ea36ef89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde6c9e7-604c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639864326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864326, "uuid": "83cdb43d-06b1-4214-b05f-f77f38fd23bb", "comment": "Malware payload", "value": "f79f700bbda0c372a314a120d0aa0162", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864326, "uuid": "2aaa2c6d-1e14-4bc4-81a7-3d01f38a6c0e", "comment": "Malware payload", "value": "8dbc24fd01cd6b91243b698f9835521033bc463da259cf7bc857a497dc12c271", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864326, "uuid": "96e1cbaf-2329-426e-93d7-3669ef29c847", "comment": "Malware payload", "value": "8668af3fb0cd499936ab704f8d1935e76c8e5491", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864326, "uuid": "5f34a822-018f-42c6-b122-d4f1e900205b", "comment": "Malware payload", "value": "5bdf5d777d43100055988df00992d1ccc5c0ccf69462a5e1f5ff950117b87ee3f416ab0572bb42ded84903d2ceb6a2e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864326, "uuid": "e49f2acb-1a5a-43a7-b37b-b57a53476207", "value": "T15EF2E14384542071DAF22EBFC3EB558FEB221E3A06B977A4130CBA4869C71256C77DE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864326, "uuid": "3f763b7f-a959-4752-81b1-55787892afb6", "value": "768:7P0AUmsT9/5jnnR4Bp225ecye/cbgVwgUQ3Us:IPmsp/5LnED5ecy/bga76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639864326, "uuid": "fb18b757-575f-4e79-b53d-64fa6a827922", "value": 36672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639864326, "uuid": "caae52d2-0354-4504-9385-58c71c3e60cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864326, "uuid": "0b71e4de-d98d-4124-be79-6520cb6bce0a", "value": "f79f700bbda0c372a314a120d0aa0162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7b9332-5fd4-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639812654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639812654, "uuid": "aa5f2277-41d6-458a-b45a-e2ac75c58371", "comment": "Malware payload (NanoCore)", "value": "381e098d43de8f3c58316c752fed29c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639812654, "uuid": "9659e617-6032-4fb9-953e-843f47430a38", "comment": "Malware payload (NanoCore)", "value": "8e321551bda5b4769a6eb0d10a1faa63fa840a2f76037b0714d87c8752219bf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639812654, "uuid": "480ddd6a-d5d0-4e40-b201-6e249242f69b", "comment": "Malware payload (NanoCore)", "value": "604995176ed003d84dd14e5f85b12a85c19fc609", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639812654, "uuid": "1451299f-dbd4-48b2-a011-9973d574dc39", "comment": "Malware payload (NanoCore)", "value": "18d92e6e36c93d8d949af4ce629eec1271d2f7e82b074cd8e37f80a6ae3266c635e57a5a7528b7e5a9a6833c7c451f3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639812654, "uuid": "9f9aa0c5-e15c-4ee8-9bb0-6542532d6c6e", "value": "T19FE48CC3F440348DF8DE827BB5D98E66E2D11D4A1D43590152713F94BFEEA8297C0AAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639812654, "uuid": "a75a4444-4125-49ff-978f-8e031664cb4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639812654, "uuid": "b403cea7-b8ed-4f41-b6b0-96ce6ec154a3", "value": "12288:7r0607qjVv2dNfb6b0xK/lcoZtLlefuSK3pkkyyy1j+QpC:rkqjJ2fRylNZlSK3pkf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639812654, "uuid": "fab11d15-ccfe-442e-8dea-3e1f794123a5", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639812654, "uuid": "05fe5b61-4629-4ec6-b905-f4b2422997bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639812654, "uuid": "153933b9-b187-437f-9c84-a754c393b6bc", "value": "Commercial invoice and Packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c5e5e5-6054-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639867620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867620, "uuid": "60df71fe-a480-4b4d-b71b-812b87feb273", "comment": "Malware payload (Mirai)", "value": "f63d243f22c3d2ad34776c68f73a4e13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867620, "uuid": "0c04d7f2-a322-4d36-952d-21f9034fc32d", "comment": "Malware payload (Mirai)", "value": "8e7de3fcb5671aae0c032e5d36e2a5e00229f4e0d14739943a179155fa20f8b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867620, "uuid": "d2e7fb2f-5730-4caf-850b-6349253f0ca8", "comment": "Malware payload (Mirai)", "value": "bc4c72dd7ee86a5bfdc065e9fcece1eabeef2364", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867620, "uuid": "36952e4a-e669-461d-b198-caa9481d6fac", "comment": "Malware payload (Mirai)", "value": "cb90cbcaeda3f2456ee5ef4dd558c53d408b640d54163ce273374569c257c305ddc9a71bf4b70089f249c68d3249aeca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867620, "uuid": "9c8d2052-7b89-4f28-95b8-131de0535546", "value": "T12D53AFB7C4A89D98DE255578F21088399723E008A5A73DF6EA46C656D05BEECF00C7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867620, "uuid": "1bed4c31-259e-4d5b-9aee-bf66ba818cfd", "value": "1536:I/xN6GOJeaUV7Y3bQIf2sOqgqX4sUEfs3C+/sMDr3d3C0Kqi:IJNsYjY3bQIgqgqXlf+/Lrt3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639867620, "uuid": "421cd453-c0ac-4b20-9e06-764082e20100", "value": 64344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639867620, "uuid": "6c4ae460-da62-40f1-ad5a-ddda0b040fdc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867620, "uuid": "a239b656-cd12-4945-95c8-a3cea30b1dd2", "value": "f63d243f22c3d2ad34776c68f73a4e13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7210c58-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639844182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844182, "uuid": "4ad6105f-80f5-4727-86df-868e061afa2f", "comment": "Malware payload (RedLineStealer)", "value": "6887fbc4db243e1fe5509d8e59d6f6d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844182, "uuid": "235db2a3-d51a-42b1-acbe-b3b94acbaf3c", "comment": "Malware payload (RedLineStealer)", "value": "8ef37ea30b02c84914a88d1516e1d595de99fbc4e38a2bc0fd1fee766e9a178b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844182, "uuid": "e1cd7863-8846-4993-bf2a-3f2266832bc7", "comment": "Malware payload (RedLineStealer)", "value": "a20613b1a8c0676f8d5d5984c829465c3c421c9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844182, "uuid": "869822af-6c83-4dd9-822c-8f5a73e0810b", "comment": "Malware payload (RedLineStealer)", "value": "0963899591346a956be25f1ed976fc2e88a2c43ef5fd7c81935a149b2ea3627e56d443686a4c349286dd23ab625e61b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844182, "uuid": "7ee21f8d-4ed5-4de2-8b76-a7546921be6d", "value": "T151549E00A7A0D035F4B712F88DB9D3BC763E79A1AB7490CB62D516EA5A74AE0DC70347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844182, "uuid": "92a32b19-8cf6-45df-a3e3-d0c45b888959", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844182, "uuid": "d80400a1-aebe-4e7c-b7a0-c503eb3d10ff", "value": "6144:RNG5hSaVe+NgLTF7uLa4jZv1PDWB2Vgrfh:1ag+NoJ7uLayZti2Vgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844182, "uuid": "6536a66f-532e-45bd-bd49-36d4c80abe34", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844182, "uuid": "2fcf3ec3-8057-4d8a-8ab2-3ccc3b0f0eab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844182, "uuid": "0827e549-0837-42a4-a621-24469547cbb2", "value": "6887fbc4db243e1fe5509d8e59d6f6d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce05f07-6053-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639867089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867089, "uuid": "5515199b-0713-4c86-b34c-9127a9821dc6", "comment": "Malware payload (Gafgyt)", "value": "322bf03dba483d279a87eede253cc5a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867089, "uuid": "1aed3548-ede4-4ada-80b3-6ec50e46a1f0", "comment": "Malware payload (Gafgyt)", "value": "8efd4002b8608008b6ed538548c98cf82114d7974dc37e1b07f23d31acc7ba5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867089, "uuid": "c918be70-25a7-44c2-8901-35007aa795a0", "comment": "Malware payload (Gafgyt)", "value": "51ab080f249023f8c9b1c3cc1a9618df74d7a88e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867089, "uuid": "5444136f-75db-46e8-be3b-8b67175631e8", "comment": "Malware payload (Gafgyt)", "value": "5239ecb1431e240be975b26ee2b0a74947a9dfb1dc2da615af04c782f268c26400957b602a9d1b31b5eed3f5f6c98ad9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867089, "uuid": "0e24bed1-34c4-489d-9ca6-d3c9442616d9", "value": "T190C3E630E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867089, "uuid": "883ffae3-5d70-4f3b-ae94-87bdfc93926b", "value": "3072:4jDy/+mh1vtbPIKaIbEcUPium7/L7QsvmGugiNb:mOJ1vxfaIblYm7/L7QsvmGugiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639867089, "uuid": "625340ff-5676-4cc2-bc56-bc821fb4bcf8", "value": 125009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639867089, "uuid": "d4b9df16-9b61-43e9-917a-2fa77598960a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867089, "uuid": "bcdb7a5c-0f16-40ed-9f04-6807cca6405b", "value": "322bf03dba483d279a87eede253cc5a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1ecb66-5fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639803604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803604, "uuid": "904aee2f-ebc2-4b8a-bdf1-d6081a16d639", "comment": "Malware payload (Mirai)", "value": "83872bf3b63bf0c00f4dd46fc18b2b4d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803604, "uuid": "20b8783b-d545-431d-8306-c42888446034", "comment": "Malware payload (Mirai)", "value": "8f60a211200b585faf1d296dace646a4bdfa919f5a24e0706fc4f41756ef1ceb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803604, "uuid": "b4c4fc3f-0909-4d69-9adb-43a26b77f252", "comment": "Malware payload (Mirai)", "value": "8c1739202e9a0c9551e81c0283a5c1a3d663214c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803604, "uuid": "b30b20e3-d62b-4810-b49a-dd2abdc2a084", "comment": "Malware payload (Mirai)", "value": "db703e355a8b727dc86d7096006026c2d4c259ead47268f1003a2e36d4729f6db2a2751d51814196b2dcf71fae6fd631", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639803604, "uuid": "8cf426e0-21c1-479c-a45c-b5ea8fb9c51b", "value": "T162B32A56E7408F53C4D22779BBDB42523323DB5497AB23065928BFF43F827AA4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639803604, "uuid": "30bf34d6-868a-41a1-867d-9ff755bf389d", "value": "3072:g46aFiBXTliwSdXEcT4ZgM/9RBKmewlMRuy:X6aFiBDli0cT4CM/96mewl6uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639803604, "uuid": "1028819b-6221-4ffe-896f-3de6b69d6b1c", "value": 110567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639803604, "uuid": "d9f3d24f-fd0c-4c2f-b5bc-a5ab232ce980", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639803604, "uuid": "60636c0a-9ddf-4771-9e4c-1a5a9b1a41f1", "value": "beamer.arm7-20211218-0500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cddaf4-5ff3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639825785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825785, "uuid": "ddc2004d-c95f-446b-a175-18cef8d23d93", "comment": "Malware payload (AgentTesla)", "value": "1c8364e2d75df23d8fe494b0fabe439b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825785, "uuid": "6a7f9b71-9b9d-4f67-82c3-7ee2765f9186", "comment": "Malware payload (AgentTesla)", "value": "8fe3841744865f7960e18c8052edbd6f7af33ec54587e298110e3ed8a1e5d737", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825785, "uuid": "78514c5d-3e35-479a-9375-6f96ce9bf3b6", "comment": "Malware payload (AgentTesla)", "value": "53230fb531cfbf8b2f2d3e06e0e4295fa375ee1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825785, "uuid": "b77528d0-d2fc-4431-bd0f-92041b1c4d19", "comment": "Malware payload (AgentTesla)", "value": "6b3a8bf4f92b77e6416d7b118b8cc0866bd458f272e90d9d857db1cd35705488c6db05655caaf56af0b8cbdf54a82a6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825785, "uuid": "de930159-ea34-435d-84d1-8b7df8a92abd", "value": "T167B412D426F4DB0FC4750BFA24B891E087757353621BCF0F0D9A61EBC9666851E20BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825785, "uuid": "389dcf8b-ca14-42a7-b1d9-d24b126fbabc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825785, "uuid": "86ed190d-c940-434e-9289-b453892083fe", "value": "12288:EHf+AOFAz3IEoUwF6b+zUj60ekeNnOANHuSK3vkmyyy1pWyUtGG:EHfPOyLIEov6025lesAESK3vkdaGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639825785, "uuid": "00d76cc4-64bd-4a09-9689-97e0673ac498", "value": 524800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639825785, "uuid": "1006d261-bb0e-42f6-9876-aa4e6dc7ee2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825785, "uuid": "871d4c4c-078d-4b68-8442-f7cc901f8c67", "value": "1c8364e2d75df23d8fe494b0fabe439b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cd70ad-6047-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639862213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639862213, "uuid": "862eca7f-13f3-4f1f-9a10-c2acec55b85e", "comment": "Malware payload (Loki)", "value": "721abd5a0539b16a4ddc04c2b611fae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639862213, "uuid": "05b789af-d4bb-4c7e-86e4-3c89fe7c8849", "comment": "Malware payload (Loki)", "value": "90d38f0f000d15da5d1cf69bad6f6b4a55ccdf777439d07c7ec6d6f76c4efdc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639862213, "uuid": "68c5e6e5-5ddd-465d-91a7-5e251c6d5266", "comment": "Malware payload (Loki)", "value": "61b2346510b969ec04e19db738471bf940214b74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639862213, "uuid": "4c28dbe6-7fbb-4bf5-8a54-56c8cfbf8a44", "comment": "Malware payload (Loki)", "value": "5ea8fb62b1a09dc3a231d6b621c6781c5f5eeeca57b1382d795b33d90c4a26735e0424c367869fabc2a25d0119366e7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639862213, "uuid": "633f78f8-bd78-4799-9806-58b15535f2e5", "value": "T105D49C5873704B14C8315E30E0554E0EAE567F2C2CBEB53EB6ADF655E27FA8208A9DC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639862213, "uuid": "5d790113-3d7c-4628-a0ec-3d731998cd19", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639862213, "uuid": "97e1bf16-51c2-493b-8a91-43ca5aecf2f0", "value": "12288:lnZ0PoiiOba28iCiPTpoM6vylGonqDZ0eS8c1tdG7WpgRwEWq:H0PodmjP0vylnGZ0eSDPUWuOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639862213, "uuid": "f19ab85e-1104-4d1c-a735-ba16d8517169", "value": 651825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639862213, "uuid": "dabe7c6a-2114-4d5f-9ac3-9a13e6d705de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639862213, "uuid": "56d96a51-ec50-497c-a59d-a51ee4d3c5ea", "value": "721abd5a0539b16a4ddc04c2b611fae2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad636d3-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639844054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844054, "uuid": "f8a55b06-98d9-4828-8077-a73b50884298", "comment": "Malware payload (Gafgyt)", "value": "a5b8cb6bf65241103559a97bedfa0436", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844054, "uuid": "e8a208d5-8357-431a-ba2c-44c431b6c9ab", "comment": "Malware payload (Gafgyt)", "value": "92770a7a647fa1492db6fab0316fe108b5141fcc4783e8d79f28de98ad1b6a19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844054, "uuid": "522ecbe4-b3ff-430e-9f5f-8e475a80562d", "comment": "Malware payload (Gafgyt)", "value": "0c0295c71c076e106e329b0bd8669d023483d8cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844054, "uuid": "e65c441b-ed1e-4b6f-a42a-8b98628a897c", "comment": "Malware payload (Gafgyt)", "value": "ccc30010e2537c3d1339bd45301d5796c9960c69e5bf6ce7c8dbb59825bd73d6f52f59cc653421b4c9f8565bd7b540a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844054, "uuid": "8020f22a-69c4-4cb4-9c67-0ba1cd19d907", "value": "T17D03F1EA9FB15751C66700B20C1D75CAAE04E24DA0F4E2AB7F9C387197B3F509BB4186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844054, "uuid": "4d6cb46d-4264-4460-9149-35b10b09c98b", "value": "768:bEXwfWkaNxQJc3TZOXh1fVgufvBnER6GhnbcuyD7UP/2d:q2W1NxQWj4Xh1fjZcphnouy8md", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844054, "uuid": "132057da-c29d-47f9-8b15-d32248899a93", "value": 38080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844054, "uuid": "cabfbd6d-77ca-493f-bfa6-735191377ef9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844054, "uuid": "40f9af5a-c781-4a77-8b7e-cfa397a6a3ca", "value": "a5b8cb6bf65241103559a97bedfa0436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a271d9a-6033-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639853501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639853501, "uuid": "da71191b-b459-4265-b707-e49b860356f0", "comment": "Malware payload (RedLineStealer)", "value": "987b6ce1f0cb9247342acdab47618d42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639853501, "uuid": "ec56bb1b-35c7-4e97-9f3d-d6e119e9f158", "comment": "Malware payload (RedLineStealer)", "value": "939de6a604c3c3177cdae5d66203be9c9ea88a9c084c8c6106556091e78891b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639853501, "uuid": "53390742-7359-4f7f-96a4-37ffba4c9306", "comment": "Malware payload (RedLineStealer)", "value": "4ab9fe0f9c6c602106909dde005405503b42a8d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639853501, "uuid": "7be6fd41-98e0-47ca-baaf-32fd83db27d1", "comment": "Malware payload (RedLineStealer)", "value": "56093b13fc7cbdd480bf86549cfc9df12992ec44faf271667030bdd7af6c6f8b2e95daccfa241d752642639697177443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639853501, "uuid": "5022b20f-f225-4d10-b8c6-17549ff35e64", "value": "T1D884D000B7E0D034F1B752F44DB6D3AC7A3E79A26B24A4CB22D516EA5A746E0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639853501, "uuid": "202d4311-f234-4e5b-9aba-876816ab1022", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639853501, "uuid": "6bec474a-b85e-423a-96f4-957acd4c4498", "value": "6144:KzshTve85lg2KTzLkvdq0nTUZKz9tyR4kS3K9RKElse+zTMwnqXOjhiEjrFPxoxB:P56uq0nAutyR0K9RK0se+X9PjrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639853501, "uuid": "e11f0d15-cf0d-4169-96d0-355337a96355", "value": 406584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639853501, "uuid": "2d1e8a9e-ad6b-448e-90d8-417c5193f664", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639853501, "uuid": "10031966-03bd-4a92-b74e-84e9920c479d", "value": "987b6ce1f0cb9247342acdab47618d42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9d4258-601a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639842770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842770, "uuid": "5ae03809-1f10-41d7-9faf-fc79d7d31b9c", "comment": "Malware payload (Mirai)", "value": "6117546aabbec1dd706aefb8a05c55d3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842770, "uuid": "6fcc7863-7292-4eb2-a27e-c8f14bd686b1", "comment": "Malware payload (Mirai)", "value": "93bc491381b85e4fa5cda2d3c701fc7b7e886d06dc1946ca80d3baf675449a23", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842770, "uuid": "bbbfe387-1439-404a-8492-54b250d3dd18", "comment": "Malware payload (Mirai)", "value": "adc23b223c2925b1a0a3f9f4feb3d1e7bb1137c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842770, "uuid": "3f1346aa-e3a1-4073-8938-08eb30bd8b58", "comment": "Malware payload (Mirai)", "value": "6e542691dc690ccad8da50b9556353b5f4a80fca1b37fa4ccdef6c78f3c43f025bbba09927558f2c0c6688a8319e18bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842770, "uuid": "5a284c88-f2f4-4c8a-9644-39fe2f9b3132", "value": "T10AF2E19CB4C64ED8CB5F4EBAA08E13E1998171C2306D839C970599EAADB5C06FD474B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842770, "uuid": "0a6cfc39-728e-4b89-a808-dbd300d230c6", "value": "768:3ymvIE+AtjjP8hXlChCD1OvWzc9tjXgJvkSMi1qFWvIpBOWMWY:pvR+AmhXlChGAvgKtSZqovIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639842770, "uuid": "39000703-119a-4a54-9eac-733f64bf3fed", "value": 36336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639842770, "uuid": "2f9a7a15-c5d6-44e2-9beb-b7d45b977f6b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842770, "uuid": "d7b496ac-cbfc-4989-90b1-9a15d7de5b90", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d494731b-5f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639789202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789202, "uuid": "350e38e1-3b8e-41a6-86e9-b8cc7462e057", "comment": "Malware payload (RedLineStealer)", "value": "0d0768e7d06d71760554dcaa521d04ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789202, "uuid": "4dcdda84-e9b4-4665-bac0-b95776ec090b", "comment": "Malware payload (RedLineStealer)", "value": "93debd2f5562df361e0df486f3aa3b23ea5fa6e2ed9865a00fa8c2c8ecd758f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789202, "uuid": "f3353a19-7395-473b-9a18-ff2c3e908461", "comment": "Malware payload (RedLineStealer)", "value": "83dbb7f3abd93dc3953573f70b95084b1cf8a166", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789202, "uuid": "a09d1074-9b97-47be-a804-2e573448b56c", "comment": "Malware payload (RedLineStealer)", "value": "87ff4123c64c2ea8ea701d514d53e0922d371d5599f470c83120c2aaef3ef6008edc92c2cee969f019c21eb50f877920", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789202, "uuid": "333b2e31-0c32-449c-8d6c-9007d0865467", "value": "T11754F13175ACC532CA931B714C708A91AE3FB86161A0968B6B69172F5E70FCC57F231E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789202, "uuid": "c76c9549-da42-4e7c-862a-69cbc02b4b39", "value": "44c00401a20ce3d35e55418765dd0985", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789202, "uuid": "f45bdfd9-58a8-4408-9059-f907659bfd50", "value": "6144:lULxcLcFDtK9TnLeEmLs3zHYXq/TenV7NxPek/U3uzbgwuYpB:lUyLcFDtKRnLePLszY6/TenbxPek0unb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639789202, "uuid": "078a4f02-8a8d-4776-a6fa-831e4169da6e", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639789202, "uuid": "cc322e85-e349-4f38-9e04-4c52e767f463", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789202, "uuid": "5d96d15c-f4da-41b2-9535-d2499ff32548", "value": "0d0768e7d06d71760554dcaa521d04ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881e2b8b-601a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639842761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842761, "uuid": "607fd8b0-7004-4d15-a561-59a18bdfbec1", "comment": "Malware payload (Mirai)", "value": "4aef1930925b6ee0ab5b54c78bd5b6c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842761, "uuid": "9d7af613-90a1-40ae-b1a6-2e0366f9eeeb", "comment": "Malware payload (Mirai)", "value": "9433fa83c6fa1e5328f9a858b64592563752092a45ee991c633ab5d4f1dee56c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842761, "uuid": "7bb29efc-04d0-4c49-a66e-5fd33877290c", "comment": "Malware payload (Mirai)", "value": "74639c768de2b0717f7d3f73d3cc03377f70855c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842761, "uuid": "073905bb-cae5-42f2-a1af-a55fbfd88475", "comment": "Malware payload (Mirai)", "value": "bbc051ab1dbf729fe17a6edfadbefbe4a65ea4eeb6ee5df3f6001046f8155388d4b1c0e1dd2ee0e08328b4ddaaa4b8a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842761, "uuid": "aa285e2e-2d0a-4cab-a196-2dcb259a5577", "value": "T18EE2F13341E1CF54F3D25032DAAE81E4305595FCE8EAB9BB1A448E66AEC620357B45E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842761, "uuid": "f501c75f-0ab5-4d37-946d-7ad1c65e1a40", "value": "768:1MTEg4yQxJfBvMNz9cMVQQqW9+tnAzbDbu2am1cR3UJ:q4g4RxvvMB9ht9+52Jam1c6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639842761, "uuid": "fd4ae129-4b52-424b-9cb0-32aef033edf4", "value": 33484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639842761, "uuid": "cd900e77-e6f1-4d8b-9108-bad227e279a1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842761, "uuid": "b187afee-2025-44e1-a122-69d4422af58c", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2022019e-600d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639837003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837003, "uuid": "9d24557a-3d59-4d28-aecf-3daf30adbf46", "comment": "Malware payload (RedLineStealer)", "value": "75ab883908cc478bd67b58b131cb94b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837003, "uuid": "4e304027-7202-4a95-86d4-cb0b492b52f7", "comment": "Malware payload (RedLineStealer)", "value": "9781f191e701b2d67b8b886058942828f5de8c42f46e95c62644e35c5d64b93c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837003, "uuid": "e3844f8f-b29f-40c6-9952-ac564734b10e", "comment": "Malware payload (RedLineStealer)", "value": "88f8745a686541b05f40c15d86101dcafdd54690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837003, "uuid": "4c7e5207-4db7-4139-83b3-d8c8f93826aa", "comment": "Malware payload (RedLineStealer)", "value": "aeba21539d8dfb5d72807e3dd24cf7b749f20695a618fe891ecee56e16c671351fe0583c34f6a21d8e6e138ac1f6e72b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837003, "uuid": "cbb9bc15-04ea-4fc2-80d2-a560f2f8988f", "value": "T18F84D000BBE0D034F5B742F449B693A9A93E7EE15B2490CB22D427EA57346E1EC71397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837003, "uuid": "20da675d-9b6a-4073-80d6-3187e587ac8d", "value": "e00af8f1ad8949415054b06be51fa3d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837003, "uuid": "72632157-4f13-4d61-8eee-ba69349169b0", "value": "6144:g/Br34ad7Mhou5p034iK769u5iha3xt9iJlcpwK5zd7:wBpNMhrp039j9Qiha3xt9IcpwK5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639837003, "uuid": "c9c6d39f-3027-4c53-8ffa-25ece48fcc6a", "value": 406569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639837003, "uuid": "73464cc9-99ac-46f5-849e-b00815e9bf25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837003, "uuid": "5c70f0f1-aee8-4424-8feb-49c6f82b9d0a", "value": "75ab883908cc478bd67b58b131cb94b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7685347b-5fd6-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639813525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813525, "uuid": "4be9961f-60b4-4347-99f1-52cba3e17de4", "comment": "Malware payload (ArkeiStealer)", "value": "4d8e50e11cd3e066925c8c051e32d562", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813525, "uuid": "20f220d3-14c3-4e18-bde5-7cf4b22af7d5", "comment": "Malware payload (ArkeiStealer)", "value": "97846ca62ffbac16afd4ab5cd5abfbce405ccebe5e6a86ee2d6aed87660410ba", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813525, "uuid": "c68f473f-ce68-46d4-a889-814e14604c5e", "comment": "Malware payload (ArkeiStealer)", "value": "d95887cb12b9c4db4eb74b8d8096d9af3165bf78", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813525, "uuid": "677cbda8-6d9f-4698-b52a-bd349cdf3cfd", "comment": "Malware payload (ArkeiStealer)", "value": "2a8cf360886d719be05964372656f69dc700a64606447cb1eb224af3e1e65e58d68fac695ed5dfec7d73594b1b0ae363", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813525, "uuid": "1e6859e0-b8e4-4c46-b3b1-faa2ca86b5b9", "value": "T19464AE00ABE0D431F5B752F8497593ADB53EB9B26B25A0CB72D516EE0638AE4DC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813525, "uuid": "e064481c-2bb6-42f5-b7c5-f315bf651be9", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813525, "uuid": "75904f8f-36a8-4da5-b2a8-71327bbe3391", "value": "3072:6I00tZ7y3ZrVYKclF6QOo3HEcCCrV50F2MQ/eKsesdD9gbrzGqFEvDna:6JQKclFrOo3k8V50F2tXsesl9gvFMna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639813525, "uuid": "45463930-ee42-4df5-adc8-729e3f6a0e53", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639813525, "uuid": "8ee438da-74bc-4187-a58b-eafb6e00f8e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813525, "uuid": "0f050ec6-8aaf-4852-a705-abfd164ec074", "value": "4d8e50e11cd3e066925c8c051e32d562.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8324372c-5fe0-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1639817841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817841, "uuid": "dee34589-2424-4561-9046-decc85d57a9d", "comment": "Malware payload (Amadey)", "value": "5dc44bd5a27e2315fce2f9cc00d80ace", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817841, "uuid": "713bb00a-8c72-497e-88c6-d3205ef6a6d2", "comment": "Malware payload (Amadey)", "value": "986542cc04bf9f82189362ccb1e27d2b1a8466b430f521aba29e4cc86097dbc9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817841, "uuid": "ba9a38fb-b383-4007-bd39-8640df54a5bd", "comment": "Malware payload (Amadey)", "value": "4ba2f5e06e1844926bbed67844f3b31a68e4ff05", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817841, "uuid": "86d166cb-9c9c-46b4-9943-702ff681bf38", "comment": "Malware payload (Amadey)", "value": "1117e23ac3fd5a00479e9a45084cdb6aab6ecfa0df333559c58c4b3c54e1fe652b711171e68ce82b3b8dba27be42f78d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817841, "uuid": "de5e09ed-d0a7-4cb2-889b-d4f389ec9b9f", "value": "T113E3BE3139ECC472C9A34670446A9AD41A7FF9212670917B3768136E2F70EDC4AF635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817841, "uuid": "b7c6b2e5-f3db-4b67-a7a2-1fe2d1306c58", "value": "254f2d7d316c651aeb3e2ff6fd4504f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817841, "uuid": "4018da8a-6903-4eee-8727-c0f0bcc684c9", "value": "3072:aeYqRXLMQiH3jaUvMm1itflyfGWrxpzbgqruKDcW5h5bB:vYqVLsH3uvwiCGuzbgwuPwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817841, "uuid": "24e96eef-1b51-4b48-9629-b23152b912e5", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817841, "uuid": "c13991f8-d90e-42cd-b696-6bd23979f1f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817841, "uuid": "512bfbbc-9b1c-4016-bec5-1d2dec8cd32b", "value": "5dc44bd5a27e2315fce2f9cc00d80ace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a962b452-5fe1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639818335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818335, "uuid": "59a5a62e-5743-4c57-8015-e86f182519fe", "comment": "Malware payload", "value": "59e040f29d21977054f5bd3510c4250c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818335, "uuid": "f455507c-53db-4cfd-955c-b812832f8759", "comment": "Malware payload", "value": "98a293de8d3eb34cee5e3e8edc9f472323d13a997bdbd2806ac1fe483f5efd14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818335, "uuid": "959c4796-1942-43e2-af97-4cc4ca3cb48b", "comment": "Malware payload", "value": "817cd6391c3dd8eaa33969121eb186c29cda4d2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818335, "uuid": "b35c7e82-07b9-466c-a5e0-30d93c113256", "comment": "Malware payload", "value": "68a7f350038a66f838b75ef5d869f43813ead45f1f85eca45db4ca069c578984323f51f47a14de16a7e3a18ebf2714bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818335, "uuid": "6ffdc075-ccac-41d2-b95d-1e19b35abc86", "value": "T15A54236FB98C78DFE56F92708802D9C983F02761E422D99BA64B644157779E13C06B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818335, "uuid": "d98d2122-1871-4193-9b66-dedf8cd44fc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818335, "uuid": "9709c2fa-49e6-40fe-bafe-9330e6a0b258", "value": "6144:zYuMRSlWm6mOIWJbWH2ZbM7vRvqprmYr:zHMRSlWm6mO7Jb2vRSxmYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639818335, "uuid": "5e3905c4-071b-460a-8fec-9a11b4670dd5", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639818335, "uuid": "aa39713b-0e6e-4425-9f32-20006726e91c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818335, "uuid": "87099f6f-6e15-404c-8ff6-b73eec143307", "value": "59e040f29d21977054f5bd3510c4250c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753181fd-5fd6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639813523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813523, "uuid": "6937577a-77bf-4aa6-a3c2-9afe90f74006", "comment": "Malware payload (RedLineStealer)", "value": "398cf356d8b97fe690d49c8ca81bdf3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813523, "uuid": "9efa7fdf-b0e7-4bc7-af0a-5b47a6fad858", "comment": "Malware payload (RedLineStealer)", "value": "98ee1f2258c8cd317faa79ecf82078857f66bbbadef2b6a664cd6bca7c68195a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813523, "uuid": "212d3176-5d42-4e55-a9bf-beda7d8b1109", "comment": "Malware payload (RedLineStealer)", "value": "3dfe95a914cdd4b03c7ab1ffd3e635d46e6525cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813523, "uuid": "a81ff88b-af86-47ce-81ae-edf18b4f881d", "comment": "Malware payload (RedLineStealer)", "value": "2c25e36f791083a3847fea70190b179e5ee49b90648be3b00aacd54c854b69bc7a363295510ffdfa5802960a9c10a6ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813523, "uuid": "30ae3670-81bc-493c-8d71-ff943e214dea", "value": "T19A64AF2067A0D431F1B752F45976D3BC653E79A16B65A0CB22D416EE0738AE8ECB130F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813523, "uuid": "688fa17c-16e0-462c-9c26-05d7eee7488e", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813523, "uuid": "927070ad-710f-4db4-b288-0c0797e22664", "value": "6144:FTPprsYH7wSuSiwgcmTF1Vc+OGsWMWo5g3MnE:xmC7x8wgcWF1Vc+O6MWo5g8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639813523, "uuid": "5ffd1469-6d3c-44a5-a8b6-6391b6582cbd", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639813523, "uuid": "aad25f16-e9c0-4a48-8f09-d33ebebe02ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813523, "uuid": "d2c42400-965f-461c-9a65-07eb8249c137", "value": "398cf356d8b97fe690d49c8ca81bdf3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40800a3-5ffb-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639829627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829627, "uuid": "4d6f877c-6276-44c3-917d-233af39c23e5", "comment": "Malware payload (Gafgyt)", "value": "ebeb694d8b478dc84834763aee9ceadd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829627, "uuid": "80dcf085-b791-44ce-a07a-59b62fc34558", "comment": "Malware payload (Gafgyt)", "value": "98f3bae934a0035574a61a056a9e7f1c6e4294c0376741ee76ba5a9b6fa54c7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829627, "uuid": "377050e1-0476-4771-a8da-26758cb4fcbc", "comment": "Malware payload (Gafgyt)", "value": "6a4986c2584a68be994df40282e71a1dcd6aba76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829627, "uuid": "882b6ef2-efd7-4b61-9858-b46c8787aa2e", "comment": "Malware payload (Gafgyt)", "value": "ec2c8efc17cd924c09ba42e2411cdfa9c5831d504b2b3128ba6d4018054b5b3ed67b6e76cd677574fb617ff39d2f815f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829627, "uuid": "6e8879a7-3313-406a-9001-c90740b330be", "value": "T1D5833C42E643C6B3C88317B2069FDE564A31BABA0E2A9F46F31D7CF49B134C53512B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829627, "uuid": "9273cb35-4176-4428-853f-566189f9d483", "value": "1536:rA9wwfgXbmbYm5G9r7Qwxkr7xWouwKDZyvB5JmF+eVOz+sEcfUnk:r5wfgXbsg9fQwxeklFmJmEeVOz+XcfUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639829627, "uuid": "5467c690-8e62-4859-9dae-af1060d48c46", "value": 86015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639829627, "uuid": "4a84433b-7b2c-414c-95d5-621c5d79b924", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829627, "uuid": "b686629c-975b-4020-9f1e-6f830eb0696a", "value": "ebeb694d8b478dc84834763aee9ceadd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2d1f29-6029-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639849020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639849020, "uuid": "bbd07bee-f80c-4227-8666-285ad189b2ef", "comment": "Malware payload (RedLineStealer)", "value": "b82ac9242ac7f4b08b9a8f2b5a186994", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639849020, "uuid": "4dd0c9be-5eee-4957-a320-55fb3fb98314", "comment": "Malware payload (RedLineStealer)", "value": "99127e15abbe4b00cf7693d0a8d58773fc1e50d6da3d14d39b350f2ce9c26d7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639849020, "uuid": "439092e4-f7e0-40a6-bd66-35556dcef31a", "comment": "Malware payload (RedLineStealer)", "value": "76c9f895717c3a6e1f27973a619e7cd9317c0d35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639849020, "uuid": "67bc0096-3d39-4307-b44c-956e22525ee9", "comment": "Malware payload (RedLineStealer)", "value": "d4c3dbb678546470efed001ad97934a985c1f39941d668eb9928a451b3e6ab179ab083eaed5b5aea59e60e3eb35b64b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639849020, "uuid": "46e4e6b6-64fc-452d-8319-a9684898d52c", "value": "T1376633BD9664EC45CB71A4332D76E487FC822E3602CC6C0D6369BFFD5A536C8D812662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639849020, "uuid": "e2452611-b387-43bf-b71d-531728773797", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639849020, "uuid": "87c6034f-68e0-4a52-9a6a-be1b8a39223f", "value": "196608:J1pCZrl972PioltY6MIX3SSrXE7G+VX+expRqpqS49DH8:JHCZrluicJ2SrIG+VXDxOpqS4Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639849020, "uuid": "12d90929-76da-43af-9c75-97ae6c540ba8", "value": 7027056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639849020, "uuid": "f969c33b-b313-4382-94fa-72766e806aac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639849020, "uuid": "818ddb08-b445-426d-809b-d74c1bd75295", "value": "b82ac9242ac7f4b08b9a8f2b5a186994.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d2369b-600d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639837009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837009, "uuid": "4eef01a5-9d06-4363-8052-37da81cb9cc4", "comment": "Malware payload (RedLineStealer)", "value": "a6995d610d05f1befd4d55a11c8316a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837009, "uuid": "252f3ba3-55d4-474e-baa0-73c2d3f41e38", "comment": "Malware payload (RedLineStealer)", "value": "9a0f607996d23c505d63f1d79812e9cceff9175ef763055a6c67bdf599e5aa5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837009, "uuid": "2232b2ef-9c99-491d-a8d1-5828969255b3", "comment": "Malware payload (RedLineStealer)", "value": "af92a7717a7168c77623464b566c99eeba8aa7e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837009, "uuid": "9f53437e-9fe0-4793-8dc5-3d0aa216bdc3", "comment": "Malware payload (RedLineStealer)", "value": "b967c762148f454df4958b1a17c9148fa470e9abd9ff44c535e789528e54c17621674842901abe96e018c86d30677401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837009, "uuid": "5652c3b3-cacf-4b52-b82b-b9b34ce420c8", "value": "T1D594DF006BE0C034F1B752F449BAD3A9752E7AF26B34A5CB53D126EA56356E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837009, "uuid": "844061db-0009-406e-b520-8a9bc79a6fb6", "value": "4ee83624426d72301d5dc28b390adabc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837009, "uuid": "c713c955-45eb-4d01-bb5d-ed0db9abb9da", "value": "12288:QOHOqFFCzvGUHZ1olS7wAxlSoEYInaHqL:nFHW/4SioEYfKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639837009, "uuid": "0f4ce39c-15c5-42f5-b3b8-453425c5fcb2", "value": 420954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639837009, "uuid": "1d6b6818-6234-40b9-9749-a27a909039fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837009, "uuid": "7ed809be-5fb0-47b1-9886-99325c5ac6fe", "value": "a6995d610d05f1befd4d55a11c8316a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a63503-5fe1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639818305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818305, "uuid": "90513c58-37a6-40ba-b122-54ac72647037", "comment": "Malware payload (RedLineStealer)", "value": "f0f44b21351864ec8386d001cda68b85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818305, "uuid": "bcd13f78-46ba-494a-a00d-ec28c2a5a5a2", "comment": "Malware payload (RedLineStealer)", "value": "9ae164f0b4984b78928811ea2e6bf7d49dcbdba1fea2f17c0a017df925503173", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818305, "uuid": "2f5a6790-6c94-4622-89b3-5f62a3f97a51", "comment": "Malware payload (RedLineStealer)", "value": "fad6905cf34127c4578935bcb644db9c245976d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818305, "uuid": "89480b54-8432-4770-a06f-68657918fd5b", "comment": "Malware payload (RedLineStealer)", "value": "6da9ffd99fa414a48d1ba7a077645e1508512950d2dba45882eebc3925ec1fcaef36584a17553a4154f1755d4dbf6f73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818305, "uuid": "8a868737-285d-4407-8328-3256eb08f7f6", "value": "T1C4B34C6473DC9904E6BE4F75B8B111A943F0F4532412EB4F1EC564FD1EA2B80BA21AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818305, "uuid": "f1ec3d86-9308-44aa-8704-09bd1e5658bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818305, "uuid": "2ad0c908-2044-430a-ae88-82c32da5a8e1", "value": "1536:iHWRG0AlEGHDomaIdQ2yAKV3OOS3blz063+102bZDKe/0jgWbx4J96006+R:iHWRLAhHDomZdQ2yb+Fz031X5qPsIw+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639818305, "uuid": "9c91249d-4922-4c23-8007-94d54964faf4", "value": 108768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639818305, "uuid": "ff78c910-88e8-4aa9-aee1-81e37d1765d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818305, "uuid": "386fc4f7-02ee-4052-a16d-dcac4e36804b", "value": "f0f44b21351864ec8386d001cda68b85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7341b371-5f9c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639788609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788609, "uuid": "2ed7138f-4859-44df-b1e1-166dad1b8fb5", "comment": "Malware payload", "value": "85ce4e5afd442f039c72fd4ff23b61f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788609, "uuid": "6888bf7a-5e3f-49e5-9391-92cef1125662", "comment": "Malware payload", "value": "9b7b438ff9bce7ece781581101ec41f4b73628d89d09a4f083e9c91a11aba43a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788609, "uuid": "7ab5c5f5-7d8a-47ce-abff-522ca17c3e82", "comment": "Malware payload", "value": "35d7fcdfe42a64a4cce1b5cc19f7e2cb7c44014c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788609, "uuid": "c7ee0b0c-2ab5-4d4e-ba3b-86634f40794e", "comment": "Malware payload", "value": "1411d88ae63ef5c812d25314e0dc6d717c7fbe614da059e5f8847f6b588739511b78e479d28dc13e8343cafc247c2b22", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639788609, "uuid": "91a246f2-faea-459f-9cb2-6285b4b911d3", "value": "T196F2D0739198A1B2DA541831A0EA06C7337D1EFCF4D3621507CC976CB66A067AAFF50B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639788609, "uuid": "44e14246-6994-4347-b083-369f2f09bb06", "value": "768:inhWYMpSp93FZKG0E0hdyS2SNXcp9+5fh/JXWU6CW3Ug:inhWYMopoG0E0h92S6p9+dh/JXWUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639788609, "uuid": "4aa3ba37-09a8-4140-8e52-bc82d57bcc0b", "value": 36940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639788609, "uuid": "d28605e6-e3e2-417a-9cac-3ee793b22420", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639788609, "uuid": "4633cb4e-212b-47e2-bb3c-257d81b14555", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861f6957-601a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639842757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842757, "uuid": "1e21cbde-fb21-4196-ae05-ade697fb8d16", "comment": "Malware payload (Mirai)", "value": "de21bc24a45fe4fb609b305932b2c284", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842757, "uuid": "1bcc9ba7-0892-4646-baba-4e15765c5382", "comment": "Malware payload (Mirai)", "value": "9c23355f661028002aac76bc7907cd32bb693624b8ed15cbf58f5354a9d463d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842757, "uuid": "b9932464-1280-4518-a15a-db12f7722d2d", "comment": "Malware payload (Mirai)", "value": "1b29f8ab0adf0cecd2d0d868bcb143206e1dc8a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842757, "uuid": "3d8c8a47-c939-4684-b934-2fe488945698", "comment": "Malware payload (Mirai)", "value": "e560c533e9860baa9f3cf658a5618b30d76ea77ab7d165c65a27f0c0eca2dd61621650e55c6a08c07dc46d63abeb0c3a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842757, "uuid": "a3d17db9-1229-4739-9831-4c43466baa1b", "value": "T1E4D2E1B39CC2D4E2EA950476E8AB478A6706177CFC4615452648567C6CC00CFEFB5C9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842757, "uuid": "ef1b7972-d9b6-4fd9-8846-37f1fd45c32e", "value": "768:oaksVO/TaAtG3zjiBFmcEs2uM4P3s3Uo6e:oaxOrVtGviX7DP31e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639842757, "uuid": "b21d1b7e-dfa1-4c4a-aac9-8b90f590a766", "value": 29508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639842757, "uuid": "597a2394-d113-4463-a410-99d60fff50ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842757, "uuid": "3824de06-ca84-4adc-ab2e-3c7962f94453", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8025c012-5fdf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639817407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817407, "uuid": "d90f0ae6-efbc-4cfd-a7d6-cfcec682511e", "comment": "Malware payload (Mirai)", "value": "87fa6fd9537d6415e226d9088c4c8db9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817407, "uuid": "d05b3e82-0cfd-43a2-abf4-790e2848d382", "comment": "Malware payload (Mirai)", "value": "9d18e46a4c2692f7462a5cbafa2accad0a01b6bdd32ae8356971b370a5d45c28", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817407, "uuid": "da7d4e61-eb25-46d6-b644-3b0711f623ca", "comment": "Malware payload (Mirai)", "value": "7ebc213791fe9039041e923bf1e4d53b25694334", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817407, "uuid": "b5b25dc9-7702-4ba0-b5de-091d4d5bcb2d", "comment": "Malware payload (Mirai)", "value": "59100fc2005293f899e05a59cde28d4fc4af4e18791eabdd08c71978af9744da60bec4afb252eb5c3bb4fbffcef659ee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817407, "uuid": "4d7ad9be-a668-4687-848f-dca74f8c41ab", "value": "T18D53E9627C926A2AC5E063BAF6BE518D332167B8D1DF3217CC212B057BC551F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817407, "uuid": "9c48d882-b2a7-479c-9ca0-17dc9518bb52", "value": "1536:omHfUXVywKHMIeVOeKSs2KlkaLFgiZu6Kjoh+tTnS:omHfUl1IFM6KEhqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817407, "uuid": "4f3b4a8b-895e-4daa-8729-285279887599", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817407, "uuid": "1351ef1a-2fe2-4f7d-abe7-c6a22711f90a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817407, "uuid": "5fd41250-e964-41df-b5de-938e787e1a6c", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3deaa5e0-6053-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639867117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867117, "uuid": "95d3693e-7845-4d76-8deb-e9c9a05742f6", "comment": "Malware payload (Mirai)", "value": "bd67a83d7dab4dca807d8060fbfd3c03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867117, "uuid": "9c186d1c-5362-406b-9f3d-8c79b8c810ef", "comment": "Malware payload (Mirai)", "value": "9e5151c0378c47bc5d42da4ed5f9a2e98217efbb527ccb61db7ffa5523f86eb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867117, "uuid": "9f06e97e-5034-4c75-a2ef-cac95ddd24c4", "comment": "Malware payload (Mirai)", "value": "b134ee129e39742d04d9d4c1af92ba97e23e94e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867117, "uuid": "e663c8d3-f535-40ab-b44c-a2ee1352d8f6", "comment": "Malware payload (Mirai)", "value": "a127919b64a5f5a04d16e22f77eec7a766a8c3ca6d22d5f3da1df111ff2a2adc9d4658532bdddaf8317d0491542a2016", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867117, "uuid": "782eb623-ebf3-48a1-b3c4-1da156f5e564", "value": "T197B31977A4654F73C04565F125BA9A310F12AD931B1F1A88773CBAB04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867117, "uuid": "a2651eab-3342-4b9b-a166-ce53d6da5db2", "value": "3072:MDVLSItJP+Xsp4JlN3HL2mH1cuEgv26uN/:MDV+ItJH2l3HL2mH1cuEgv26uN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639867117, "uuid": "6c282b74-528b-466b-86d9-953cf97faec5", "value": 112634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639867117, "uuid": "71c040b6-de77-44ef-afe0-ea4eb51c4cf7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867117, "uuid": "6fbbd43d-7b85-4af7-bd03-ee92f517a507", "value": "bd67a83d7dab4dca807d8060fbfd3c03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1519ab-6029-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639849347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639849347, "uuid": "61b07baf-b5b1-45c3-88bb-da20a7400d83", "comment": "Malware payload (RedLineStealer)", "value": "021c61c9d1cac56e4ac63d60ce75f601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639849347, "uuid": "19090276-32f5-4524-8b5d-ec32bf00ab7c", "comment": "Malware payload (RedLineStealer)", "value": "a0900f66e0b67b27ae44d51c4b3fbe365741c3c3d265951bd72536aafe705932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639849347, "uuid": "292ca844-3b47-4fd4-ae15-7bfa526a94d3", "comment": "Malware payload (RedLineStealer)", "value": "54281aca074996bf0a66fe408440b69f2f66ccfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639849347, "uuid": "1bf14ffa-3c2f-4873-bbff-3001d42761c8", "comment": "Malware payload (RedLineStealer)", "value": "7d1188463495a9afe23a057f0d6528abee683b036beb4b59d15ec5ae51b4ff90caa30703deace498d968546b2bfed6cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639849347, "uuid": "422d53eb-9160-4fee-b718-3b80e8504238", "value": "T1ED84CF04B7A0D034F1B752F449BA93BCB53E7AE16B7891CB12D526EA4A386D0DC7035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639849347, "uuid": "75d53644-967f-41f3-856a-63bfac21b4b3", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639849347, "uuid": "ccca5c82-1c24-4d06-9cca-d1f920e407bb", "value": "12288:sg6mkXjBtHZtry8fCjDX9D9RD93p+bwHirRcp:sgSTDHZtryRjDND93owK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639849347, "uuid": "3d4c0272-0e3a-4244-89da-9c30eab8e98f", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639849347, "uuid": "8024783b-083a-4e0b-95d0-5ce61ea8ea47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639849347, "uuid": "cd457034-a5f0-4b44-81af-a28b58477cde", "value": "a0900f66e0b67b27ae44d51c4b3fbe365741c3c3d2659.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eaa3d10-6039-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639856113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639856113, "uuid": "a3921669-3d1b-4582-883f-b799ee9f5384", "comment": "Malware payload", "value": "a97b6a7593351094a8ae7aafcd96ac5e", "object_relation": "md5", "Tag": [ { "name": "contains-exe", "colour": "#6BD70C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639856113, "uuid": "c9b50506-3028-4828-b95b-ecb6939e1299", "comment": "Malware payload", "value": "a12d74b1756d49531e21f755fef2049ab6c83626f0834cb945c781c39d40a177", "object_relation": "sha256", "Tag": [ { "name": "contains-exe", "colour": "#6BD70C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639856113, "uuid": "a828c949-7377-4ac6-a282-496c66782210", "comment": "Malware payload", "value": "e45fc85c4455d3739e90d1d1234872e92b35970a", "object_relation": "sha1", "Tag": [ { "name": "contains-exe", "colour": "#6BD70C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639856113, "uuid": "15f2ac54-9aea-4b24-90ca-41b3a9928014", "comment": "Malware payload", "value": "2a6ebf599b55e1e8c31fd0e3b497dfcd8765af9db78da35a4371f28cd654cc528e748fc943363209df260f91fb06b505", "object_relation": "sha3-384", "Tag": [ { "name": "contains-exe", "colour": "#6BD70C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639856113, "uuid": "d15c5081-d8ed-4d1a-ad85-e020c09f9642", "value": "T1208633BBFB8613E9FA8137AFB979D90D09A996337910900D082C89E9073DD39C167477", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639856113, "uuid": "f2be0427-786a-4d21-a1e1-2107b73daafc", "value": "196608:nhFpWQgslw3QYgWPij8AT3OKKmy1Egf552Hna6L3PDhbjNkW:nheya3QYPbo3KmiEa5QnPp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639856113, "uuid": "cdae802e-c44f-41ef-ad7b-caa7e66f60cd", "value": 8100964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639856113, "uuid": "11d019d2-7904-49ef-bcc0-310824175ebf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639856113, "uuid": "401b404a-a44c-4f5f-b9a5-e4a698c3a979", "value": "PASSWORD_IS_825825____Winrar-602-x64-.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb277bdf-6039-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639856187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639856187, "uuid": "3d0c768b-dfa3-4455-835a-5824ab226730", "comment": "Malware payload", "value": "0af9c941d86c3914df0d442d51536bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639856187, "uuid": "03cb1d42-2f8b-4e9b-a6d9-d37c12b67a38", "comment": "Malware payload", "value": "a2f9f5a099a6b1c2ba6789effefa150aec52c5587e85df9a6963fd03b55d4d57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639856187, "uuid": "c6dd8726-0816-4cfc-9081-06e732c52842", "comment": "Malware payload", "value": "86ccef66be89113b7deef5a09e3354cdd13b0585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639856187, "uuid": "be2667e3-043d-4552-9365-4c0f9fd79bfe", "comment": "Malware payload", "value": "de865fb9070d5302205764d5c5edc79cafb8f04c2ac28ae49b085539637b412446249a65f5fb3a7802d0d9a4e0248f32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639856187, "uuid": "6d18da47-fb9a-4c09-aa5e-b75ec0860a60", "value": "T14A86339401455866C1FF6CB2ADB23F238A61AF449FAB8DAF713C2C4F9F6180D219875D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639856187, "uuid": "91d87956-9b19-46f4-a899-edebe32684f3", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639856187, "uuid": "26dd9907-72e3-4b22-a4ec-fe75699ff5c8", "value": "196608:JKtR9T1HusScfQ2BFDg6E801cUMDDYNvyuBbBcb:JwpHbLf9USYNKuUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639856187, "uuid": "b24ebc95-050e-4298-a8f7-b05dcd4b8a9b", "value": 8112022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639856187, "uuid": "4e99c3cc-8d27-4bc9-b17c-f2da99c1a7ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639856187, "uuid": "27079209-a613-4ec7-aac9-b2ea2a183bc9", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfda7709-5fd7-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1639814131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814131, "uuid": "429a551f-635c-41d2-9e8a-c6522489c8ac", "comment": "Malware payload (Amadey)", "value": "b581478dba5d79dc2502f02a0cbdb44a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814131, "uuid": "02694f3e-41e3-412b-9c32-77e873d895c0", "comment": "Malware payload (Amadey)", "value": "a3176dc8b23256fb326ca2198e98d848cd38988d9e5d2d0a228ea17e070f27d1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814131, "uuid": "a2cc627f-1aab-473b-83b7-321c151c8905", "comment": "Malware payload (Amadey)", "value": "dce54fe274583ba98f282350efbf9c985696415f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814131, "uuid": "05f874d5-3f61-4bf5-bc5e-96fa4eaa4080", "comment": "Malware payload (Amadey)", "value": "32426d2d2ae2b8d134d753735519784acf53d13450f342f9a004b6d47c26cea1efe3c7b4c880267e4e6e404aef55fdd0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814131, "uuid": "a87e56a4-8677-4672-b70f-73b79f542735", "value": "T144649D00ABA0C435F5B752F849B593ADB53EB9B16B3491CB62D516EE0738AE4EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814131, "uuid": "f9bf57c0-0bc1-4b5a-9859-9b2eaa3577c8", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814131, "uuid": "e50a1df1-97b0-4f57-8f95-38874b50d302", "value": "6144:TlAfC/MxtuOTXoZ7ZfQGDgVr0F2E2sqzRGjIm7n6:v/Z7ZfQGDgVr0FmsqzRIVj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639814131, "uuid": "8ed488ed-db28-4b3f-b8ca-a5736a7c3503", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639814131, "uuid": "a1050af2-887c-4e1d-987a-c88cde387ad3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814131, "uuid": "43716e12-acf0-4544-85c0-4bd4faa72bd1", "value": "b581478dba5d79dc2502f02a0cbdb44a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e955ac-5fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639805867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805867, "uuid": "468bb6d6-6cfc-4718-9e73-500d4940506e", "comment": "Malware payload (RedLineStealer)", "value": "2afbe4b5748cf9c2f51a24a9d6633d28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805867, "uuid": "1bb02189-399a-41f2-a605-b414c6bee1e6", "comment": "Malware payload (RedLineStealer)", "value": "a46877360915a0f6d9ff4a1ce935352e485333ca80a3c82ed83ae72bc92328c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805867, "uuid": "7cdfb959-c5d7-48c2-b2c6-bc3102a0d878", "comment": "Malware payload (RedLineStealer)", "value": "23d00713bd897d06da7d2285ecf320ee8597a7f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639805867, "uuid": "f43824f8-e855-4e40-818b-20afb8ce831a", "comment": "Malware payload (RedLineStealer)", "value": "7f816bc9ee4493e513a5743cfdffd3262ad8a3bb4843612df511287b8bf805be28aa2b121ee15762f8b9e93d5752264b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805867, "uuid": "742f72ec-c5ab-4c72-9f89-6ce877ae1e55", "value": "T145B48D5A32DCDB58F57FEBB98CB5204083F5F4C2E211E5CDFED124CA5961F448A26A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805867, "uuid": "c3b873d7-1ec2-4829-852d-1ca623d6979b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805867, "uuid": "2e0208a7-a66c-43a8-a8ae-fc2bc7a6f347", "value": "12288:xfRQYsMwa//uQSalhEeCpCjJ2lY6Liv/GBlqr+C79:xbEeTYogqKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639805867, "uuid": "3d29d7be-980a-4a8d-9f6e-d046887f52e6", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639805867, "uuid": "9ba6debb-3c9b-4375-847f-b101b43a26c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639805867, "uuid": "74ecb455-db8c-483c-b41b-f8a5af8a051c", "value": "SecuriteInfo.com.Trojan.Nanocore.427.31843.21596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babbdf34-604c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639864320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864320, "uuid": "655997ce-43e4-45ab-84df-34d6abc07bc7", "comment": "Malware payload (Mirai)", "value": "fa36d05a48c7ff68680abd9a05ae3cfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864320, "uuid": "76f0e892-9cd1-4279-bc05-b4b978a99f1e", "comment": "Malware payload (Mirai)", "value": "a46882fce4f22fe923707a9fe8ae85c21081182baa18630477ab922dac25af7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864320, "uuid": "55b4fd84-749e-4547-ba85-99d1da44b984", "comment": "Malware payload (Mirai)", "value": "80e26b01aaaffedd3279d04001c256214d6bc48c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864320, "uuid": "bb94e0d6-4779-4854-a856-bc655c647f66", "comment": "Malware payload (Mirai)", "value": "704b04168ae8fd6c743cb522a10fd4adc95050bb165a005c880ffecf3dfbf7472bc54459198bc0d97f64c9e7c99dd5b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864320, "uuid": "5b0cb35b-fcc6-4943-93b5-40e2dbc5f3de", "value": "T146E2F163A358C740D36E36751ACFBE05D1A8472FD47583D7ADA8243386E1FA1292CB13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864320, "uuid": "0e8f8d26-0cb0-470d-9eaf-55b6d1134a3f", "value": "768:byIuM3Lc1tCD4Zb+0S6uVUK9N15eYuvdPz9WDCjcLA0rD1g4NnbcuyD7UryqQ:em3Lc/CD4Zb+vbNaYYPzsZlNnouy8mqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639864320, "uuid": "1b6e127d-c12b-4cd9-92ca-c9c7adca1a02", "value": 34108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639864320, "uuid": "4f0556c5-df07-4a12-b087-d8410dec8f3e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864320, "uuid": "1403f7e2-a9ba-4812-b1cc-a22052ae7e23", "value": "fa36d05a48c7ff68680abd9a05ae3cfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b7c7f7-5fa6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639792779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639792779, "uuid": "1485be0d-4a1a-483a-b6cd-f0227a8640b1", "comment": "Malware payload", "value": "c4ab4694e3c957eff04b1d348653ee3c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639792779, "uuid": "cb5bd81d-1c7f-4547-90bd-a234f4a306cb", "comment": "Malware payload", "value": "a5473efcdb90b47cd41e0740a37554fb2265d19584bfce8cd6b020a679f143c4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639792779, "uuid": "d053649e-52bc-4b07-b81b-54f33d7db5f5", "comment": "Malware payload", "value": "70e762a8245bce816a4c68d85a261bb980b56135", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639792779, "uuid": "80589f13-876a-45fe-b8f9-3c8d9635bcb4", "comment": "Malware payload", "value": "6d04caeefd3bad8df7bb456df16f351e0652d0f609bd4270e2c54b7bb78f6889c0ea5b731edfb76c06b210d6529d9f04", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639792779, "uuid": "b85e3fdd-b1b6-4563-9508-44378698c80c", "value": "T175440176EAC9D81ED36BE7B90E7A03AA152DC2488712CB3FB555C0984DCF895CB40F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639792779, "uuid": "4b1eaf4e-c6ad-4e57-a4c2-ae77edb78098", "value": "6144:PBJHta5/OnzcxyCuBfHta5/Onzc2nBwHghFBY9W8BV9WsT:PB9PzbCuBvPz/BMuBO3B3zT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639792779, "uuid": "f7f6e0b1-9655-46c3-a7fc-c6f6835f98eb", "value": 273716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639792779, "uuid": "a527b0b6-3c1d-448f-8f1d-fabdc9d87e3a", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639792779, "uuid": "f21d481c-09e4-44b2-b563-8ba24c18fbce", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a6506a-604c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639864313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864313, "uuid": "2eea6929-0d93-42a9-a98c-78fd8632b9c7", "comment": "Malware payload (Mirai)", "value": "ad3c85d659db6f9f554ded5c5cdc5ba7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864313, "uuid": "12b18608-4e95-4a91-a36e-2b1f457f311a", "comment": "Malware payload (Mirai)", "value": "a56456fd4e8b1c1b4b86dea0fe788279b6d58b1f783d9f662462d70ae72d9d50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864313, "uuid": "9c14916f-1e61-4bff-8bab-7db4a1f7c4d5", "comment": "Malware payload (Mirai)", "value": "644012af84f0d3aaacee33809d9f2627ea2e0309", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639864313, "uuid": "0d7411cf-7fe6-42b9-8bd0-359664770df6", "comment": "Malware payload (Mirai)", "value": "8b3107f6620f5ed64be7072ba9dacd3a9d7100bbe0a55ffc31b546377cd520c34bfa6890af6789111984a497f5ddbe4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864313, "uuid": "5229c2e1-353b-4c4c-80d9-7fac5b71e501", "value": "T15B835B3289142F68E5102A7161F5DD3D47237EC043530D76E18F822C5AA7EEEB216FE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864313, "uuid": "8f171440-c864-403c-b1b3-5e0df904fc0c", "value": "1536:k8TKPWLIy+g6tV14bncT30KUrJh+ggjC4ONqSU2Tp:lKP9y+Ym7UGggjrp2Tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639864313, "uuid": "e40d8312-d222-4826-b718-a091fd12bbb1", "value": 81244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639864313, "uuid": "1bce24a9-3349-43ea-b94e-51400ab6c132", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639864313, "uuid": "55f55232-eca0-4e87-adb8-111012faa5c5", "value": "ad3c85d659db6f9f554ded5c5cdc5ba7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783a72ba-600e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639837580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837580, "uuid": "7a66660f-cbf8-4fb0-a80a-7d59d11661dd", "comment": "Malware payload (RedLineStealer)", "value": "6a4b078a500c92ae7bbf3563a49fb100", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837580, "uuid": "28efb425-bc73-4c9d-8839-dd037a48b776", "comment": "Malware payload (RedLineStealer)", "value": "a5acef0be0bd9993e756bb20a6b4e9fc2b1e819a02992255e4839d217ecf7258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837580, "uuid": "0464e3ff-0126-4bb1-a81c-677e1c85727d", "comment": "Malware payload (RedLineStealer)", "value": "03005f11d47b9ef868df361c1603f33a9cee55fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837580, "uuid": "f80df64a-a477-40a2-b762-dd0c82f36044", "comment": "Malware payload (RedLineStealer)", "value": "39e4198c59439ff4761ec3e1e1c6dfcb025b2a0bba845bab1deb6fa284b6028d1f1ade45a17b1fcdb1f36cfc3f0e6d48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837580, "uuid": "ec52c489-1c21-4921-9507-07a4bc73d6cc", "value": "T13A649E007BA0D035F5FB96F449BA93BDA53EB9A16B7591CB12E116DA47386E0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837580, "uuid": "a6701eae-224c-4ed4-9660-1eafec74b7f6", "value": "4ee83624426d72301d5dc28b390adabc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837580, "uuid": "51ff9298-650d-4ba6-a8cf-364796d6977a", "value": "6144:WnXZmLTBtc8uQreHIN/51x5iVt+A6p2KSVEn1y:WkTBdQHId51x5iqA6p2KSmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639837580, "uuid": "988e69de-b23d-4def-a71c-1ac65f2a3553", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639837580, "uuid": "8201764c-62a9-4ef3-b4c0-b251de0c41e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837580, "uuid": "2f5a12cf-721e-4981-804c-6778e62fb0e3", "value": "6a4b078a500c92ae7bbf3563a49fb100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f55b6e-600c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639836695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836695, "uuid": "35b4802a-f2b0-4bf7-8728-19d49ecf3da5", "comment": "Malware payload (RedLineStealer)", "value": "7424f5391db5d89d3efb799879fde297", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836695, "uuid": "3072ec3e-c3dd-402e-b7be-e9ad5b3082b7", "comment": "Malware payload (RedLineStealer)", "value": "a5b297ef1b34ab54da2e29edbfdee659ac2f9abbe53ddf66b2bee9fb28508f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836695, "uuid": "cc7ce54f-ac48-4015-bf28-22f0a7500ada", "comment": "Malware payload (RedLineStealer)", "value": "abc666c89abaa5c937f1a7dc9298f06c5bfa3733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836695, "uuid": "dcc59781-06a8-48ed-9d50-4ac30a3331fe", "comment": "Malware payload (RedLineStealer)", "value": "07029b04bb16bddde43d206930d2ffa17539a35ad00c4906e67b0f104effa0b2a4e90b3be68de00dfbf82cf86e14a7c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836695, "uuid": "2c973866-164a-4e18-a8c6-f2254c4307f9", "value": "T1AB84D000BBE0D034F5B742F449B693A9A93E7EE15B2490CB22D427EA57346E1EC71397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836695, "uuid": "ba2cc324-8d64-466e-9f33-53a120741d3e", "value": "e00af8f1ad8949415054b06be51fa3d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836695, "uuid": "a06e4f5a-bccf-49db-8165-596bf2258c2e", "value": "6144:g/Br34ad7Mhou5p034iK769u5iha3xt9iJlcpwK5zd7:wBpNMhrp039j9Qiha3xt9IcpwK5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639836695, "uuid": "e8bed452-b929-4334-9261-291cfe51c526", "value": 406616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639836695, "uuid": "8136b351-8bb9-42fa-86f1-b49607046dab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836695, "uuid": "b613126d-f969-43a0-816a-42dcf333c5fa", "value": "7424f5391db5d89d3efb799879fde297.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3fc0f0-5fd9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639814902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814902, "uuid": "6d58c152-1d06-43f6-8721-af8e5dccb14f", "comment": "Malware payload", "value": "02e3992a9be2cfad955a6439c72e9554", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814902, "uuid": "1ce4c9f2-c40d-4bd5-83d8-adfe2510f3bd", "comment": "Malware payload", "value": "a6ef0b6287c51dec139c374243a499b4612c18c704ee821fa67e306dab3b52dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814902, "uuid": "d8b92b18-a251-42d3-a888-526cf76e874f", "comment": "Malware payload", "value": "ce38df24e3ee9fec4a9d19d93e42ca2884ddfb87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814902, "uuid": "3ceb3656-cdc8-4463-a2ef-50b59501ebaa", "comment": "Malware payload", "value": "470f61558801a2d211367aabeb01c642c35d09cbefb1c91184ee8df88ce153f4da992d07b8dbbe3033c10b9c65fb7283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814902, "uuid": "3c706fbe-2010-41e3-bcf5-d3450dda83bb", "value": "T161944951EEE85201C5539BBF1273B8719AAF9C7AE804D038588E7DEE377A78C09C5847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814902, "uuid": "17ac1e69-2612-46b7-bc3b-e5426395b971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814902, "uuid": "155195c7-a482-4e5e-a816-778fc798b468", "value": "6144:gETqbtKhf548pjilcYxLr0vXNQ20AUXYOZ3CTZDfcQB++:RebK4ojFYx8Q2LIjZ2zcI++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639814902, "uuid": "04eeb8ec-2299-41f4-8591-14f4db8c53f3", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639814902, "uuid": "2e6b1b98-a1b1-43d0-97d6-d23d393f6f83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814902, "uuid": "40b8b861-5b68-46a7-a489-0caa70b19e1a", "value": "02e3992a9be2cfad955a6439c72e9554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ad87d2-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639844186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844186, "uuid": "84916b85-3ca8-44c5-a485-c9ff267b08d0", "comment": "Malware payload (RedLineStealer)", "value": "97a50e4f411d03938e2fa231d0538ba1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844186, "uuid": "d2e2dfb7-1981-4461-91fe-47a59d8aa901", "comment": "Malware payload (RedLineStealer)", "value": "a73b323f8aa04093e8200196cb373035dd6f10d30ae0316f666bf6fbcdf4fe4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844186, "uuid": "6ea2031f-fa6d-4285-9601-14940efe47bf", "comment": "Malware payload (RedLineStealer)", "value": "6bd5e9c23bd3b5c70c444f2040cfe61f206da86a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844186, "uuid": "99b7ef1b-69f8-4e41-88f4-fa2284630f6c", "comment": "Malware payload (RedLineStealer)", "value": "e044442519500d09f214ccc95326d625c58962766b478112deef38eb8c5eeac0b9233501c460f40ee60c9c4dc823d300", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844186, "uuid": "d95d2a6b-68ec-4cab-8dce-6bbbef0f5cbd", "value": "T1AE549E00B7A0C435F1B713F849BA93BDB53E79A16BB5A0CB62D516EA1674AE0DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844186, "uuid": "43d1c69d-c68a-4cf4-b92e-2ca058b372a3", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844186, "uuid": "18cf5aed-8534-4c87-abd7-e57b0918d5bc", "value": "6144:S38NOrTQXGQFb0BfXLiT9iyva5PZvqBCmBM1DqmBFrt:S38cPESBPLiBiyva5ZByM1Dq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844186, "uuid": "1d324376-8a01-477b-9876-a2c783ea4303", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844186, "uuid": "cfffe825-9c0f-4fe3-98b9-77c1135b5e5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844186, "uuid": "3ef2e94c-49fc-4563-ad0d-4463ed3b878e", "value": "97a50e4f411d03938e2fa231d0538ba1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1841678b-5ffd-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639830117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830117, "uuid": "7627082c-2929-4c61-a085-d78e7f2c09c1", "comment": "Malware payload (Gafgyt)", "value": "c6d908f4a97a32db6972f060438c9c0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830117, "uuid": "17d5c602-394e-4d6b-bb4a-06f83f06a58c", "comment": "Malware payload (Gafgyt)", "value": "a775f10a0ad99f304d04f7269af3d063f9a2890b1c1a3e82102be47e63afd48f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830117, "uuid": "1ad16cd8-7dcc-4115-a9ba-a6dca3f85e79", "comment": "Malware payload (Gafgyt)", "value": "ac871d9fb3223fbdc72355921e596da93391b632", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830117, "uuid": "8436c2c8-112c-4a6e-9d0e-89f172fc36e3", "comment": "Malware payload (Gafgyt)", "value": "5b42347a96b3b7c828a3c2028d534e80612a355808ed7b3b7d4d8d40593475c9090b2dd2ff6819a02e39e774b882a040", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830117, "uuid": "f98de0db-89ea-40d3-922c-a9a832dbcf64", "value": "T17CA30696F801DFB6F40AE77604D34B25B670BBA10A936622731739A6AE721C47833F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830117, "uuid": "c7c04681-1f34-4fa5-9b6d-7578d30a2db9", "value": "3072:MeWDYAaxIV2ylueX1gDEP/wwSOmyzVqDrIafHZe:MlDYAWy8ogawwSOmyzVqDrIafHZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639830117, "uuid": "f21e09d9-733f-4c2c-a6f2-cd6f30eb5748", "value": 102765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639830117, "uuid": "548206f9-4432-4adb-9ab7-70effb2b49a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830117, "uuid": "5b5008f6-8e37-4b49-a1ca-99948dfb75ba", "value": "c6d908f4a97a32db6972f060438c9c0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76736ce1-600e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639837577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837577, "uuid": "c9fc146f-2178-465b-99a9-bfa62672b66d", "comment": "Malware payload (RedLineStealer)", "value": "ab7ff188c508a3cd3ef07ed0dbbd9a51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837577, "uuid": "c34dadae-53ed-441a-8d7e-1b83a8468dad", "comment": "Malware payload (RedLineStealer)", "value": "a8799937a4e80e5556a2885c987a9c07859312304c718a1a2e414621ca74cc80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837577, "uuid": "79b0acda-65fa-44f7-b437-4885fc3fb7e6", "comment": "Malware payload (RedLineStealer)", "value": "dc20940f23e976b66f5137137ff74a5c0fd8e5ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837577, "uuid": "bd227bc3-0889-4090-bc93-8f55f4ab786a", "comment": "Malware payload (RedLineStealer)", "value": "f4184e09d458fb24c6aa9c09c1c763c18d640248e9bcf62615fbcf78c9fb7780364750476ffe0ff76cda643626f7a2cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837577, "uuid": "a8732225-9142-404c-8c31-b35acb043ea6", "value": "T10594DF00ABE0C034F5B752F449B6D3ADB63E79A21B7494CF62D456EA4634AE0EC32357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837577, "uuid": "e08636fc-5342-48e6-982d-96397c6aef2e", "value": "97510e08b27860260a6b4085182271af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837577, "uuid": "08a0cf7e-b971-4c2d-abdb-92f37006214c", "value": "6144:G/H4UvwYogRhavtZSh7URusIGG+xdWnPbc4dtHMWJn:mYDQwVMh4IGG+xdWDc4dtHFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639837577, "uuid": "9df224f4-1984-4678-9b99-ddda73579293", "value": 419871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639837577, "uuid": "66b8b159-6513-4421-bc63-ddd14d705120", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837577, "uuid": "f7ea5a97-469e-471d-a1a7-7e4d98c1cd8c", "value": "ab7ff188c508a3cd3ef07ed0dbbd9a51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f460bf4-5fd7-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639813835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813835, "uuid": "60b4ef72-3900-4876-9121-6a3cc15ede2b", "comment": "Malware payload (RedLineStealer)", "value": "815523d02617a224888d2fad9703ca4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813835, "uuid": "748efa9f-883e-40aa-bdc7-7f4dc4e1595e", "comment": "Malware payload (RedLineStealer)", "value": "a8f23aa1f7842d8229fe27e9c8be82ef59aaf4829dec489e963034bf744934be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813835, "uuid": "156d34c3-77fc-4709-852d-e68b10f74678", "comment": "Malware payload (RedLineStealer)", "value": "8f141cbb187f34bc6180a0c2992c944bb1f132fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813835, "uuid": "8f2b3762-5721-440b-9757-c7cb13b2a54f", "comment": "Malware payload (RedLineStealer)", "value": "fc3dec176901098ee5ece74d579cd8a507d1f4e4118bc38e795c04342ec0c550d86b077008bb3f399f13a90731963eb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813835, "uuid": "c985e03c-f353-4e61-b212-9758f6b5e5bd", "value": "T192649E00BAA0C435F1B752F84AB9D3AD653E79A15B64D2CB52D526EE47786E0FC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813835, "uuid": "87e06154-6938-4dfb-86d3-e698f8d76a35", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813835, "uuid": "0286ba79-3179-4c93-b710-d3d66b412b76", "value": "6144:sZRLZZsL2G0/MUIGqJU1yc+OGmcSMWclxaTn7:SLZSyGoIGUU1yc+OCSMWclxO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639813835, "uuid": "8e302007-d860-4b8b-9f0c-34e7212523c5", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639813835, "uuid": "21c59332-b6ba-4690-b696-a8da2f13b5c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813835, "uuid": "a8656ba6-516d-4eea-b95a-ed56dd9d5e70", "value": "815523d02617a224888d2fad9703ca4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc384cc8-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639844190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844190, "uuid": "b5dd60eb-7869-4833-99ba-21d562d8476f", "comment": "Malware payload (DCRat)", "value": "9842545d9bb49bdce0960a279db91b64", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844190, "uuid": "16dae1c8-6cd6-468f-b7de-d32ecb07ec34", "comment": "Malware payload (DCRat)", "value": "a99743495cee5a17b40bd14b3db7e0d2e61f99a0e1cc7d29d419d48861dd7423", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844190, "uuid": "060aabce-5869-4d49-92c3-f7f73e323cf8", "comment": "Malware payload (DCRat)", "value": "62cd15ebd6c1f719ed5bcf72ce6923234c6297f8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844190, "uuid": "95fa1116-b5e0-43ed-9a7a-7cb8243d6520", "comment": "Malware payload (DCRat)", "value": "8316a5e4e750b801313dbfae613a334d816100e7f862189f3902db70e05fa2e024faf0a1e056247eec9ed48cd057942e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844190, "uuid": "cb40e6cc-bf58-4604-bb3d-e1e9e7117b82", "value": "T170549E00B7A0D435F5B792F449B597BDB92EB9A16B7590CF22D516EA0738AE0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844190, "uuid": "519eeae5-ef6d-4c6c-b88f-f06680e780cd", "value": "e00af8f1ad8949415054b06be51fa3d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844190, "uuid": "5197bc20-b697-457f-a488-f5f340ecaf41", "value": "3072:z0PLs7yOcilregSjSB8NaQZdy1v/EBrwsfGXt8EHaBY++1s1tcfXnC10z5Ya5bHo:bcdgdeji/9sfGdn1s1tcvw0z515R2+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844190, "uuid": "d6f74eff-bff7-4d69-be53-e8a9c8f8da6f", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844190, "uuid": "0e87222b-841a-4d95-9eab-af053130c99c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844190, "uuid": "7186f656-6bc5-4825-b2ea-c8cc273ce670", "value": "9842545d9bb49bdce0960a279db91b64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89beb336-5ff2-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639825583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825583, "uuid": "a3e8ea6e-93d5-4dde-a2ba-9d6a72ec461a", "comment": "Malware payload (AsyncRAT)", "value": "b87d5b63f003c3f81ce9687e56e12102", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825583, "uuid": "e3b11c8e-04ba-417e-a251-535a6f9cf6ce", "comment": "Malware payload (AsyncRAT)", "value": "a9c1dd5c5d75819771e541e646968e4c01bc12b2eb648e8cf553462e8e76fe74", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825583, "uuid": "634ac36a-5f51-413f-aed1-93ec5ab7f88d", "comment": "Malware payload (AsyncRAT)", "value": "a970c3b5cbd61cefa12a9a3b22b26d118f310d84", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825583, "uuid": "49495d56-0519-4eaf-b5c8-8ca847e515e8", "comment": "Malware payload (AsyncRAT)", "value": "5962d3565f2126a168a13e551732b82c297e0e2649ab07fb03a0478eebfaae1e815021cb5c25165bd5caa83b022adc98", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825583, "uuid": "4150667d-a0b5-4acb-89ef-023f83daef71", "value": "T1C8A43A1A6683EBEEF935D3385A28209043F4ADE3D327E5D9FCE971CB1452B4096B3524", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825583, "uuid": "4e52eb18-ec44-498a-80fc-888416c1181a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825583, "uuid": "be8fb8f3-6543-4312-8c2e-ffa0d22fa895", "value": "6144:pB9cspMy3P5mWFRSftebkTlNU6bJ7G6N81cmEQzc+9VSTbJq//yYmE6:pB9TByG63S9UcLm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639825583, "uuid": "b0633779-e15c-4bd3-9c24-41f1e0478e57", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639825583, "uuid": "67ff8be6-0c26-4915-b85f-b3d97443a9e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825583, "uuid": "9799a455-9ea8-4c6a-bd16-4a91609efe47", "value": "b87d5b63f003c3f81ce9687e56e12102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2333f6-5fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639803606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803606, "uuid": "65fada85-8db5-4bc6-a1c2-4ee58a52ce1d", "comment": "Malware payload (Mirai)", "value": "f58040143352eaf1c9578f346a650d2f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803606, "uuid": "b8e62073-8a08-4695-a554-6bb0248eb532", "comment": "Malware payload (Mirai)", "value": "aa4330a554a868bad8dd57443c126df8a56c6a15168a1fba943278172df420dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803606, "uuid": "070ad5f4-df50-4dc5-8994-715498775912", "comment": "Malware payload (Mirai)", "value": "2c7dc7a39e0ca9c7214970db65c31dbca2882679", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639803606, "uuid": "c10dddcf-19ff-46c1-b503-2472b8899199", "comment": "Malware payload (Mirai)", "value": "ea78e4d32d77524e97462c7f06b80ab30f238861eba7feec005e58c50e828d197d8203a94d2f5e78071ba175f654b575", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639803606, "uuid": "300b805a-3487-416a-a2e8-c91bccb82545", "value": "T181E20881F9415A03CAC65177FF0E438D7B2B1758E1FA33039E2AAF2237979660F26552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639803606, "uuid": "e000d29b-f6c9-4302-976a-8496a7054e4c", "value": "768:6qAIddSE1MySQn4kSh6CiywXV5wcvQdII:Tn8ySf9iyePwcv01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639803606, "uuid": "383a2a7d-3f25-46f9-b0f2-89f8f9976c90", "value": 34204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639803606, "uuid": "11ce329f-54cb-43b1-aeda-11bcf5e54207", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639803606, "uuid": "46c75544-bd8e-423e-871f-ab3176d07107", "value": "beamer.arm-20211218-0500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fe7f87-6015-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639840603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639840603, "uuid": "f82eaf98-4d51-4f88-8ac0-4cb351d92211", "comment": "Malware payload", "value": "9eecbe9d6e31597d3e6cd78fe9ef7f2c", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639840603, "uuid": "5017185e-f713-44af-bcc3-284ce4d53ad0", "comment": "Malware payload", "value": "ab604be3d7aa25e8ad916513b85c1119817ba67bd3849950b518c58d1271b1f2", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639840603, "uuid": "2a4bbf45-da67-4a17-ac9e-399326ca861c", "comment": "Malware payload", "value": "9f6713dfe2b7244794905f34ae783fca6fafd9bf", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639840603, "uuid": "090b8e0c-7344-44eb-bb47-393c930d2879", "comment": "Malware payload", "value": "d2e8975e1c1f74b2af917c34b27d8155a63694a6a5b00b58406cab2413cd6cbe56346cb68eb42ab1929beaab1aab476a", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639840603, "uuid": "4084e6c5-7ecf-4796-b245-15358b1f0515", "value": "T1A651960AFD47D15C5FB5235BED978A32FF1B411B5DA3100872ECC2595F20809A7ACB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639840603, "uuid": "ed32a936-3bd7-489f-b372-b066404cbf75", "value": "48:kxJJckjOjOLuDQjvUKmc4TQ7QZE96pAUYRAGqqsUoyWKLrj6l1CelkEJmZVoQdrr:WHWChrffoypvK0elkEYZaM8ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639840603, "uuid": "cbea2177-2e52-4641-8b37-aad1ac0fae25", "value": 3170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639840603, "uuid": "85a325a7-dade-4aae-884a-26c05cfaa0f3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639840603, "uuid": "a9b81c8a-1269-4b9f-a03e-fb6da4911277", "value": "Apzw415p.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07591ae4-5ffd-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639830089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830089, "uuid": "4be5bde2-1b6f-4317-a9ec-ddc07bbaaa57", "comment": "Malware payload (Gafgyt)", "value": "46fcc59f0197d2a1990351a5b6e8a8c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830089, "uuid": "a21a6cf5-ab0d-4b55-93d6-376da3bc3350", "comment": "Malware payload (Gafgyt)", "value": "ac68823794d5326c9d58e3e3cab6afe4632ae46b38a6305e9d58ff6317b67a55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830089, "uuid": "01a70fa9-c62d-48bd-aef3-7ace316d8db2", "comment": "Malware payload (Gafgyt)", "value": "50eedf17c5a6901b1311638c4067cd8b8f65fa18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830089, "uuid": "ad942554-7cee-4a01-a9d0-3bbeaef598e8", "comment": "Malware payload (Gafgyt)", "value": "4283db8ff9fb952503aa19ed1951712c0a0a9fec086def050035d7c39eb669c0d1e66e922c76fd251dbf43a0d3ff9dd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830089, "uuid": "c9644937-f9ae-4061-a36b-fbcd73733ec1", "value": "T183833B42FB81CAB3D18305B6169FAF110532F9BB1A1AEF06F36D6CF49A150817622F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830089, "uuid": "312d9e8d-e2da-4cd6-9319-3e7e5522a85a", "value": "1536:ueCZMF+Kn6kqkUIvwR/Uxg7MtGTGW/xYWkR/Zimd+eVOz+sEcfUnk:ueCZU+ZpkLwlU6WW/+9LimMeVOz+XcfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639830089, "uuid": "b5158dcd-314e-4d1e-8ce5-7a1ab6aff541", "value": 84991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639830089, "uuid": "bd98f8b5-717f-4c3e-aff8-faa2b66699f3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830089, "uuid": "04e599ba-66e5-4fda-8eed-19f99b4929e6", "value": "46fcc59f0197d2a1990351a5b6e8a8c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613863fb-5fdf-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1639817355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817355, "uuid": "e2b39c49-4bc8-4d1a-a894-7365e9ec6379", "comment": "Malware payload (STRRAT)", "value": "25d7be8c2f534dca289f50a193a5418d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817355, "uuid": "2c0c9342-1267-490e-a821-35acce41f5dd", "comment": "Malware payload (STRRAT)", "value": "ad13f2f5590aa12b204c3713520f605595ab04f468577424effd742251a35712", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817355, "uuid": "9fd53dfa-61fc-4f26-91a4-93096df51cb1", "comment": "Malware payload (STRRAT)", "value": "020aa3a275641eb88e07df1ed222f14944f80785", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817355, "uuid": "3c5d9350-742e-4968-bd71-87e5d516285c", "comment": "Malware payload (STRRAT)", "value": "733b6890bfdae8e8d1e8dfe54e2fe5f8b90141d5838f81ad6e9182929b9c4491a1d3f0a0a8fcf4c57302397289570fe6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817355, "uuid": "e959285e-0337-4e16-a417-d9c61eb9c546", "value": "T11BA3D05FBC6EA8A9D88B113F9998E273A50C5584C415E23F64FC540E1EB0C6D4A07EEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817355, "uuid": "5f7159e3-1a30-4d24-8a89-d68e2ddfed7e", "value": "1536:Qqt7M1p4RFTp3spbTmXXgTETWd/Lo2P1Vj9T13471XxCcXF464Z6ki+XGV4EH2/z:RMv4FTOpbTwgTO2DCGN6415w2PUzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817355, "uuid": "71e836ac-3a09-4670-b985-aa7e52f2303e", "value": 106049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817355, "uuid": "731bc876-397a-4042-bd91-cdd9169334aa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817355, "uuid": "94570ee6-8c4f-4f9a-955e-6c6781d61544", "value": "SHIPMENT_DOCUMENTS_BL_INV_PKLISTS XLS.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1f2a7b-5ff2-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639825748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825748, "uuid": "ccd60f98-d6d9-4628-9c07-4e1583b57dd6", "comment": "Malware payload (AsyncRAT)", "value": "39c6cd028ce7cf63afe5890e21523b91", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825748, "uuid": "0f1514ef-7ed9-41b2-b5a1-d563945ccb85", "comment": "Malware payload (AsyncRAT)", "value": "adbeb59939b56b701446d79c10c6af29c287a621b4522f53c481582eb926924d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825748, "uuid": "48213237-6314-4e16-82b9-557e382f7e68", "comment": "Malware payload (AsyncRAT)", "value": "826a9d4452671ef6ff292717d46f3ac1365976ce", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639825748, "uuid": "28580b2f-e10d-4dd5-abaa-24cfb9f51c62", "comment": "Malware payload (AsyncRAT)", "value": "d0c2d87053cd1caa60178cc479179f8f8078ad787d472321e3409a9ae0c575d7fad7a01fd385d3e48cd518a2a4964dcc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825748, "uuid": "11de6356-1cfb-4eea-b611-2f12a55b8fbe", "value": "T1B105B59D325172CEF5B7C835DA982C64EB9078F7970BD247E063259A9A0D897EF100F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825748, "uuid": "779f78ab-891c-44c8-8600-9a66e2474a86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825748, "uuid": "67bcd17a-4862-461f-82e8-05a4627ab216", "value": "12288:z3w1WdUdnb6jQN43ilT0J9bilQhxGhBjNVavK/LsnE5CXvUiljwnkDuFsS77BXUr:z3w1W2b0QN4SlTo1i8xGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639825748, "uuid": "0f695f98-8341-4f98-ad19-d96400af1225", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639825748, "uuid": "96fb9be0-e72f-44c5-b128-9441e3310466", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639825748, "uuid": "f22ce7fb-c8f8-4fe7-9335-e55baa33372f", "value": "39c6cd028ce7cf63afe5890e21523b91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325d6934-602f-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639851636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639851636, "uuid": "bf275c45-7663-4179-abfe-f671909ead7d", "comment": "Malware payload (CoinMiner)", "value": "a380aa3d52cdb2b613a091cd1d55b6f6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639851636, "uuid": "27e5c1dd-8547-4080-91b5-43d4cbf1aac0", "comment": "Malware payload (CoinMiner)", "value": "aea2cbc32b7925ab28e619b8deb5c540ea8e61ad631b02e348be04b87f44627a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639851636, "uuid": "bad23a09-d36f-4d92-a2c0-2276a60be332", "comment": "Malware payload (CoinMiner)", "value": "a5f63418e68412576de89a4611a4f9c57d36ac0d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639851636, "uuid": "69cda75a-db9f-4e14-9aa3-5a0e1a335dbf", "comment": "Malware payload (CoinMiner)", "value": "402f25304eb1664c508abdd89a462db97021c9c5d365920d0da6e4d8c7e16cdd5de7cbf4c0a89af744632b02534f6261", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639851636, "uuid": "0b12da0b-81f0-4e18-9e55-647a6b2141bd", "value": "T168549E00A7A0E835F1B752F849B993ADB53F79A16735A0CB12C517EA5634BE4EC7030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639851636, "uuid": "dfa4796a-ec9d-4f69-918b-f648285b4cbb", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639851636, "uuid": "b449699b-5553-46ce-8505-f04fab8773a9", "value": "6144:HOO+Xvkq6W1nRAm9ONay6Sq6Bqu8j+cEu3W5KB:HiXRV1nRAKONaVS79u3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639851636, "uuid": "d279a341-0f97-4555-9711-d4a61bafb1f6", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639851636, "uuid": "9c38aba4-1f2c-4085-9e22-387d487151f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639851636, "uuid": "9a27841a-184e-4053-894f-e462cda400c4", "value": "a380aa3d52cdb2b613a091cd1d55b6f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3cdf71-600d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639836999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836999, "uuid": "051b6bd2-d0ff-4a14-a0b2-633179464bdb", "comment": "Malware payload (RedLineStealer)", "value": "835b87a384f53ef1d7417046e43c4fc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836999, "uuid": "646950b3-6242-44bc-86fe-bda9f4e6d603", "comment": "Malware payload (RedLineStealer)", "value": "af93e6a53d25e1727a2294de646d2941d94dc034e1c76eb3f34d129e0ecf2e69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836999, "uuid": "3d733164-0b06-4b0d-aa6b-9468c80507b3", "comment": "Malware payload (RedLineStealer)", "value": "523442d3b63542157ef7adc2dcef9caae6ba7e80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836999, "uuid": "480c2310-790a-4296-ad0c-708ae0dc9738", "comment": "Malware payload (RedLineStealer)", "value": "3b0c85de1081ba1244592a1edf63d803e07d652e09d4dffc604fa5be205a0b6c6a63460232758ca705ae9114536927c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836999, "uuid": "3fea9788-3e45-4746-9ba3-e4f7d44e7903", "value": "T19494DF006BE0C034F1B752F449BAD3A9752E7AF26B34A5CB53D126EA56356E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836999, "uuid": "d7b7211d-a805-48ea-a2cf-20fe25e00122", "value": "4ee83624426d72301d5dc28b390adabc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836999, "uuid": "1ae95355-f15d-4424-99e2-919819c0ff98", "value": "12288:QOHOqFFCzvGUHZ1olS7wAxlSoEYInaHqL:nFHW/4SioEYfKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639836999, "uuid": "aac26344-2696-4f08-bbca-833090ff583b", "value": 420949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639836999, "uuid": "d26a6612-bf4b-4dff-81bf-dbdc9a06e630", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836999, "uuid": "e312c84e-eb20-4cd4-a18b-df105725b458", "value": "835b87a384f53ef1d7417046e43c4fc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc216600-5fa4-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639792194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639792194, "uuid": "aff7ff09-f3c8-4260-88ab-3ca1f971429d", "comment": "Malware payload (ArkeiStealer)", "value": "24a153750bd7f50c29bf2a0dca08baff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639792194, "uuid": "3be1d698-fbdf-4e29-9b15-c3da2d5f3330", "comment": "Malware payload (ArkeiStealer)", "value": "b0b5c0153c7a4e5e1fce6204f5e8e82f09afb7b720b4d31c45db95f6af83f2ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639792194, "uuid": "c27b9de1-5dcc-49c0-91ca-3f0f7f433a11", "comment": "Malware payload (ArkeiStealer)", "value": "2f82a4afe6600f7fbcca2aed7cdbb2a77db0dae0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639792194, "uuid": "8cb027b7-078a-42c3-9a9f-1575faf89f35", "comment": "Malware payload (ArkeiStealer)", "value": "7f24b374e2e07eb6e20f023038a0fa74eff4ff1c9fa2be1d8b8d095a87c45eed7059836b5b7f24a29618904c51999d90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639792194, "uuid": "220b3e14-45f5-460d-88c1-749857939979", "value": "T1F3F401006BA0D035F5B796F41A79D3BDB53EBEA16B6491CB53D012EA0638AE0EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639792194, "uuid": "0ed01e83-8858-40d5-a24a-802fdbba83a8", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639792194, "uuid": "1ee497d5-02c2-42a8-9c97-10b4a3b3cc6b", "value": "12288:CTEh+Oc+RnmY5CesQRMetU2OJNBiDOru2UDv1VF3JzCw2yISUNHm8JZ3xMwwP9vi:CQQOPnmY57tqJNJu2K/F3JzD2yjUNjMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639792194, "uuid": "c14ed50c-a07d-412c-a4a3-38a68e7fdd4f", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639792194, "uuid": "a09766be-a52f-4eb4-aba0-66d47d807ad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639792194, "uuid": "597fd5b9-8743-4887-84b4-ee4133ddb342", "value": "24a153750bd7f50c29bf2a0dca08baff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6350c85-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639844100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844100, "uuid": "64c578a0-cea4-4d89-b30b-c218c5a421f9", "comment": "Malware payload (Mirai)", "value": "7f8c3b70986dfb62f92bc6d0068b91c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844100, "uuid": "60dc7f5b-26b1-44b4-8256-0a0d945b3f52", "comment": "Malware payload (Mirai)", "value": "b1759402bf5202b92a5e1c4a987a68b81a4e911f875aef36b4b23f0938223b9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844100, "uuid": "1b0fd3bc-71fa-4139-a70e-431525475292", "comment": "Malware payload (Mirai)", "value": "1cebb6d1b126a384b58cbf9517895bc7f57306ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844100, "uuid": "32d4d30a-82a4-4b2b-9aa0-85809a1c194c", "comment": "Malware payload (Mirai)", "value": "0f4a1762e36a0144cd527826a7b080c4837b070e1fe8f25c200396508ddceb7760f63671afdb954589a1b1cf40e74595", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844100, "uuid": "89ae44e1-afff-47de-b56e-1259d5421b15", "value": "T10D635BA6F800DDBDF896D63B44130A06B130B3540B921B37B767FD93BDB21A49466F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844100, "uuid": "77179b4a-59df-4b52-9545-456b672c2031", "value": "1536:rfXqlMuQycbLbSUQD3j2vpF668fjSPiQvF4Qr8fQpmchP1Cw:rfXql7cPbSJiRF67Qd4Q44P1Cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844100, "uuid": "a0c49bbb-28f5-458b-a9e9-d6862da7c5bd", "value": 72956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844100, "uuid": "594cd9a1-e6de-4ea4-a8ed-25719efa9a12", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844100, "uuid": "6ad5e71b-73b7-4d6a-9f2b-7b4731aaf784", "value": "7f8c3b70986dfb62f92bc6d0068b91c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db451820-5fcb-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639808970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808970, "uuid": "96559ad9-a128-4ae4-9b7b-f974cb1161b1", "comment": "Malware payload (Smoke Loader)", "value": "951d4903cedd287e8b24fe5dfca3d99d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808970, "uuid": "ab5d80ba-8f40-42ba-a5ee-10565d8d8850", "comment": "Malware payload (Smoke Loader)", "value": "b1f977415cb0ada91f4a2ba455d315b7a2ca9e7d1a191348fa95edede644a49b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808970, "uuid": "f99c3349-4d53-4cd5-bb85-25d40107c725", "comment": "Malware payload (Smoke Loader)", "value": "defa10e71945081462a05e3e67880d52d39d5c95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808970, "uuid": "60fb3a79-4b59-4167-8b4a-aadd97effef4", "comment": "Malware payload (Smoke Loader)", "value": "9c9c8cc77488a29d7b5cd2e6a369055ba37decff73e11193d2ae4b14aeb998e322c4f6530b39ad467cbda2fdf78c9ae4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639808970, "uuid": "c74f8769-0acf-4ebb-ba66-e7635377c539", "value": "T1B4549E00A7E0C436F1B712F449B6D3B9A53E7AA16B65A1CF52D516EE0B38AD4EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639808970, "uuid": "f856d66d-6b55-4cd9-9597-898f5de580dc", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639808970, "uuid": "cd7ba968-6686-4630-af4c-68ffb0eff4b5", "value": "6144:5YWyD5yy2o45qe8E39Bh1Lc+OGTpMm9lpO25n:XyUN8E3nh1Lc+OyMm9lpb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639808970, "uuid": "f447b240-c848-4255-8468-8e2b3c1f64e3", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639808970, "uuid": "22777c9f-fce2-44c5-a9c3-676bc4a43175", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639808970, "uuid": "d2f0a38e-870d-45aa-8dff-ea17a057282f", "value": "951d4903cedd287e8b24fe5dfca3d99d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1934f12-5fd7-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1639814134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814134, "uuid": "53efd7d4-5211-4eb4-b490-ac0325268724", "comment": "Malware payload (Amadey)", "value": "aff79a620121d540484f4ddf927458cc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814134, "uuid": "7c6ba8bf-9bab-4d67-82e6-1569f87b08af", "comment": "Malware payload (Amadey)", "value": "b252f1adbe8e920ad91404c9b9ee45450d1552c685cdbaf9d4c5acfcf05f6a1f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814134, "uuid": "0ce52f00-51ee-4299-9551-991d953b4877", "comment": "Malware payload (Amadey)", "value": "075ebd846e9483de79ba95c3c2fb2315eb6b62f6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639814134, "uuid": "4c75461e-03ad-4131-b958-bc7c7cbcc9b6", "comment": "Malware payload (Amadey)", "value": "09ff35b0ec8df708a4644d7d1783e6300b1cfe041a8240e3dec0e23455f8ef0f500c3951a3b7dc54556eeb2501faac09", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814134, "uuid": "93949d6b-77f4-4b28-a882-28610afa416d", "value": "T1BD649E10A7E0D435F1B752F449B6D3BD742EB9B16B65A0CB62D516EE0638AE0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814134, "uuid": "b418a08e-8963-49e2-abae-7b3080015fdd", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814134, "uuid": "30537fd2-8e35-40b7-a207-84d5dcd0ba0a", "value": "6144:9grbkdxa1XuPAqSTg1Qc+OGYBMyz5NN+XCnki:SodbPAqCg1Qc+O9Myz5NMXmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639814134, "uuid": "dda04cef-c144-444b-8a1e-1ad7c7acb77d", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639814134, "uuid": "e56e3e94-82c6-41b1-8d3e-f342499d04d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639814134, "uuid": "70916d85-231f-4d99-a7f6-74182399d306", "value": "aff79a620121d540484f4ddf927458cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41598d6f-6053-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639867123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867123, "uuid": "1f149751-10ab-4562-960c-d5dbe4618944", "comment": "Malware payload (Mirai)", "value": "afcedbd31d0fc4727d2bec63d9d964fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867123, "uuid": "c5ca2d24-4426-4525-b848-4a46c7945cf1", "comment": "Malware payload (Mirai)", "value": "b2d0dedde66985a2b6b9391de9bb75eb87e9b1470fdee37fbb3ed6a20dfa7c01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867123, "uuid": "9b7f5343-ed54-4136-bade-39c84690caaa", "comment": "Malware payload (Mirai)", "value": "bbbad148b17016ad2477d2d3334c4ca98ba248e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867123, "uuid": "a80d8190-6480-4dde-ada7-9d66b0206514", "comment": "Malware payload (Mirai)", "value": "3699496827e31b0b0805e811c85b918fe7a4530ef633851f9376fc02a224fa0acbf6991bd1620fc01e86d52102c3f831", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867123, "uuid": "02b38e54-c2f9-4f95-b918-8db80a750de3", "value": "T153E3A63E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867123, "uuid": "a60a417e-118e-426a-bf09-d21b217c778b", "value": "3072:JW6BK9tS1aRG4dKP6h//CJH+mrThPaLEne7rNb:c64i6XCUmrThPaLEne7rNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639867123, "uuid": "146417d6-1691-43fc-95d7-7d6f423a0fd3", "value": 155429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639867123, "uuid": "1d80299d-bf93-4bed-a21e-67b9023c44d1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867123, "uuid": "28bf664a-fa49-44de-8b87-d0d9ec231f65", "value": "afcedbd31d0fc4727d2bec63d9d964fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f0b80e-6055-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639868179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868179, "uuid": "0d25ccf8-0852-4a56-83d1-58c93b725d0b", "comment": "Malware payload (RedLineStealer)", "value": "f74ce1c29eb241889d61659c5ac3764c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868179, "uuid": "ac02484e-d989-4344-8479-02dc8bfced39", "comment": "Malware payload (RedLineStealer)", "value": "b32ce818ed06031e267e71fd9621c40d2dad34127402ddaa338fe159ee3ae62d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868179, "uuid": "3651ba5f-4973-4961-86b0-32b961461da4", "comment": "Malware payload (RedLineStealer)", "value": "b8d2f49187ea5762534a6e4851e4c4c66dac3c10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639868179, "uuid": "9e32ad83-ac28-4e74-95a9-4b7f4c59f5af", "comment": "Malware payload (RedLineStealer)", "value": "927e045b1ec128f8c976b23d5b9a448ea867f70ace93ed7f77077af30ae49425768befe05d7366787fc4b616c47eb3a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639868179, "uuid": "26d6a58a-d3ed-4fb5-b853-2f1f71b4d040", "value": "T11184D000B7E0D034F1B752F44DB6D3AC7A3E79A26B24A4CB22D516EA5A746E0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639868179, "uuid": "f1c57bee-7e6f-4de2-91c0-d4d93aef48a2", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639868179, "uuid": "240abe04-3889-48c4-98ef-4333ee2e2494", "value": "6144:KzshTve85lg2KTzLkvdq0nTUZKz9tyR4kS3K9RKElse+zTMwnqXOjhiEjrFPxoxB:P56uq0nAutyR0K9RK0se+X9PjrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639868179, "uuid": "16c35bf2-6c6b-4ef6-b2f9-9a66572970b2", "value": 406551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639868179, "uuid": "70cb870e-98d4-42ed-98ba-99f1df22b904", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639868179, "uuid": "181bd94b-87e2-4dff-ae9c-0dbf4b1c09db", "value": "f74ce1c29eb241889d61659c5ac3764c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fdde5ba-601e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639844465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844465, "uuid": "e5101767-647a-4bfb-a6be-196ace79e34d", "comment": "Malware payload (Mirai)", "value": "d15259173a5d6f310c5819bc93c5429e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844465, "uuid": "35f867ec-a99c-4762-a6cb-ebeb6a3909c3", "comment": "Malware payload (Mirai)", "value": "b41ff48377bf2efa5ae946d90fda4e32fb4593725d5c5fbd4fe29a8897b63602", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844465, "uuid": "a356e4ce-6fad-46f0-95ad-986c76a2b0ec", "comment": "Malware payload (Mirai)", "value": "feada62ab48212bd79308777d0f646c0a4ef1546", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844465, "uuid": "9ae563e4-44a1-4df2-8e7c-f5b227d2d606", "comment": "Malware payload (Mirai)", "value": "b9417e2630a80648d0e5a9943928ee50bf535c313c5ea554477ff804d63e44499a6b134bf42c82b77ea28ff35fc96bbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844465, "uuid": "9179e71f-5a8d-46cb-b02e-5816a1a01cc4", "value": "T116D2E0AF67B02DD9C99C683EC2BC17E12B88F1D4706E518753144E6C9F9B48A35C98BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844465, "uuid": "812ad9f2-30d1-4494-ae2a-8e1607776fef", "value": "768:OkK4iVidIMh73Kei3fXW60ocXbNQ+rwm+GLWTNpT:OkAVCp3KtPGzrSyjTiNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844465, "uuid": "a4073e00-f826-430c-a11c-9609b2e6aae0", "value": 28804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844465, "uuid": "347b46ce-3313-4a49-a1fe-02e450209f1e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844465, "uuid": "c6f24bba-9951-4637-bc63-f7c2f5d76285", "value": "d15259173a5d6f310c5819bc93c5429e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172fe82c-5fdf-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639817231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817231, "uuid": "7c78da1b-1946-48c7-b507-a42c0ad22d91", "comment": "Malware payload (AgentTesla)", "value": "54e110fe274b5ac06e16a8210934445e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817231, "uuid": "f28fbb23-65fa-468f-a9c0-e46ef4d3c2f2", "comment": "Malware payload (AgentTesla)", "value": "b4c6049ded3b703e476b804da2eb2cc5b988d9de0cd49861a087f7a51e88dc45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817231, "uuid": "21db82ae-cd99-4bc3-b924-7afb7bda957c", "comment": "Malware payload (AgentTesla)", "value": "875938df76bf0e67f8f8622c82f3c0b1010d4a53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817231, "uuid": "832f7a4a-9dc3-4e6f-a497-0ba728516bcc", "comment": "Malware payload (AgentTesla)", "value": "5804d4bd9baf4498dd5bba7622e71aa7106833188331243882ca696988cd7a936402d28ddb0f9c3c49b1c0a96d6e33ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817231, "uuid": "d30c5b05-13fd-4228-9329-774bdd0d4303", "value": "T1D3356BB121C1F54073D868A8385427ECBDA5ED6BABDC795C57E0840DB07347889ECBAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817231, "uuid": "bc129e4e-81df-4365-b0cb-c159287ea74a", "value": "24576:16pcOei9UgfCZ+je/uSLibjzurjvRBAPhbbLnlti:16J92aKUad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817231, "uuid": "0ec42c6e-5dc3-46e8-b1ac-eb4eb1fd9828", "value": 1134893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817231, "uuid": "de8ae163-faff-4774-8c0f-73aa4f9eabed", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817231, "uuid": "3383e463-dfa5-418c-9769-dd89666aa80b", "value": "Agreement documents and passport.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c42b9b7-6054-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639867598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867598, "uuid": "a673662b-5f1e-4d00-abbe-a0fff97e1542", "comment": "Malware payload (Mirai)", "value": "90ee8affe7aff19c88744c41617f5a0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867598, "uuid": "6b352a7d-5e1d-46d5-b39b-977d119e4c4f", "comment": "Malware payload (Mirai)", "value": "b651ed87db612abb40d8cd0f012db4bcbc95b613e776216909778d2e68d49c25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867598, "uuid": "66cd1960-fdbd-4dd4-a1e0-b3cb820912a4", "comment": "Malware payload (Mirai)", "value": "e0f2552eaca6222f2121d12aee4956c0c954681c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867598, "uuid": "0f6f0e55-3e76-44e3-809e-23585e04c192", "comment": "Malware payload (Mirai)", "value": "0eb063b7f10e579d070c5427a01f57d2d6edcc352bc2a36cf91aa6b860c9b02a7010bafa5b1537103b73a8fcebb2a01f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867598, "uuid": "57ec8597-dcdd-4ad6-8044-53341cec7b53", "value": "T11FC3C63B67170E23C0CA50B101E34332AEB5DF9734B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867598, "uuid": "9f17a54f-eefd-495b-bec8-d2799597ef93", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqP5a7Cxmm/QMurB12CGNb:SMQplV5nmm/QMurB12CGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639867598, "uuid": "c915be65-7119-4b0b-a548-3b039a1bfb36", "value": 129857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639867598, "uuid": "94d46595-4cd1-4d6d-aacc-8ff89ced4a92", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867598, "uuid": "c3547876-20b3-484e-8661-68408ea8155d", "value": "90ee8affe7aff19c88744c41617f5a0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d63fce7-6022-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639845991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845991, "uuid": "3f8afe0e-f36f-4a6a-91af-09afa9fd876d", "comment": "Malware payload (RedLineStealer)", "value": "a866c999eb054a42ea85a0df687b5d22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845991, "uuid": "f831ba68-bcfb-49ec-b3d5-753694b42461", "comment": "Malware payload (RedLineStealer)", "value": "b668d45c603ef18812ef9499d69585ac8b35f2cf6b3096b8eabada8b66dad075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845991, "uuid": "f5165dfe-91e0-4e30-a914-1f20dd8e44ec", "comment": "Malware payload (RedLineStealer)", "value": "02e5cda20d85bc498556e3e4471bc6f3f330988f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845991, "uuid": "f6aff209-5ed6-402e-a24d-35fdac480284", "comment": "Malware payload (RedLineStealer)", "value": "aada042d49813eae7e3f4c8b5185bfc12db59146b65b0f4c805a02af7d11eb0ece1a8d4445a5d675e9cf3151264e9ef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845991, "uuid": "e503abb1-1ca8-4ea6-809d-4be77b66257b", "value": "T10484DF00BBE0D034F5B752F849B6D3ACB63E7AA15B60A0CB12D426EA5775AD0DD3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845991, "uuid": "67f21f64-3c58-4e35-9582-0224b502d105", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845991, "uuid": "52e68009-d0a8-43af-a7cc-154c17732b86", "value": "6144:kexzTwaVLQ5CcQXJsa6OyPE9SXVk1BQ4X+OZd7vniBqJWBxZL2:kexQaVIClsa6OyKSXVkXQ4X+cJ+qJW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639845991, "uuid": "c8896d1c-7723-4d25-81e4-9d80155f47b9", "value": 406056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639845991, "uuid": "90cb74fc-4a54-404f-b301-d7deef33c804", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845991, "uuid": "d6abb41f-7530-4d66-a392-36ad90fe67f1", "value": "a866c999eb054a42ea85a0df687b5d22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c94fd8-600d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639837301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837301, "uuid": "64566d91-db48-4fa0-851b-20a46a047ffa", "comment": "Malware payload (RedLineStealer)", "value": "fdc6e508f5dfac76f3c1ff729ccd9034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837301, "uuid": "edd35f88-9278-4378-84e7-e403b8ba8c1c", "comment": "Malware payload (RedLineStealer)", "value": "b78548ed80db0c4eca0593f6788ec7723e51f27fb79145a5292d201b3ed23e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837301, "uuid": "d2810261-21c6-4b6d-8b1d-6c015ed98f5d", "comment": "Malware payload (RedLineStealer)", "value": "ca751d48898f1a7ef9030677efea12a4d9e5316c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639837301, "uuid": "f5a507a7-9bb0-4066-9452-5aea38aa4370", "comment": "Malware payload (RedLineStealer)", "value": "daea696ecbe22f1de5fe1862fdaa09c590540a8a0853f8a72d01007731b3d753195a3549b7a6e35f1ed7a1942c9aeb5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837301, "uuid": "c803e568-5562-4b73-9863-6d765e2cd6af", "value": "T18894DF00ABE0C034F5B752F449B6D3ADB63E79A21B7494CF62D456EA4634AE0EC32357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837301, "uuid": "6d236f2e-4675-49ec-9abc-90a6f7ebd8e3", "value": "97510e08b27860260a6b4085182271af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837301, "uuid": "4c32430e-782f-47ec-8866-ea040937e222", "value": "6144:G/H4UvwYogRhavtZSh7URusIGG+xdWnPbc4dtHMWJn:mYDQwVMh4IGG+xdWDc4dtHFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639837301, "uuid": "e8270d37-0a08-40a8-bc3f-750ecadbe897", "value": 419846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639837301, "uuid": "04c9c993-a3d8-42e6-a0df-d09f97117595", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639837301, "uuid": "1bbf6e0a-fc41-4db7-ab35-8277876daa69", "value": "fdc6e508f5dfac76f3c1ff729ccd9034.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a538b0c2-5f9f-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639789981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789981, "uuid": "a1b0ec61-1ebc-4627-840e-3a0e3c74a95f", "comment": "Malware payload (AveMariaRAT)", "value": "1a636ecdc2916959d3274a9eaeac5e03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789981, "uuid": "b8e2658c-609b-4b61-83bb-d527334e1d29", "comment": "Malware payload (AveMariaRAT)", "value": "b85694f437421dc352691a808ea809d853112af168854a8f5fa7add791f1656e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789981, "uuid": "511629b7-55ff-4787-9867-d1ccb07d951e", "comment": "Malware payload (AveMariaRAT)", "value": "c496b081a9867d5789e2c8434924f410642b2b75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789981, "uuid": "db7293c5-9171-424d-9fc4-f87c5ca5e6d8", "comment": "Malware payload (AveMariaRAT)", "value": "49f75453834bed724f60665d856090ebfcd4c54d21cfa65ed5535261fe5d3dbd0cd3a70d78d76f96927d960777c977e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789981, "uuid": "97f91f9e-a14f-425b-b7bb-26121e73d20e", "value": "T145652B60A3A51111E597A77F73A08B90C8AE3C409D6E97CF4E460AD6CA3D2F479087F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789981, "uuid": "08e02d03-4d0f-4911-a74c-65ae3707fe82", "value": "94f6bec6c84332e1dd4bb2feb01e6131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789981, "uuid": "7c3da52a-069c-4b5e-9815-fa502bf1b2e4", "value": "12288:Vwp6fK786QaQN3wbnm3D4pa7+oivBpgO:VS67wbnmcvDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639789981, "uuid": "111cd850-eb4c-4301-8a2d-3826358b50c5", "value": 1532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639789981, "uuid": "035a3853-7e38-44c3-9ac8-d5e6d2e14867", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789981, "uuid": "6bed2dd7-aaf2-412f-8fc4-ca45c00dd18c", "value": "1a636ecdc2916959d3274a9eaeac5e03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b323b2-5fe2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639818807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818807, "uuid": "68607436-18e1-4a0d-bdbe-15995728bc16", "comment": "Malware payload (Mirai)", "value": "0bea0cd0bf5d2017494aa7d3f9f30d85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818807, "uuid": "52a1a767-c8fe-4889-99f4-4858252377a6", "comment": "Malware payload (Mirai)", "value": "bad9d7a02e47fbec442a7e9f19dace199f77ebe181f5d599c1423a834a4e06f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818807, "uuid": "c8c98267-c955-429a-90ab-0760dc556e43", "comment": "Malware payload (Mirai)", "value": "ad955dec0866b39d539d9dc6e3471c9ac3e0ef56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818807, "uuid": "2dd64f99-ee6b-4edf-81b9-ae786f04c929", "comment": "Malware payload (Mirai)", "value": "e68c38d2db81be835890af4ac4e1a9c2f894f50690cbd36d248128fe5a9fc1db0668b9a9302b7b15ece8c414ced890e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818807, "uuid": "e622555c-85d3-4bf6-afd3-31897de53028", "value": "T1D983F89278C29A16C6E423BBFA7E018D332567A8D2DF32179C212F1577C981F0DB7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818807, "uuid": "1758d86b-c53c-44ea-a2b4-abfb887865db", "value": "1536:ssCvlPf6NDyL9Jb0+pHXlzPhha0xT45wn6ahWNrTRKW57nHM35njC:ssCvlPCuTxCwn1hikWC3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639818807, "uuid": "d81881d0-24b8-4e66-bcf5-58c5d8aaac35", "value": 82940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639818807, "uuid": "4db65946-55eb-4cb5-88f7-4e04d9979c0f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818807, "uuid": "91c1e67e-87ef-43c5-a606-440996f44529", "value": "0bea0cd0bf5d2017494aa7d3f9f30d85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e0ca72-6029-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639848991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639848991, "uuid": "a17b1d23-86f8-48f9-ad9c-69131f849025", "comment": "Malware payload (RedLineStealer)", "value": "a22e5f73f08a009eacf5d5eb3d6a5792", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639848991, "uuid": "9cc05e31-321f-4a71-aa98-771238b1599b", "comment": "Malware payload (RedLineStealer)", "value": "bc23463a2be659f023c2752e8fc2749ddb0a79cdd90690e6aadfbaf7878fd1e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639848991, "uuid": "0fb1b225-4363-4713-9cc5-bea8f5c82091", "comment": "Malware payload (RedLineStealer)", "value": "a40938c9ffaae8d23a56dc163b4b84d88256ea19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639848991, "uuid": "abcfcb39-008b-4097-b403-d2f77fc668c5", "comment": "Malware payload (RedLineStealer)", "value": "5febc8552db3dfa1d4dfbdc4ad9cd8e704213151fe5ed98a80e543444c1a0b6ac4f3ccf0ef90514febc3387073747403", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639848991, "uuid": "c794af3f-9139-485b-b4d3-06f349598056", "value": "T19E549E00A7A0D435F0B716F849B993BCA93E79A1AB3590CF11E517EE5635AE0ED3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639848991, "uuid": "fdb30c46-434b-4d54-b6ab-6fb3b5fc8520", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639848991, "uuid": "5ae959d8-24af-40fd-85f8-83c637fd632c", "value": "6144:DNe0NZXnRwnRZmsc5az1SqaBqtmjmfjElHzPfJB:DzhwnRZjc5a5SawlHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639848991, "uuid": "dc5b7ab9-818f-48fa-8ab4-0320f63ed748", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639848991, "uuid": "436656f6-f8bb-49fa-bd8b-59166add3262", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639848991, "uuid": "380bfa7f-dad7-4a65-ab11-5d3da2171557", "value": "a22e5f73f08a009eacf5d5eb3d6a5792.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b8b4b1-5fab-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639795210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639795210, "uuid": "4ec0f1bb-2304-4387-8ecd-0f696d55bff6", "comment": "Malware payload (RedLineStealer)", "value": "a048419bbecd8baf3e9620c51a19dcb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639795210, "uuid": "5ccbcbd3-2a30-4e1f-91ee-7d392640e94a", "comment": "Malware payload (RedLineStealer)", "value": "bc568026a968ebfed5e7fc53d59e57f36925ee31670480b466bdc4f9dc38c39b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639795210, "uuid": "2a8181cb-75a2-4543-bc75-9c232e3868e4", "comment": "Malware payload (RedLineStealer)", "value": "468c3e429b559aebb2046a8f3367ea4e52e4d30a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639795210, "uuid": "87521730-9a7d-4ee8-82ae-6ab5c2369f28", "comment": "Malware payload (RedLineStealer)", "value": "b77e93d549bd2348982cbd3263d443eeb4e22b9643b6f8f9cd12a7f97cefe1d2aade96be6b5123a32f85b7cd1ecc5018", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639795210, "uuid": "f6745a3f-82b3-4a98-8c48-a8dfbdbd1c54", "value": "T1D7058DC1E394D155F0B349B248B39D7261B7767C957E8A2A21DC733A2BE7391003AF26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639795210, "uuid": "dfa9106a-8499-4600-9c05-32170d31e8bf", "value": "75afc1059bfe56b0afb3bd2b843c8e59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639795210, "uuid": "f1dbf400-81f9-4f70-9b2b-f2840b872fce", "value": "12288:jOHN/8nd+1ChUd+9XT2Y90rMB3FOqx458xe6pNOeG:jxnd3fKfiVfS583b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639795210, "uuid": "506fd4ad-b832-4399-8456-b2e0d744fff1", "value": 806256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639795210, "uuid": "8c0d20b9-d540-4fbe-8a2a-d7016deaab7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639795210, "uuid": "a35bd44d-9f72-4603-a52c-bcd5d5cf83b0", "value": "a048419bbecd8baf3e9620c51a19dcb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db19ed72-5f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1639789213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789213, "uuid": "8520fc69-288a-49e0-bbce-d912d3dc1db6", "comment": "Malware payload (Amadey)", "value": "0aa19ef5e1ac47d2c4cdfbff90550947", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789213, "uuid": "f052adc2-a7d9-44fe-b516-f2a21638d44f", "comment": "Malware payload (Amadey)", "value": "bd1ae8b23302a17ef00d7a83024b0d7bcef71a279e98790b60a87c0981ac6ed5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789213, "uuid": "e7bc06e1-b3c0-4ac7-bbf5-a453ba6407b3", "comment": "Malware payload (Amadey)", "value": "fead44012dba08d02ddac462b9f2b5c5d16b0c20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789213, "uuid": "7a56b70e-b38d-4d33-b6a5-d654d28bc2d7", "comment": "Malware payload (Amadey)", "value": "6c012b151a0427398440f3e1dab37bcc6711f219bf9e6f45fa82d9f5e8998eb45a6ea77f3c80ce906c75bbf103cad8f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789213, "uuid": "041001b2-e1d5-42b0-a396-0ec5b064b150", "value": "T17F34D03535FCC1B3C967163089E48BF56AFEB8625660804F3758172A2F60F9C4AE635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789213, "uuid": "573d7af6-fef7-49fd-8df8-54d4cc883019", "value": "085d4aa5e29579ffcd8f5171fcc76b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789213, "uuid": "b9fdb0b4-a474-4c74-a7f9-91725b012b01", "value": "6144:1LlpRqIEqzPgS2IVXbTUQOgeuzbgwuL7B:15pRqIVPgmlUDunn87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639789213, "uuid": "6eef8626-5a14-499c-8a15-163714b0e3eb", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639789213, "uuid": "b01131e2-ec22-4749-8ff2-8c70ab81db81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789213, "uuid": "efe9bbc9-f607-496b-998a-d879f3ef74b9", "value": "0aa19ef5e1ac47d2c4cdfbff90550947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9abece6d-5fe1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639818311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818311, "uuid": "45410113-d663-484f-85bc-e0e5044aab5d", "comment": "Malware payload (RedLineStealer)", "value": "d5355f64da8998a4011ed7947abf49d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818311, "uuid": "0f7b5445-2bd7-4490-842f-09699eab500a", "comment": "Malware payload (RedLineStealer)", "value": "c4c8179ac2a2be1697ef244e5c8c4e70dd311b0f4a350c6fe1f05ddd69afc1f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818311, "uuid": "0f318f39-89d5-4c74-b314-884cc456465e", "comment": "Malware payload (RedLineStealer)", "value": "882e97e9a71826d7ab129d46992443227eed683d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639818311, "uuid": "04cab77a-405c-4a31-ae18-6a43de35b123", "comment": "Malware payload (RedLineStealer)", "value": "3495afbae0f145636081e548a3c37e75e37e15a1223e60a2f26af0a2c5846a2b67fbac1da50518e3f51bb01c2dee0b82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818311, "uuid": "9aa1bc9a-c992-41a7-9596-37c9f6780daf", "value": "T1DDA4AE2A73848F84EE952DBFE4E3C59403D1E7692372D74ED9BB11A71E033A48C452E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818311, "uuid": "16fadeaa-6e92-4e8c-afc2-4decc1f24d08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818311, "uuid": "59cef09c-fdd2-4c4f-b759-68639bbdcac2", "value": "12288:bdq3DUPK82+0t04dOjbeHDt7Q99frDfX0H4ej07goKzVbc9/rJN:b+XL04dOjbwt7mWH3oKzVbc9/rJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639818311, "uuid": "c0df4145-5297-476c-8575-b190f1b9a53f", "value": 483568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639818311, "uuid": "afa0070b-6855-459e-8dbd-ab391a2c2bf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639818311, "uuid": "9d1e8ac5-2f82-4ff7-b91f-34ae3a1e8cf5", "value": "d5355f64da8998a4011ed7947abf49d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841bba8d-602c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639850485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639850485, "uuid": "a667f8cb-d014-48c2-9367-b5418a02b801", "comment": "Malware payload (RedLineStealer)", "value": "a55309ef0aa5202fc46a2be73e440063", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639850485, "uuid": "fee18000-0ab2-4abd-a7b5-a4ce2b390625", "comment": "Malware payload (RedLineStealer)", "value": "c79ec573e27534ad631aa61bbe6c0e73192cc76333be93f6b418621bce969a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639850485, "uuid": "9ecc584d-b76a-4bf6-9fc5-376cff575bdd", "comment": "Malware payload (RedLineStealer)", "value": "8e70e417a30ed3edbc10a92d77333f6e2b9a2a53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639850485, "uuid": "30176681-9805-46a2-aaa0-5f99db7ef27c", "comment": "Malware payload (RedLineStealer)", "value": "e8d9d4aab22d8b28be272e47b2840a4b4d528cac2d6e5a891bfaca0fbf259d67a987de0c874f88e1ab251bd7e42d588f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639850485, "uuid": "eb4e4c2d-52a2-43a5-b231-1a0d776b372e", "value": "T1AD84D000B7E0D034F1B752F44DB6D3AC7A3E79A26B24A4CB22D516EA5A746E0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639850485, "uuid": "b8506450-8871-4ffd-8fd2-8d0b33e7335f", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639850485, "uuid": "ff678d72-d2c5-4d78-a5ad-16318a6b0063", "value": "6144:KzshTve85lg2KTzLkvdq0nTUZKz9tyR4kS3K9RKElse+zTMwnqXOjhiEjrFPxoxB:P56uq0nAutyR0K9RK0se+X9PjrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639850485, "uuid": "ce213c04-fe6c-4ea4-a754-5679b4589668", "value": 406530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639850485, "uuid": "6ad392d8-d730-499d-996e-69b2361ecb26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639850485, "uuid": "2afb8c2a-c583-4ba0-80b0-9a1dced206e8", "value": "a55309ef0aa5202fc46a2be73e440063.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8961249e-601c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639843622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843622, "uuid": "abbda021-042a-4e6d-8ab3-6a1354deff5f", "comment": "Malware payload (Mirai)", "value": "f22dd9cd383b2b942407e15443477cfd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843622, "uuid": "554f92a0-0ce2-48c1-8d48-3a003eb4e919", "comment": "Malware payload (Mirai)", "value": "cc8312420d37401ad2a33eb20133bbf30b22209b7e6de093b80a18833c473d16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843622, "uuid": "c32ed0b8-a8c4-4c4d-997e-914ceaaf53a9", "comment": "Malware payload (Mirai)", "value": "0656a9c7ec118baa70b30377d546fd70f47b2c3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843622, "uuid": "d397170b-c4c6-47e0-b77d-2c59b1658121", "comment": "Malware payload (Mirai)", "value": "a024dd7eab8e75611a5e0da6c9079a41d13d685252aa3d3ccd9f51ed55a3bab30df3dc46ecbfb24f963ea423ca5672d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843622, "uuid": "a2dfc417-1fc0-465b-b509-17635f01662a", "value": "T1B0F2E1F29B26FCB6C3B67FF2DC791881B069513CA5DF35001E79C878A5944A62AC9813", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843622, "uuid": "16897b92-892d-4149-baad-f572d8dc10ce", "value": "768:mNh95PuNlVTqH85XAqjfysmfywBY4VSH3Nx8OhRkMqBH9q3UEL+eL:mfrufVTvTKsWmIg3NhRKwLtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639843622, "uuid": "8950bb1e-90ae-4c23-a93f-048e277868f4", "value": 37232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639843622, "uuid": "4d7b0a1b-7fff-42c2-871f-0ad68d97a4d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843622, "uuid": "e226d879-59f6-4716-b27e-9930cd569763", "value": "f22dd9cd383b2b942407e15443477cfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ef825f-6038-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639855640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639855640, "uuid": "c688b39b-416b-4baa-9637-65d009b513f3", "comment": "Malware payload (RedLineStealer)", "value": "4110dcff2a685170b204bc2b807f74f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639855640, "uuid": "201c34ff-8009-4afd-a903-6aef55349cc4", "comment": "Malware payload (RedLineStealer)", "value": "ccf6f4f2f94fa5d621425eb1217d17b00f449e372e720ff6f228e21368372bd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639855640, "uuid": "07d586c7-6b88-4672-b1dc-bb2b6ea735bb", "comment": "Malware payload (RedLineStealer)", "value": "57daead18a812fb77fd9456232e14021a17f8db4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639855640, "uuid": "cd5db13c-b475-450d-bb21-7d7b3f95104c", "comment": "Malware payload (RedLineStealer)", "value": "1bd8fbf852a292dbbf93b7edebeded5aa92853c45e94297c6768a4c8f5c8517af3ab53e5130088d7ee1c67669e03bd9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639855640, "uuid": "d330b22d-735c-465f-9d32-5b887a68ae28", "value": "T1A504289C766071DFC86BC8769AA86C74EA60747B830B8253A01756ADDE0D9D7CF180F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639855640, "uuid": "a09de375-d11b-4954-a9c5-972e3cdcfe2f", "value": "3072:toZ6REhNl6+43oOtK5FqQyGo/SHc+zgjhsEVjslJQC5DYO:toZ6REhNe3oiyqQyGo/GfzgSEVjslOg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639855640, "uuid": "7b5ff1a2-744e-4dd7-a8bc-0c8c146ddad7", "value": 187736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639855640, "uuid": "64245c4e-71f6-4e20-9dab-e7018bfc2807", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639855640, "uuid": "0be9f59a-f987-4e54-8efb-b9eaf8da79b0", "value": "4110dcff2a685170b204bc2b807f74f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f803ab-602f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639851703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639851703, "uuid": "80313dd4-1228-43c0-8f8f-595417c29383", "comment": "Malware payload (RedLineStealer)", "value": "b9fab9c37f665fe4f0d46c58a3b0ddd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639851703, "uuid": "85897dad-52e2-4cf5-9d83-33f5629d7a98", "comment": "Malware payload (RedLineStealer)", "value": "cd259bf283f50124dfaf6c384b396a7371f762aa739cc0154757a5d414a809ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639851703, "uuid": "f903f1a2-c407-481c-b62c-40cbaeca468a", "comment": "Malware payload (RedLineStealer)", "value": "55efeced439570360682aa41cd37ee00cf4b5392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639851703, "uuid": "20f972b2-4841-4242-be71-b5f4b2eaf54f", "comment": "Malware payload (RedLineStealer)", "value": "d13885c5ae6f9b2a80b00ef393ee6607f8afa5aa4ffc717af35792d4bdd4175f4e7673e9075b9526a056251013773877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639851703, "uuid": "d654aa1c-12f5-4126-9704-78b091c41df1", "value": "T11D84D000B7E0D034F1B752F44DB6D3AC7A3E79A26B24A4CB22D516EA5A746E0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639851703, "uuid": "c4a13620-b9a3-47de-98b8-38a225d82db7", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639851703, "uuid": "0378f32f-fdf7-4d29-ba46-25f33d20f5a1", "value": "6144:KzshTve85lg2KTzLkvdq0nTUZKz9tyR4kS3K9RKElse+zTMwnqXOjhiEjrFPxoxB:P56uq0nAutyR0K9RK0se+X9PjrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639851703, "uuid": "787ca8e1-66d8-443a-82c5-283c4c94ff0a", "value": 406587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639851703, "uuid": "4c6c46f1-42cc-4656-bd15-9469fe9c26fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639851703, "uuid": "57f1d40e-d36f-48bd-90b7-6ed97ef228d8", "value": "b9fab9c37f665fe4f0d46c58a3b0ddd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74f4d55-5fca-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639808587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808587, "uuid": "013d6056-7f97-4151-9db8-87cbbcd012ae", "comment": "Malware payload (RedLineStealer)", "value": "97d249dbd2a70e5e7fadc85079982409", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808587, "uuid": "d50fdbcc-5f6f-4ec9-a846-77e1266bed7f", "comment": "Malware payload (RedLineStealer)", "value": "cea9aafffaa9c5b5b5b7a2d8245ef6290b2fb58276a79d8fc9cb22facb9cce15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808587, "uuid": "5f54d3cf-a8ca-4690-980a-c1b4963179e2", "comment": "Malware payload (RedLineStealer)", "value": "071e5d8126c8aaa820e08d40d30c100d321aa3b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639808587, "uuid": "c545eec0-6f77-406d-a57c-4d6a4a48f465", "comment": "Malware payload (RedLineStealer)", "value": "1129f415743ff68a11cfd373b68d53ffc7d47196a5078bb25e8a1bfcb0a5ba63e624ad43e89d8f71f609f07f1c01a950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639808587, "uuid": "a2357d72-d6a8-4e8a-9005-5b51c44b39c9", "value": "T128C4E63839EB5019F1B3FF769AE874A69A6FF7633703A55E105003860B13A81DED1639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639808587, "uuid": "efa00dd1-bece-4463-b0bc-50d9e751879f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639808587, "uuid": "df10dc76-9b53-4663-8b7a-d8ea7fab1484", "value": "12288:J1zsGERMan4dnADfSugs4KB31gkzh8o24B:DsfRMm9bShiakS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639808587, "uuid": "fc11c475-ab21-4b5c-8133-dc2c389f79d8", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639808587, "uuid": "9468e0e4-23ca-4192-a036-527538f24182", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639808587, "uuid": "26e7ed49-c36f-43fb-bf9b-ff7dd6244f47", "value": "ForceNitro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0813d389-6029-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639848988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639848988, "uuid": "ef4006dc-f427-46b5-afd8-0761352a9724", "comment": "Malware payload (RedLineStealer)", "value": "174a69ad545688935215ef61ceb0e6cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639848988, "uuid": "5cc5b706-4dc2-4471-bbeb-dceeca8d05ed", "comment": "Malware payload (RedLineStealer)", "value": "d1d8da32bdcfda6a1d10722c39f8db40ef41008f81f6fe5a2dd144f2a3186838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639848988, "uuid": "74870eb9-7a5f-46ac-9656-f6de69dc15d2", "comment": "Malware payload (RedLineStealer)", "value": "d9dfa58e73498301adeb6da9cf3c8aca7a6a1775", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639848988, "uuid": "acc48fca-8a08-4194-996e-7ecdaa0ead44", "comment": "Malware payload (RedLineStealer)", "value": "37d480d009781f7b503c6f274735bbf58a90ef7b0dc7eeb33ed05d86fcb035ce5203de2b3942e007a52fcc87db5b16f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639848988, "uuid": "f4c3f445-a536-43be-ab72-95adb852e78d", "value": "T13C84CF00BBE0D035F5B762F44D7693ADA53E7AA16B34A4CB22C026DA57746E0EC7134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639848988, "uuid": "5db9d7a5-690a-439f-80d9-429bcffdd4a5", "value": "fffb3573e6a31c80ef6af28a69351bf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639848988, "uuid": "977652d1-27ba-4d62-b9a6-5d3f188a0b37", "value": "6144:ibsXkAifDileIs174iSmL+w9gAV38Mv/k+8KEF9qxBZZaD2xRza:8VDile5X6AV38W/k+xzbZZIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639848988, "uuid": "9c7505a0-16cc-4f1d-9735-7d96ac055600", "value": 407079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639848988, "uuid": "05b50cbe-746e-4ec9-b8a7-14c5654dd7ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639848988, "uuid": "8a0352e8-3430-4e26-9937-2646fb5f2d07", "value": "174a69ad545688935215ef61ceb0e6cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d692b8f-601c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639843628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843628, "uuid": "14a64157-455f-4a47-b1c7-9c3d777dad50", "comment": "Malware payload (Mirai)", "value": "19551eb0f89b8bb7044853c7a901867e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843628, "uuid": "98b60c6c-3fa9-410d-8234-3e35df74a663", "comment": "Malware payload (Mirai)", "value": "d2cd72d6f127b6ea7aa0ea91fdaa4e878eb14f84f382d189de9d79cb05faf545", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843628, "uuid": "36f54bcc-400a-4748-8c9e-2dd254bf0962", "comment": "Malware payload (Mirai)", "value": "e918d8cd10b38de7217fc76122df5e2a2a96a774", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843628, "uuid": "f0b667af-072b-444d-b3f7-4d4c39c44b5a", "comment": "Malware payload (Mirai)", "value": "b4d65deb651ee7c0cf3793cabd1bada59a042c982da12231de8dfc66feb40b77e7a457704f26d53f95b6dc704941fa50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843628, "uuid": "b0c82646-a9b1-4f5a-89b0-da27de791407", "value": "T1BFD2E16610D1896FD8BCC2772FF69F1930B60C8A694B9553988DB74EADC20D0A178E25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843628, "uuid": "c78e1e10-ceda-41dd-a82c-10c05db84a27", "value": "768:7zW8UBTZiarzxChpogPxM+VbKiy2yodPBh:XWxnrWogPSLzXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639843628, "uuid": "b5791d06-5aed-4247-b99e-04a9bbbf8b2c", "value": 30852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639843628, "uuid": "6504e01b-c4d4-42ca-ade8-5354f6303bdd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843628, "uuid": "d3631315-c98d-4f1c-a4f2-5614585ba9a1", "value": "19551eb0f89b8bb7044853c7a901867e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce6f6b1-601c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639843654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843654, "uuid": "98f2b90e-f650-45af-a4d8-73fe9075af6b", "comment": "Malware payload (Mirai)", "value": "f56de733190b16041d98760c61a6258a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843654, "uuid": "35fe38de-dd69-48c3-9ac3-bff1c08673ba", "comment": "Malware payload (Mirai)", "value": "d49541d6831919238d634e4350504ff03f6ebdb29fe32b62be006d79dca71939", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843654, "uuid": "39510ec8-8a26-4c56-ae69-946c00bd64ee", "comment": "Malware payload (Mirai)", "value": "57eb913545461b8f5588186358f7545b7d36e435", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843654, "uuid": "472e85a6-473f-4cee-badf-b799d5bc74ea", "comment": "Malware payload (Mirai)", "value": "b6bdee53b0a5b9bc03cc38cd81b5eee8cb95f3f6730a8cb63747e5e494109550a2e8dc6657ad5bb2dfa800b5a78ce9b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843654, "uuid": "9f4b3f65-70e4-4d13-8df9-d970150de980", "value": "T1E2E2E1BFF7D8FDADCAFE443903989AE1AF69B5E0B2FB855863008D443748905B942065", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843654, "uuid": "cae7c120-56d5-4c59-b1c1-1844483e27f0", "value": "768:zrRKG+yWvagn7v4D78CbocQwza273zplEWQ:zEGfmay7v4D78CboG+273zp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639843654, "uuid": "8d9a6ef3-8333-42f6-9b52-ebf2080d7a11", "value": 33988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639843654, "uuid": "0959b8cc-d677-422f-bea0-658fc0d0e1b5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843654, "uuid": "9a07048f-a3cf-4d02-8372-03ae8829eb3a", "value": "f56de733190b16041d98760c61a6258a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25ac8ff-6032-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639853193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639853193, "uuid": "80b04490-d85b-4756-b2ce-a511fc8051f1", "comment": "Malware payload", "value": "df3b5be1c3c37a03698f979b0f83dc8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639853193, "uuid": "ca7a8a61-d2cf-4b1a-9456-64bb23bb6baa", "comment": "Malware payload", "value": "d59a6101adfbe3060622c60cd377d7856974266ed7fac2a657345609b4fa2ad5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639853193, "uuid": "852295bf-7ee0-44f2-8eda-ae04175a4c7c", "comment": "Malware payload", "value": "a645cd87f77d65440be3c76e6e42cf9c2ab9273b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639853193, "uuid": "a06f5169-4993-4b98-86a4-82afdf369a81", "comment": "Malware payload", "value": "0ec8de6a42c5aea6cf40bf528ab845c4545e873f0cc17aa555163b9fab3c26cd4fc7a14a87b7f980b8bc03bb5c845926", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639853193, "uuid": "91ebebc3-75af-47d8-9878-a6f78b6cdc5e", "value": "T160D50182BBE01A0AF25A2A771AFA03109633DF4295C28B0B754DB4174FB1BD51F527B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639853193, "uuid": "8a1effb1-8097-4627-9a09-b62f8cfbed24", "value": "eea4e81bbd38d3acf0856edd3a7877e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639853193, "uuid": "16893c18-c447-4588-9c3c-0ca66fdf10a9", "value": "49152:kAzqGwE0VtqBJwsgmQZz4agivCQzhRpbg59ssSolQdy+:1z0YwGivCQRg5esSuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639853193, "uuid": "f901eb7f-2ffc-458d-b8cb-f0023879e989", "value": 3003392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639853193, "uuid": "24aeff34-1c01-400a-a4ac-75ebdaf26bb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639853193, "uuid": "b9e9e1a2-1d5b-4ee7-bd02-5d8a4ad492b6", "value": "df3b5be1c3c37a03698f979b0f83dc8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04ca6fd-604b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639863900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863900, "uuid": "5f27002e-cc47-40a0-b9d4-1b8d82c0d0bd", "comment": "Malware payload (Mirai)", "value": "05c4a53b6d03b36e54bfb4ded7aa19e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863900, "uuid": "f84f95d3-800f-4cef-a76f-60875350247f", "comment": "Malware payload (Mirai)", "value": "d5d0230d9d1b7275401d7681345fdd96387cb4a38d8128615ecd0e1e17a4143c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863900, "uuid": "7746c0e1-c05b-488b-bbb0-1527a8a3eded", "comment": "Malware payload (Mirai)", "value": "b4f3cacea0187fe81000a0b5bf1ef2974ba46f88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863900, "uuid": "150d4056-8ca4-4190-b024-ca33b6db8ca5", "comment": "Malware payload (Mirai)", "value": "88adc1b5a6b88f2b54740df6bae7db445f1361ffdba4fb7111bc8c171f8c0ff83cadb4b434cbd1c449050a74dc6e5ad8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863900, "uuid": "398b0284-d011-4423-933d-04281a92d997", "value": "T14CA34BE2F904DF7BF40E9F3A04534502B62263E26A889F35A2577C67CEBA1C11967F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863900, "uuid": "e5a9f26c-001b-4067-acbd-7fcf45977e58", "value": "1536:cu7KWv0oLsmsZGw8ONuLv0BXbwCmwvziNIIN3MuUyysn/TTm:+Y0o8GiuAb57wpMuUyysn/TTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639863900, "uuid": "afcbf7e6-801b-4761-b57e-0e6c4829a06c", "value": 98408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639863900, "uuid": "eb806444-501e-4b05-aff9-2909dbe6b519", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863900, "uuid": "55b2b5d0-67d1-430d-ad99-8c8bd9e6aede", "value": "05c4a53b6d03b36e54bfb4ded7aa19e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a847a49-5fdf-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639817236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817236, "uuid": "4c3d309f-8c2d-44aa-9b7b-f03aa25d0443", "comment": "Malware payload (AgentTesla)", "value": "d9812f7c4d27c377bc4d6f9cf8be9151", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817236, "uuid": "dc22a97d-d0b2-4f0f-9c56-34ba598618cc", "comment": "Malware payload (AgentTesla)", "value": "d6dddc53e2cd05043ebdb394f540a1bb2305dd450a441c9605e56087a5b324f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817236, "uuid": "07c678bb-1265-4312-853a-819cc62b2360", "comment": "Malware payload (AgentTesla)", "value": "e9887065d70ed0dfb47774320c098ab8d09350ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817236, "uuid": "d884d837-9d4c-4105-bb55-18b72c8b0df7", "comment": "Malware payload (AgentTesla)", "value": "b555c1a453da61b60c6ff0828afec1a5c34b8df865e04b4fcd39a18e4eddc98ef0501bf94b45d47e25eb2f0182471384", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817236, "uuid": "614d4fbc-7ca5-471f-a7ff-515a245ab66a", "value": "T1E5458BF10145F98542C97CEABC84F7FABC3A9D5B7AA4225C95D0CC0FA15A900CB5CEB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817236, "uuid": "4bb80e4b-0129-41ae-94c7-f9c826d112ce", "value": "24576:FI+bPdtCwRwols0RmDnxhIfpwwiDmpAiNMmy:SqzWxhoFPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817236, "uuid": "7f1fee2d-83c7-473c-bcec-1d8e2c8e356d", "value": 1231136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817236, "uuid": "e467dc1d-669c-4886-b616-fd84666d9afe", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817236, "uuid": "3d123e99-595d-42cd-bdf5-b80d2278ad14", "value": "Copies of documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4126b499-601f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639844789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844789, "uuid": "8066dbb5-ec07-468b-9510-7eb3d534dc5d", "comment": "Malware payload (RedLineStealer)", "value": "648778b73f45379e0fcae1db749964c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844789, "uuid": "55714338-56b0-4d02-ae94-6cd9fb560c72", "comment": "Malware payload (RedLineStealer)", "value": "d73125d9410206b309952ace95e02552e36cf21df1875f5685eb5ac2b84db10a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844789, "uuid": "c6efc3f4-8e61-4ea2-86fa-b71e7e6dd8f5", "comment": "Malware payload (RedLineStealer)", "value": "721fb6c52cdaa8906463cf45edd4146a77cbd14a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844789, "uuid": "723f3b59-5a6c-49b7-a7aa-7409770cc462", "comment": "Malware payload (RedLineStealer)", "value": "870ba9ebd5b569a01e91bc83b56a2fcceaaafea5b25de6455d2d7ee4d7fda81dca0c7306ddeb3f638c13e22e4e1543ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844789, "uuid": "a2aa42be-a790-4a68-a1db-0a306b8ea15f", "value": "T17084DF00BBE0D034F5B752F849B6D3ACB63E7AA15B60A0CB12D426EA5775AD0DD3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844789, "uuid": "0afde6d4-d864-45c6-8913-05e26bc2aa2e", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844789, "uuid": "9239e2b0-bc4f-461c-aff0-8c1cc545be91", "value": "6144:kexzTwaVLQ5CcQXJsa6OyPE9SXVk1BQ4X+OZd7vniBqJWBxZL2:kexQaVIClsa6OyKSXVkXQ4X+cJ+qJW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844789, "uuid": "49ab3bf9-69b1-46a0-9b7e-a0b28a080ee2", "value": 406077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844789, "uuid": "454c7b43-82fc-41d8-9cd1-bff62966b813", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844789, "uuid": "b2c0151b-1157-4d0f-a0c5-96b9fcc61177", "value": "d73125d9410206b309952ace95e02552e36cf21df1875.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a564a83-6020-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639845234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845234, "uuid": "d686cb7f-acd0-4416-8ffc-ec6a471d7a07", "comment": "Malware payload (Mirai)", "value": "60d99ec5014c7d57f89ced07ed2eb228", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845234, "uuid": "4779e989-219d-4422-b1ff-654e8886eece", "comment": "Malware payload (Mirai)", "value": "d76c1b55b0a80ce326f4cbe003f0ee3a86f66cf219067213f2d6308c0cc86a97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845234, "uuid": "6eb48109-9355-49b8-9916-4894c98578f4", "comment": "Malware payload (Mirai)", "value": "f04d7dce157d24337957b9fa062dd40e55cc6882", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639845234, "uuid": "e3711f49-8d43-461b-a860-870ee67b7dab", "comment": "Malware payload (Mirai)", "value": "1c8b6bc4c347257f415be24ef3c4afd3f9099da5ad72aa034db3bbe809b18da8d40567a5555b03106f82ca4e34c13373", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845234, "uuid": "2ffccc86-c8d4-45b7-a55e-df0e62cc47dc", "value": "T1D533F1DA1C616094CCDA3C37BA2584CFE319EAF4F1F5F37823741A057BA2A8A45E0557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845234, "uuid": "1887263a-efcd-440e-b404-7cdcbee4ba17", "value": "1536:ZRG0CxM2HNcrbzjJtZxfE2MtDHGwCtbQvO:bG0CG2HNcrbvJrxfEDhHGJQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639845234, "uuid": "c52d9317-b4a3-434d-8091-04fa255c1897", "value": 54292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639845234, "uuid": "341ffdda-c13a-4dcf-9352-6984e8d81dda", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639845234, "uuid": "6539bc24-c4a9-4ffa-8403-40944c710dbf", "value": "60d99ec5014c7d57f89ced07ed2eb228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2c377b-6054-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639867624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867624, "uuid": "b7c68f8f-6ae2-4adf-bd58-78df09c1a358", "comment": "Malware payload (Mirai)", "value": "231c362b8eea8643ce572827e57b8789", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867624, "uuid": "9d5150ae-926b-476c-b99a-0603a982a0d5", "comment": "Malware payload (Mirai)", "value": "d79e9cee767ce8771d739dfa2efe18e7b5f4289142fa62898ddb8d05910be88c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867624, "uuid": "364c26a7-605e-4827-a00b-6d3ac560fcbf", "comment": "Malware payload (Mirai)", "value": "181e05a1c86eb0c222d7b94852e7ca1995d87718", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867624, "uuid": "39aca86f-2f0f-49c8-8b20-162dc9741a07", "comment": "Malware payload (Mirai)", "value": "0a9628a2afb82c7407316c25cf0c986fc9cfa928741e46e5249279f307c166ea76a0ad0b7345ce243f1389010fb08f1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867624, "uuid": "e5bc14f0-1470-4ca2-874b-8b0356bd7774", "value": "T110D34B86EA408A13C0D51B77FAEF41493322D754E3DB73068D189FB43F86A9E4E63649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867624, "uuid": "f88faa62-80aa-4bf7-8752-76b2be123113", "value": "3072:WxxUsEen+GYY5ORnauzS9mrsplDKZUuQBKXAVanwX+F8JyvdlhLIgtHfsjJNxe+n:WxxUsEen+GYY5ORnawS9mrsplDKZUuQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639867624, "uuid": "0395dc7b-df0a-4082-b371-047e7183d0e7", "value": 142651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639867624, "uuid": "75c0426a-d0eb-439d-b389-dde08faaaed3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867624, "uuid": "99c35ae9-e34c-4939-a4f5-6fccd857a3d0", "value": "231c362b8eea8643ce572827e57b8789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f58550-6054-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639867616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867616, "uuid": "e6ab53e2-c0c5-4e85-8579-71db4867446e", "comment": "Malware payload (Mirai)", "value": "53e060abcc78b41d9d89661180f9408d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867616, "uuid": "5ff3afa0-1b2a-4d8e-9961-73b274be9336", "comment": "Malware payload (Mirai)", "value": "d7cbc23e0e78fb7586879e8de58e4e160b9327c6372509ff5734be3f7456a406", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867616, "uuid": "10c48167-d8e3-4bdd-b3a6-ad4939878037", "comment": "Malware payload (Mirai)", "value": "b17e107334ded3f9b38c3e423645898287c78725", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639867616, "uuid": "402087c1-49b7-45ff-9c77-90ad6f536c09", "comment": "Malware payload (Mirai)", "value": "603ad4fbc7adad5db8d1abf6b49f074ddafe1796770a42c635de4dcd441f0cd487a7fe9425878ef3ccb1a5ff2a1119ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867616, "uuid": "5af44f44-2aac-4c7b-a34f-30e266e0e034", "value": "T1BFE32A34D4504B17C2C213FAA69E825E3F321F9793DB33115738BAB41FE279A1E69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867616, "uuid": "06481d70-e5aa-4221-8fd6-7ca08d5630b1", "value": "3072:Cv/WwsLgaq353qHiCOvhOpKqbDQHbe1UkmhxQwoVZUNu:KPLaq351hOpKqbL1UkmhxQwoVZUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639867616, "uuid": "9995a560-2762-46ab-abce-28ad504bafeb", "value": 143020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639867616, "uuid": "d7fba5bd-d9a5-4465-843f-d92d006ab9f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639867616, "uuid": "050af00c-b798-44ea-bda7-3c7d97c3b5db", "value": "53e060abcc78b41d9d89661180f9408d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e210ef9-600d-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639836972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836972, "uuid": "327daef3-afda-4ec1-a627-93a87744df69", "comment": "Malware payload (CoinMiner)", "value": "3779a744b829ab9dd65057e98c04629f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836972, "uuid": "aa24924f-c535-4b08-8f0b-838c859f149c", "comment": "Malware payload (CoinMiner)", "value": "da14558a1df6f28f8968e5c387dc818c4c1f73d18ae6ffe47aa4f786cf98a013", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836972, "uuid": "f05cacaa-213d-4630-ae32-ba6332861ccf", "comment": "Malware payload (CoinMiner)", "value": "a7ea8ee25c2b3c20eea03254e968987180e7ea7f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836972, "uuid": "29adde2d-cfae-400e-b420-aad07f4ace2f", "comment": "Malware payload (CoinMiner)", "value": "148e7be188d81c7b0cbc9da0a3fbb3962c9b87c83d14b7fc49fe0bf13e6143d8e38f4ac2c4e6c4ac8b3a48af08e876aa", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836972, "uuid": "08831d23-d0e3-44a6-a457-69a8e35ddbfe", "value": "T102649D00ABE0D434F5BB12F84A76D3E9653EB9A26B35A0CF52D516EE16386E5DC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836972, "uuid": "8ed8fc8e-4e41-43ce-a32d-e725b066bb46", "value": "cd2e8aca313b88a16bc7b305a3f26143", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836972, "uuid": "73e011e9-1314-4b13-899c-ed4d8b2625ee", "value": "3072:cf0Jtx7yWXPo4l/BD85Z40Kz+KJDIQ5+sUeRYVJcqlgWOgM66BL5brz0B6FWDnB:cYp/Tz+7Q57GVJcqSEM66x5aNnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639836972, "uuid": "04560df6-b093-4c74-aa76-1822119d705d", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639836972, "uuid": "8770eae0-a6ed-4d9a-9eed-6e78bec80d45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836972, "uuid": "4e677cd8-de89-436d-a3c8-607af892a56a", "value": "3779a744b829ab9dd65057e98c04629f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ea98dd-601a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639842603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842603, "uuid": "7e742b9a-cfe0-410c-a108-2928232a9265", "comment": "Malware payload (Gafgyt)", "value": "bf3f4a7f922e5756e6e35e656a6e33ac", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842603, "uuid": "e1fe7036-b2c4-4549-a1a2-83cd4949e997", "comment": "Malware payload (Gafgyt)", "value": "dc3256f4aee90ae53b10650e49aac5f4e821603fb32e5a72b26d6591a4769cae", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842603, "uuid": "92f9b966-aacc-47c1-baa6-59bb7f77753d", "comment": "Malware payload (Gafgyt)", "value": "9fd66ce34e6131b9699b3f8776c55164fbb98be7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639842603, "uuid": "8e929940-8700-430f-b2d0-bd9d09b262ec", "comment": "Malware payload (Gafgyt)", "value": "cba7cab871e6d96e395b1b8efe88da67531c0a98fa2fab28789b95f52db79b0a10cc81cf3a24b60fd3dd29cbc090a794", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842603, "uuid": "6fb09bb8-505e-47a9-bc58-ef6b450cad46", "value": "T11CD2E1F9C1DFE483D6BA8071184EB6468920AB0AB2D45B1777DD25F1CC32B553B6C20B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842603, "uuid": "8d0f9e42-71ff-4fff-9e3d-e964f775ea5b", "value": "768:WVpz1gU7EA6nyENgkfHd6Ujw9Iv6HadB517PFFBJnbnbcuyD7Ub/2p:ct2IEAoikf9rjw9Iv6qB51RFBJbnouyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639842603, "uuid": "99deba0d-3371-414a-9e8b-52825ef1cdf4", "value": 30128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639842603, "uuid": "1fbc8d74-1a21-4202-b0b7-c1e5fe78b9f0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639842603, "uuid": "66cb8200-f5c4-4380-9cca-6af64dff2e72", "value": "Fourloko.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d271c72-5fdf-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1639817348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817348, "uuid": "396a2dc5-56bd-4435-a795-85c08eb21871", "comment": "Malware payload (STRRAT)", "value": "94c7b2d865bde2640f25675a1c4f6505", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817348, "uuid": "8c6c5a62-824e-404f-b228-b38f8cdb6698", "comment": "Malware payload (STRRAT)", "value": "dd3b94cbb244bf2e3ee0154ad78e2d352af3fd95a976abe5f5f3f2d4d630a873", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817348, "uuid": "7dab7dde-3e3a-478b-82a5-e5ab11bc128c", "comment": "Malware payload (STRRAT)", "value": "9d535b02ae1babcf0a0f15c2925b4b8a0ba02ba9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817348, "uuid": "e9191c4e-5bdc-4a78-a1c2-be9efc9d3e97", "comment": "Malware payload (STRRAT)", "value": "7d94af7be2cb1a28becda974ca1b9e77bd0128bf0e467c985f6ddabe4dd5f711c0377d694262f0f5c079426ba465d14a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817348, "uuid": "eb732d0e-0e86-4f50-859b-423784a1128f", "value": "T19CA3CE1B3EAAC3F9E157A47290448237E61D5B98D08DE11B2EFD14870971C6E4B26ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817348, "uuid": "5e0cb144-90b8-47e4-865e-a2f240b4fdc9", "value": "1536:GhTJFGS7/AbQvRYkN3AYJLCYY5X5vAFVxxJ5nukEqEuKtsmuegVvKXDH:GhTjTQ4lAYpe5X5v0VbJ5uzBdKmudG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817348, "uuid": "57365752-1ad6-4f1a-abac-722a57e96fd4", "value": 97721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817348, "uuid": "aebf4138-1f7a-45ac-b9ee-58b15b607b51", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817348, "uuid": "67329071-d02c-4ddc-8502-7876059067cb", "value": "SHIPPING DOCUMENTS_00298761 PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf7110f-603e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639858041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639858041, "uuid": "e1844139-c7bf-47fe-baf7-05ea1d20a80d", "comment": "Malware payload (Mirai)", "value": "6935cdec487b21fd055018a3d73bb47c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639858041, "uuid": "6dc4ed56-f484-49c8-b651-1c578cdbbac0", "comment": "Malware payload (Mirai)", "value": "df7cf61d92a3f3e3b1d13c54d604d7b462afee5722ac562a93edfbbec9495ec7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639858041, "uuid": "f7a36563-2750-4ec0-8110-cc59d15c254b", "comment": "Malware payload (Mirai)", "value": "51d48d474eb19c0a7a169af4e82a5955c3c41b48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639858041, "uuid": "d77e8972-0b53-483c-8486-99af2b71f74f", "comment": "Malware payload (Mirai)", "value": "8288b47df7b58e72765ea2454516ea1bbe020871600d1189ddfdcbf2034ef6fd70b2478ec366df85cda1c6c12bdafb91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639858041, "uuid": "7ffedf3f-c23f-41a1-8abb-a769d6788400", "value": "T1FEC30905E8418B23C2D267BBFB8E478E3B3657986FD7331256296DB02F817582E3D550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639858041, "uuid": "9a08ea46-1fe3-4abf-a22d-be4522b96083", "value": "3072:6HrkzVS/eYe5S0L52jrp++OoPsqo9A5hGvet2xp782E5QInMqEi/M:2rySO79A5hGvetk782E5QInMqEi/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639858041, "uuid": "36a947e4-e4d9-4a93-94e1-2cab7c9c1af5", "value": 124042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639858041, "uuid": "85e4fd53-2b21-4d46-9fab-1ffe5e58d548", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639858041, "uuid": "8b66b74b-3afe-4f94-b1f9-2bba43536aa8", "value": "6935cdec487b21fd055018a3d73bb47c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cff454-600c-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639836663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836663, "uuid": "56e78ab4-6595-48f3-a466-2e053fcb3faf", "comment": "Malware payload (CoinMiner)", "value": "9261ec807dc6965583568535f281f45b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836663, "uuid": "ee6c06b0-0278-44ba-b82c-08d7a3881a08", "comment": "Malware payload (CoinMiner)", "value": "e09146461b767fdaa708438838c86eaf760151ce43cbd33e97b2aae278c762a5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836663, "uuid": "3d27098c-d2c6-459e-b709-b04ee47a51c7", "comment": "Malware payload (CoinMiner)", "value": "831680c0af96148b161b11a08b449b9191d85eec", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836663, "uuid": "28622fb5-fd18-4bb9-8558-c6a6155aac6f", "comment": "Malware payload (CoinMiner)", "value": "735ff26224facfe95fe76404fc25a95b4ee44c15948a0e6035ae1dabd674faeb90526e0ce556bc0cba50832c27bb2ed4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836663, "uuid": "1bbb8265-45ef-46c8-a8e4-146d7066e2f3", "value": "T1F964AE0077A0D435F6BB12F449B697AE753EB9A16B74A1CB22C516EE17386E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836663, "uuid": "cb943af6-cc26-4c2a-8b3b-5933b18c4825", "value": "4ee83624426d72301d5dc28b390adabc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836663, "uuid": "cd671495-8860-40ca-88a2-987f41391cca", "value": "3072:OQ07DF7y9dewTmNuMhsiY3m/gpCXkoZ6W31wFiVc7hHBAypss/bHm2Gt0mfSDnx0:OETmNRE3m/QG1wFiV6zAypz/LG/fsnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639836663, "uuid": "1f29b258-e2f3-45bb-94de-845d683bce62", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639836663, "uuid": "3fdf02f5-22bb-427c-aa88-64866423170a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836663, "uuid": "a3071545-f891-4b52-b555-1b20aabdfae9", "value": "9261ec807dc6965583568535f281f45b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d027cdb5-5f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639789194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789194, "uuid": "40b1b933-61c0-4493-9734-eea010e54ed2", "comment": "Malware payload (RedLineStealer)", "value": "56bb69a2de8224733abcefa700d4cc86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789194, "uuid": "8c3cbf72-53d0-4da0-a242-4f551feea9fb", "comment": "Malware payload (RedLineStealer)", "value": "e237102ecce153410e4609db0ec5986e2d874a5efe4c9ace10bd419e80dce974", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789194, "uuid": "b39cad4a-b8fe-4da8-bcd1-591e501a6cb6", "comment": "Malware payload (RedLineStealer)", "value": "86903bd0a87a29f902b188f38d7aa6cbbcb87127", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789194, "uuid": "d3e4d6ef-a937-44c9-bc39-a02285f8e898", "comment": "Malware payload (RedLineStealer)", "value": "f5ff835ccc111ae6a8842644bbfc5e4aa80c6b161ee52ff7206c7f8e02ee364e547063e0273988a42793bc2bb9ba0b19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789194, "uuid": "927a1790-bb7c-47cd-860f-d621c531a5c7", "value": "T1B51633D69AC0A71EF70972789D604F7BC94243C623EF641655BB80C2DB082BDA79173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789194, "uuid": "1d312453-a5af-4476-8665-46ce1c10dbea", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789194, "uuid": "b0516b61-21bd-48ea-b465-d1f448e9a403", "value": "98304:OkKq6Xnt//o1ZNkr5nTAJXyqEwdc+BMXRFGCQWpiKgPtSM+Tg+epokUw:cq6Xh/OLkxAlyqE+spQWpiKl1PeikUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639789194, "uuid": "41f4b664-ffde-4c7e-9dc7-8aefed970a78", "value": 4409736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639789194, "uuid": "c2fa8235-d12d-427a-b6dd-448ec5e0d9e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789194, "uuid": "f590f6ee-96c1-4dc0-b793-44d3e1711dc9", "value": "56bb69a2de8224733abcefa700d4cc86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80409f8b-5fd6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639813542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813542, "uuid": "0534b794-2ca5-4561-95e0-98ba5316510f", "comment": "Malware payload (RedLineStealer)", "value": "6a9b6ed7dd36fa89c1d9889995e1183d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813542, "uuid": "9f31cc58-830f-40fd-a29a-ff3646859ea3", "comment": "Malware payload (RedLineStealer)", "value": "e35c69fa5d52a1295092a91cb40fb471065619521830af3e5410107536aab19d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813542, "uuid": "712dac57-a6b0-4284-8fe6-b2d2d987e92c", "comment": "Malware payload (RedLineStealer)", "value": "e80253ab891634f2335b3cdc205f34fcbf42782a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639813542, "uuid": "23dfdf53-a02d-45f1-aa3c-13f4c2175289", "comment": "Malware payload (RedLineStealer)", "value": "e93581d561d90290a52f6aad18ba03384a1cec485d4d35da597c27f1144f6e48788ccd3b49a39fdb1d1d1d52cecd62dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813542, "uuid": "36c695d3-8eca-4698-95bf-7bc38cd41d38", "value": "T1A264AF0077E0D835F4B752F449BAD3AD653EB9A16B64A1CB62D416EE0738AE0EC71307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813542, "uuid": "81309fe8-900e-4404-a521-a762cd992505", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813542, "uuid": "30bd1f32-fcb1-45e0-bf25-052a08e8888c", "value": "6144:jNKmVNq6TX00WMlSJK1uE+OGfBM5c1gJkn:YmXq6OMlgK1uE+OqM5c1ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639813542, "uuid": "976b99a7-1b5f-484d-8988-1660da88e71b", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639813542, "uuid": "48c0a3ce-800b-40d8-96fa-4412e8c29900", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639813542, "uuid": "5f9cae07-11d5-4dba-ae1e-4f3592d6a889", "value": "6a9b6ed7dd36fa89c1d9889995e1183d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237f0b61-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639843880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843880, "uuid": "8757853a-d91c-41b6-87de-4a2f0bb37490", "comment": "Malware payload (RedLineStealer)", "value": "80d47ef91c941852d71bd34d4eefecd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843880, "uuid": "0f14752a-7299-4038-9265-752c04e6a97b", "comment": "Malware payload (RedLineStealer)", "value": "e5043b4437aa7b89b36d2af4ddb628c4f7321e6d3a442c985536a9c168fc0b90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843880, "uuid": "55b2f45f-a15f-45e8-97b2-4878155dac5f", "comment": "Malware payload (RedLineStealer)", "value": "ee79f7065d3123bda7c923125526a07e76aa3366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639843880, "uuid": "6e35b317-7e40-4176-a712-1e6fc490d534", "comment": "Malware payload (RedLineStealer)", "value": "faeed8a648cd9521c71d66c2c34e118ce0b9bead4ea48aa4354b740f7cb8ab7d3612e511cf4dae5caa792b60754e0460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843880, "uuid": "9a313e64-f2a7-4ee3-b3da-690e4fe919ae", "value": "T16884DF00BBE0D034F5B752F849B6D3ACB63E7AA15B60A0CB12D426EA5775AD0DD3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843880, "uuid": "749f740a-0569-49e7-b964-0d5f3bbb6d5e", "value": "d5ad0dd900bc145ad0c026557134f094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843880, "uuid": "6cc36623-25dc-44b6-96c3-7a594a7422f2", "value": "6144:kexzTwaVLQ5CcQXJsa6OyPE9SXVk1BQ4X+OZd7vniBqJWBxZL2:kexQaVIClsa6OyKSXVkXQ4X+cJ+qJW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639843880, "uuid": "32d1db88-2416-475d-8aa0-161ef922d84b", "value": 406088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639843880, "uuid": "258b0bd4-89cd-46a1-a2a3-d2217e824503", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639843880, "uuid": "27e5626b-41dc-4afe-90bb-467aada715c2", "value": "80d47ef91c941852d71bd34d4eefecd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c762c07c-604b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639863912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863912, "uuid": "4ccecb27-c3d5-4566-ac97-e346874fa973", "comment": "Malware payload (Mirai)", "value": "0aa772f95ff7f087dc32c7e0417fa33e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863912, "uuid": "cf13c909-3d6e-430e-ba8f-07cbad83c35e", "comment": "Malware payload (Mirai)", "value": "e7294f755b0296a7134ed4c746c36db051084ee17d2e616983e9a570d0926b46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863912, "uuid": "1c628230-fe7d-464e-b8d4-c2f4ac0e23d4", "comment": "Malware payload (Mirai)", "value": "4a9c9f8cd0c61f729d81006a4502c3f1d7371d2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639863912, "uuid": "71405b69-113e-4a79-b5a9-7fb7dad81556", "comment": "Malware payload (Mirai)", "value": "4033e1ab84bc2302c50efe169a11ffadf8704acd64f1e0a9877c96783feb54c43e4e832d57ab4bf62dda3b699446d99f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863912, "uuid": "d4ff9c42-b23d-4fa9-b9dd-ef1f574f2180", "value": "T120E2E02691825AC9C0BDB23525BF7D1A451C937D34888723A9D8E33278DBF197C31B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863912, "uuid": "4fc5157a-3e47-4cd6-9883-1300d3626a9d", "value": "768:UyIuM3LXhwg1T9U4JuTWrNHT56qQip1ekISNhINqZnbcuyD7Uryqh:/m3LRxDUrTWr3eSNhINqZnouy8mqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639863912, "uuid": "d373a65b-8433-4f00-a8d8-530cd10817a0", "value": 34108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639863912, "uuid": "b9cb1b4a-97ff-42fc-9d77-503a22339ac2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639863912, "uuid": "979c4a7d-8491-4c27-a8e8-93446d945f05", "value": "0aa772f95ff7f087dc32c7e0417fa33e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cc269d-6052-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639866698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866698, "uuid": "5c5d2e84-1089-4e86-b966-b337d4f904c5", "comment": "Malware payload (Mirai)", "value": "a3dfc83d241394c9567317e33b6d06af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866698, "uuid": "f6543281-a9a0-4fad-b2cf-d8de5db1a003", "comment": "Malware payload (Mirai)", "value": "ea872d137ae7c120140f9fdf340c3e69a94e515a13ab6cf67f63acc315862639", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866698, "uuid": "fe9c5a39-93cf-4a2a-8800-a809ad7d0b67", "comment": "Malware payload (Mirai)", "value": "0a44359958715a1bf3d0e56dfd54f1d1c79201af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866698, "uuid": "6ea77e5d-8b1e-4367-81ff-a35fdff79d3a", "comment": "Malware payload (Mirai)", "value": "fa5c9ae6ae085447aa3f7a50292e81444e9ed14af8335d63b2be403fdcf24506f898159ff672bdb009f738f6607a7f74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866698, "uuid": "aaf7aef3-f171-40d9-9202-39d682702c99", "value": "T1B6C3F830E8044B1BC2D223F6A75A469E3F351E9797E733115A387DB06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866698, "uuid": "d08a7c33-1fe3-4c4c-bedd-c224ea9f8af0", "value": "3072:6jVlyaL5JCrIpv04substiEiJmP46aQyfPluesNb:yoCJCN4sub8YmP46aQyfPluesNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639866698, "uuid": "8934ce56-10fc-4516-a99b-1fb455690b39", "value": 129899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639866698, "uuid": "5dc35359-717a-460e-966a-ba36ac291140", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866698, "uuid": "8564a23f-97bb-4e06-bdf7-e59708921468", "value": "a3dfc83d241394c9567317e33b6d06af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed40814-5fdf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639817405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817405, "uuid": "6a1b8d0b-f8cf-432a-990d-2ddb4fb02a90", "comment": "Malware payload (Mirai)", "value": "8abfdc5116e6dc5f38917ecadb12fe20", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817405, "uuid": "556aad20-dccf-4790-a02d-c13d15b1eb28", "comment": "Malware payload (Mirai)", "value": "ead2d36a535cfef910cfd2bbbbe2e760230d433c3efc8ce61b29840faf690795", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817405, "uuid": "c60f3553-fd23-4223-8272-c6a859d79a7a", "comment": "Malware payload (Mirai)", "value": "760502bf97052bbce80532de2ef4b355861ffd8c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639817405, "uuid": "b6ab466d-74eb-48c8-bf7f-e118326ebf26", "comment": "Malware payload (Mirai)", "value": "83a7074dacede53190ccfe5c51095a43658ea230f678b9705a789fd6cf708ed25952b2e5b81e4b69059a0f3b8a6bd326", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817405, "uuid": "91896f29-f2a9-4ef3-94d5-f1d8712e42e2", "value": "T161634AC4A553E8F4DD1507B43177EB334A77F536212AEAC7D3B8A923BC82A41940B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817405, "uuid": "9c4d1837-60da-49d2-afd1-0cbc29b536e1", "value": "1536:m4uQwyBcqv117K/Mn9O/kbfvxk2N5rFfEftaNGOTLaL9UPrT8y5x73QC:mBRk13jbfvxk2N5rFfE1aNGUa568ybg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639817405, "uuid": "28e9045a-a71f-4806-871a-a4cdd741d34e", "value": 70704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639817405, "uuid": "071f1812-7020-45df-a6c7-9e8d1180e47f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639817405, "uuid": "600c2c6d-5003-403a-a37c-cc9e2de59ee8", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950174ec-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639844071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844071, "uuid": "26467162-9e0f-44d3-bfc8-967cf4db4d39", "comment": "Malware payload (Gafgyt)", "value": "7efc787a6b887420bb5f54f6c3fd363d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844071, "uuid": "9b5e9e80-4500-43b6-9038-440a5c6f3644", "comment": "Malware payload (Gafgyt)", "value": "ec62ca2b181a826a6ca21707d698d260f55de856302b7cd714d92de66c8df210", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844071, "uuid": "013bd02f-7bd6-4c79-b219-cf92f7b6921d", "comment": "Malware payload (Gafgyt)", "value": "0b482f16582f95183dbf8dbb9572ff11bea9e463", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844071, "uuid": "6031d188-e945-4a41-babb-e0b972ee7c29", "comment": "Malware payload (Gafgyt)", "value": "d0dbfc6146062e1fa898d9f64a4bc310cd5046749abc344c282304a61843c4482831e8d44039e9ce7aee05bf7d6f6243", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844071, "uuid": "8db4a502-8ce9-4e3a-88a0-e42e9341d110", "value": "T1AB63BF75F41A1E90C6954174B198CD360F33A889E2936DF29BC687A2504BAFCF508FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844071, "uuid": "03a812c9-3e4b-4651-9e0d-48119a2f059a", "value": "1536:v/BkoASuy5a6BqFl6hhOeC+y1PsqTHCmGFBzRUNLIqCJV/:vpkRJyxqH6hhOek7QpRGLIq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844071, "uuid": "c9ba5154-8956-4cbd-a3ec-4ec395e7aa3a", "value": 70984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844071, "uuid": "edbe7aff-c793-4d17-b65a-a8e595012590", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844071, "uuid": "97808ccd-0a9e-4526-9de7-546b9c4e871c", "value": "7efc787a6b887420bb5f54f6c3fd363d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7019099c-600c-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639836707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836707, "uuid": "d96550b1-8510-48fa-bf24-e4c9cbc6a5e7", "comment": "Malware payload (DCRat)", "value": "35c331329700486a4f850bfce5309945", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836707, "uuid": "6aaa542a-f352-4326-bf72-b21b770a2c30", "comment": "Malware payload (DCRat)", "value": "ecca35cc0d4904c56e217553ac6017b1edb86a3a5779d888decd0b2497f2ab3b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836707, "uuid": "e5421c71-8462-4f65-95a8-cfb928babc30", "comment": "Malware payload (DCRat)", "value": "bc93d7999657981f78105d1c3e0aac19eb110d0b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836707, "uuid": "ff1c8121-cd7e-4fbb-a3ce-4808d5b19a08", "comment": "Malware payload (DCRat)", "value": "64ee750df2922376e4cedfc3facc04e2118eaed5023d0a9f3a8b8ae91f2de0b908f5149eebd98b1cf591a6ca19ae0e87", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836707, "uuid": "af726849-abd0-4526-ba0c-51a9e76bde8b", "value": "T1BB649E00BBA0D435F4B796F449B993BDA53EB9A16B70A0CF52D516EA47396E0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836707, "uuid": "d0d88088-186e-4040-b1aa-26c8f06c5263", "value": "97510e08b27860260a6b4085182271af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836707, "uuid": "fb5b1565-0ace-43e2-a8e1-5542ae4ed84a", "value": "3072:Xg0qDs7yvmaWE9ECkgKOoMgBsAf2CwVIXv5VKav1L/EVNuseJMqvpcnbHd7kLV6D:XgPZ9OZf2CM21L/EVUnMqvWnFkXEnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639836707, "uuid": "1180eb55-6853-41ed-9ac2-4adff1a7d69e", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639836707, "uuid": "6977b19a-bb87-4078-8c68-5dfde0073c53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836707, "uuid": "3385dea7-2812-4139-934e-f711abd173e9", "value": "35c331329700486a4f850bfce5309945.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690ccf2d-604e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639865042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639865042, "uuid": "0dd6c054-5675-45f9-a4f8-9fbdd16ba324", "comment": "Malware payload", "value": "41e5ebf9f727feead56f2fc431690329", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639865042, "uuid": "2de9669e-67aa-4834-bd3f-2d0ec9283585", "comment": "Malware payload", "value": "efb57de388772c948de0d8ae04db4325caeefa010c68c81563807d9a8e870b5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639865042, "uuid": "1e929f71-77cf-4b9f-80a3-dd709b2b1118", "comment": "Malware payload", "value": "94c9c85011e9c1498b653fdd7455dbcd3f06b9ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639865042, "uuid": "99652320-b867-42f2-af65-e3118cb9bbc5", "comment": "Malware payload", "value": "a3be33fea75c864b98f653f291c9b2eb213a00fab2b68dd00b84d8c1c2940c84e5cfd6257db23ccce531457e511262a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639865042, "uuid": "10650b00-4465-43fc-8249-7281b6b07215", "value": "T11073BF4295C85136D156013E2BB63AB6D5B4F1FB3201D2993A8CCDE5EFD1CB0A26B3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639865042, "uuid": "3b63f980-e009-4104-be75-9f104dab1b4f", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639865042, "uuid": "c74a7510-36ca-4f0a-a0d6-bd20cd24dea0", "value": "1536:I7U0q4xfa9zINR1hTSJk4wXyapUCzfdIbhe3Mb+KR0Nc8QsJq39:I5lSz2R1hTSJk4wXkCzfdIbhye0Nc8Qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639865042, "uuid": "85d90571-b025-4f63-b9ec-63ed3cd74a78", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639865042, "uuid": "cfec627e-5dcb-451d-b9f1-b3ddf1215ef4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639865042, "uuid": "5acbf297-2fab-4f5d-945e-18ce49154dae", "value": "41e5ebf9f727feead56f2fc431690329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b091d0eb-5f9e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639789571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789571, "uuid": "c75f1b2b-d36d-46fb-8dac-48edf409c35d", "comment": "Malware payload (RedLineStealer)", "value": "32b51b2c435e16c3408623d78e8d455c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789571, "uuid": "2cf036a7-2ba2-46ee-b305-d389ff3861aa", "comment": "Malware payload (RedLineStealer)", "value": "f0148d72fdad372a96e3ec1ecfd36d76f907dd973d807d73551b7129b748de14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789571, "uuid": "450ef39b-7585-4d24-82b1-45d8e6a1bb58", "comment": "Malware payload (RedLineStealer)", "value": "702484d3a19946c1d1fc0b9765cc64e823f54728", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639789571, "uuid": "f49b8472-54a2-4df5-a3eb-99f0d94794c8", "comment": "Malware payload (RedLineStealer)", "value": "6908f62a969a2dc5f3e32f1b1b92c5e169d1fc249da7fe4d1ea5f15428ecea66fa7237f9bfc2f6adf0eccb270b91cea9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789571, "uuid": "7fd25a5a-80cc-4df7-ada5-8e4085ac13ae", "value": "T1B01633EA35F43482C18B88F998E027671126F841F219DFEA4D85C6478B39AB0FF64576", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789571, "uuid": "8212e97a-8c90-4b83-9c8e-d7e9ad47d71c", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789571, "uuid": "6c23eede-3092-415d-9219-416752b91e62", "value": "98304:baKKY2KHqHr1MhR+ZlxJHM/uknDFxqMCEJPdT2LQCp+hKee3Zk7gDnoYb09PQyi:bNKY2K2MhR+rMN2sJUlZee3ayzb09PI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639789571, "uuid": "7f9059e3-4baf-445b-be56-c02de690794b", "value": 4387840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639789571, "uuid": "aa81131e-0f6d-4544-acab-0b262b678a06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639789571, "uuid": "3c323ab9-8ae0-47bc-839e-0e1f361febc1", "value": "32b51b2c435e16c3408623d78e8d455c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcb043d-5f9c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639788603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788603, "uuid": "41f7558a-c569-4f9f-ae1b-73968a45a4f7", "comment": "Malware payload (Mirai)", "value": "38a04d5df5185ae2ff9657568d9687d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788603, "uuid": "ce672430-5888-4e2d-a6bd-1e680a2681f8", "comment": "Malware payload (Mirai)", "value": "f130d3b265175f14b279db0117e5c3e0df22af385e1778d0b8bca0a4b142b643", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788603, "uuid": "a3de971c-fdf0-4417-93de-60e88840ceae", "comment": "Malware payload (Mirai)", "value": "250b166feb01e2e8fedfcffc7f1f71c224136f00", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639788603, "uuid": "52bb0cc9-9ed0-448d-9644-0c5c20e373d1", "comment": "Malware payload (Mirai)", "value": "cb5ea61a2af70f22afc989cdd2eef10fd2ac61ceec7f6d6d3b4fcba60a12c409459b2705c5cbbcef930cfdf0e472e631", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639788603, "uuid": "ba5d881a-4ae8-4caf-acb7-766f0e93908e", "value": "T197D34C46EB818F03C4D5277ABA9F42493322A754D3DB73068D18AFB43F86B9E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639788603, "uuid": "a52534f2-6f91-431f-a485-edd104cacf23", "value": "3072:PY8qpbwiS07lCY6SByl/G2JD3qHJyfJrx8Ph1M/9iO2x54o5:PY8qpbwiS07jbBI/G2JD3MJerxgM/9Ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639788603, "uuid": "d92fdf4d-e914-48a0-8315-a1224e865530", "value": 135010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639788603, "uuid": "77342563-0d75-4775-b81a-d2049dbf3f47", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639788603, "uuid": "e05e843d-5881-46dd-98c2-59129e261fce", "value": "apep.arm7-20211218-0050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff3be98-6052-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639866691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866691, "uuid": "b115d156-c24f-443a-b43f-58f30692b784", "comment": "Malware payload (Mirai)", "value": "beb95d1513eab245803125a14cd1b843", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866691, "uuid": "39bf98d1-2614-409c-9ba4-47033ba0a132", "comment": "Malware payload (Mirai)", "value": "f65e9affc990b8333edd413ef2124f6e60f6ed103076b7e39572a0479979c62c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866691, "uuid": "f5eec722-7cee-44d1-ad68-cbdb87f5f14d", "comment": "Malware payload (Mirai)", "value": "fdbc3a966472445990f6090e9545c6e667d26dc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639866691, "uuid": "61655513-3088-4c6c-a6de-42b52d3c22b7", "comment": "Malware payload (Mirai)", "value": "c3d974cf56d2b65ab870b74a2a4a9969f27f81090a1e05b0f1b97720dd4d5a42e6e9842dc9104d89d13a0e58b0703ccf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866691, "uuid": "e5edb26c-fcf3-4165-8822-b14a7b48c1fa", "value": "T14A83954D2E219F7DFFAC823987B79A21960533AA27E1C5C4D05CEA022E7034E741FB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866691, "uuid": "6b4023e0-b0c2-4c6d-81f2-f0cd74ceef51", "value": "1536:y2MI3DAoc6Qncq50vLEKN3TgPnEDg4iPK2PQ+ltB:qkDS0T7NanEDg4iPK2PF7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639866691, "uuid": "e3e63ce4-0830-490e-bcee-616f57d03d93", "value": 88000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639866691, "uuid": "5d8a866e-4f24-43af-bcfa-c464c4a3f525", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639866691, "uuid": "ac009baf-561b-4e9f-b329-63b613f306a3", "value": "beb95d1513eab245803125a14cd1b843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91264dca-601d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639844064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844064, "uuid": "c3951806-3ee6-446f-ba3c-1c7f98ebdbb3", "comment": "Malware payload (Mirai)", "value": "7be65db1805e5c4b082d8627c20b22a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844064, "uuid": "8a6201db-caf4-4985-b840-7622c5a029a4", "comment": "Malware payload (Mirai)", "value": "f71c01a7ab71928451813f72e80008bc3815db15242bbf6a76586b04f1205e40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844064, "uuid": "ce6d9078-03f7-44e8-9c2f-16f6c320f223", "comment": "Malware payload (Mirai)", "value": "f80c102a0cb9cbe3f974d700663a244ec6141652", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639844064, "uuid": "f0d09713-7389-46ce-b515-b51e734d20c2", "comment": "Malware payload (Mirai)", "value": "75871ef7d7186681e724dcca51465acc6b0ed1bb377b2ec5b1b09302967ee2ec32d8b6c2cf14957770330ae18413752e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844064, "uuid": "47cc7806-b99f-4c3e-8213-d97b98c6cb5e", "value": "T1AFC2D079D05D9CC9FF89DCB62C186B852FD40F6E392289B292644F524A14B07B74CBC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844064, "uuid": "41612daf-0dc4-4374-b91c-00cf7926678b", "value": "768:Ud/qRyD4/P6k7kILiEe4Ee003aCvIR1yyi4uVcqgw0XJJkmWq9:UdzikYe4Ubi4u+qgw0fX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639844064, "uuid": "27222621-556d-496e-9ce2-56f32396eeab", "value": 26332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639844064, "uuid": "5ba7a4b1-e115-4e4f-b64b-121e2ae906d9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639844064, "uuid": "d620c7a3-45ee-4de6-a3c1-87147c508ba9", "value": "7be65db1805e5c4b082d8627c20b22a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9776174-5ffb-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639829609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829609, "uuid": "77663e9e-a5d1-4da1-81b6-0d5857bb5cca", "comment": "Malware payload (Gafgyt)", "value": "ee05c15a9f4cc4787487fffbaeb2b0f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829609, "uuid": "9878b244-ef37-4d0e-a364-1be40057130e", "comment": "Malware payload (Gafgyt)", "value": "f7e8fd96f421e5a3c52327e0e061c0f63a28e2b1308cb73e1c6b1e7fc88d3c04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829609, "uuid": "3ac02957-ee45-45aa-b333-11c60ce2d119", "comment": "Malware payload (Gafgyt)", "value": "40c774d055817331d5f349d7fe863292e7319083", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639829609, "uuid": "aed99aeb-bff4-43bb-a03b-cbd564716519", "comment": "Malware payload (Gafgyt)", "value": "d3b420354015555c10301e24d9144965dfec9a255eaeb0565f00cddf4abb0c86e8b19aba1afa8e1539406e075f2db3e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829609, "uuid": "8605e2a6-80e2-4783-986f-6911f0a0f15d", "value": "T166933A8799659F77C187AA7129EB9D300B26A8911F4F1B497038A7F4074F4CEB80EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829609, "uuid": "76634421-57d6-43c4-a4ad-0d565edc8e5e", "value": "1536:i4kybnxghYJk0L5vE3KYv2ObK5XOfP9iCKuXwmFOiVqOEsmfH86:RVbnWYisE3Kr5YiFVmQiVqO3mfH86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639829609, "uuid": "a2caf401-8309-43ef-aa22-2d3be7938c31", "value": 93350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639829609, "uuid": "f187fef9-90a7-4dcb-b6dd-d25245ae66b7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639829609, "uuid": "f56c2a1e-ed61-48ca-ade5-9987ba6dedec", "value": "ee05c15a9f4cc4787487fffbaeb2b0f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e76b369-5ffd-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639830101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830101, "uuid": "ef1d6915-5441-4ae2-a862-d976453de27b", "comment": "Malware payload (Gafgyt)", "value": "beffd13b73013ef68de2fd84ef132ded", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830101, "uuid": "466af4aa-9ba6-47d1-b21e-4da3b1bd7a41", "comment": "Malware payload (Gafgyt)", "value": "fa447908581d72a0660a4449fca6bad219f04d3282ff76d559e6b9ab3927605b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830101, "uuid": "b0ee6ea7-0ecc-4106-9af5-873b1bdd6606", "comment": "Malware payload (Gafgyt)", "value": "0cae45ddcf038c7f720e88863edd18355770c874", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639830101, "uuid": "d3313674-b7b1-48c0-977e-d8cd683873e2", "comment": "Malware payload (Gafgyt)", "value": "d3879c4ff72bb6330e7dc4b9eb9fcd4a8493e0e7fb67416f4054f36010d91b00b3cd5e7d29e0a52455e9dbf82dac8176", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830101, "uuid": "6ff3d0b2-0e30-4fdc-9d52-307618fa3a68", "value": "T191C32905E5518B5BC2D3237AEB8F465D77336BA493CB33115A34AFB42BC27891E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830101, "uuid": "b14bc258-278c-45be-af49-1da7e105f334", "value": "3072:wmzw8L7PTd1EajO6VnkGGqIxYoomzQOY54Xpgn:wmzw8/p1EaLkGG5omzQOY5epgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639830101, "uuid": "23b80f74-4141-4e53-be1a-529abda65ccc", "value": 124807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639830101, "uuid": "41245081-0710-47b4-a1cb-9f21759f57df", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639830101, "uuid": "4dff2319-6896-48a8-b2f3-2cf2f0a06fc9", "value": "beffd13b73013ef68de2fd84ef132ded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1dbfee4-600b-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639836361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836361, "uuid": "3bfa15ec-2c9b-40f2-ba3d-ee47b323bbf2", "comment": "Malware payload (ArkeiStealer)", "value": "1003c6904aa34b7e4caae84ffb3e9c12", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836361, "uuid": "1bc79d49-f0ad-4548-860a-ee2f179db217", "comment": "Malware payload (ArkeiStealer)", "value": "faa3108df10114433b642294213704b774b978765776c538ca40edee37f72f27", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836361, "uuid": "7b378ac5-5740-4c0f-af9d-750b84c3a929", "comment": "Malware payload (ArkeiStealer)", "value": "8943f3f500a7510170e618326a8b7fb9bad5550b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836361, "uuid": "b6fd9bc2-154a-4287-9e6f-47fc7919dd27", "comment": "Malware payload (ArkeiStealer)", "value": "b72f8459ea9c07cd206fedaaa1c7610a0a7e4675c36156a90f016c0976050861f035b5ea1607ddd9a28750805d792c15", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836361, "uuid": "34c760b6-9e1b-4c8a-990a-b53da33acf1e", "value": "T14664AE0077A0D035F1B756F449B693BDA53EBAB16B7490CF22D51AEA463A6E0EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836361, "uuid": "d4451dcc-c23b-43af-ba5c-f9a3cd6c6b07", "value": "4ee83624426d72301d5dc28b390adabc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836361, "uuid": "6cd3b16e-9ab0-4531-b02f-735a3be6d698", "value": "6144:1NCGMUArdqkm/aGJo1XBiVC2AOBO6UoaVKn:49Dm/aMo1XBiBAOBO6Qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639836361, "uuid": "f09f8eb0-e497-43c7-8f58-679e92bb2cf0", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639836361, "uuid": "561b51a3-b326-4dd3-ae88-c58f7bff6ce0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836361, "uuid": "3c9c3ab7-76d0-4b43-a88a-0f1b85ef12ee", "value": "1003c6904aa34b7e4caae84ffb3e9c12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9cf8bf-603f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639858797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639858797, "uuid": "d3c7035d-8132-427e-a740-32dae5052b0f", "comment": "Malware payload (Mirai)", "value": "f904130625cd59d4a3ce2387d3b1130b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639858797, "uuid": "a63bd327-89c5-4a5e-845b-3b1c17987aa0", "comment": "Malware payload (Mirai)", "value": "fcb57c93f80a26236462c5831e15933e75016a3d5677ff550bac353bc69a17ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639858797, "uuid": "5669b606-6b6a-4242-94c3-270b25ef5d86", "comment": "Malware payload (Mirai)", "value": "d1d4e7d9fc7021914f7042aa7136db4c2aa71b99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639858797, "uuid": "b771b6db-e068-467b-9389-d348378ac090", "comment": "Malware payload (Mirai)", "value": "37c54685214bdb89f40b66c97471b0c518de3375d4713a6679fcca99851f0e06e89899dacd00abdba04d39e197f40612", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639858797, "uuid": "d91c1a18-3d5b-45f1-8fda-b64cd54be3e1", "value": "T161739E76803AADD4D2480538B5E59C382753B109A6239EFA8EC64B9B6007DFCF5097F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639858797, "uuid": "261d29a6-64da-4a07-a025-761964c199bb", "value": "1536:0/ZSSSNatdr1Ev4NhLaeU2b5yzeTaQ2qyACFInnyd42+RqaV31:0Bj2qt1E+/U28zeTaQ2qyARGeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639858797, "uuid": "32d7bbb1-c1ec-47a0-b8c5-859011b95911", "value": 75060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639858797, "uuid": "f9abc157-aaa4-444d-b2c6-676e2e0b8116", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639858797, "uuid": "fc145b24-504e-4a99-835d-9f7b02d53bfa", "value": "f904130625cd59d4a3ce2387d3b1130b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7706c6c0-5fd3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639812238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639812238, "uuid": "489bbcc9-8f6b-4c50-bf08-fe3dcb601f72", "comment": "Malware payload (RedLineStealer)", "value": "30a35b83c44aba13ee4ea4ee11003419", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639812238, "uuid": "c31af366-15ae-4836-bfaf-7968be590102", "comment": "Malware payload (RedLineStealer)", "value": "fee1019ba9c5d5229717f864c5dc8e1b49150b0c4db83f4a2c9b36d51eb03025", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639812238, "uuid": "97ab890e-e58c-4991-be18-37a8acec4843", "comment": "Malware payload (RedLineStealer)", "value": "abbb71291df7529f46f8d5896f1bb60e2a4afc21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639812238, "uuid": "b8c65195-e26f-4feb-8dec-91c58597b738", "comment": "Malware payload (RedLineStealer)", "value": "4d7d62a5c3946d74deb7c2c3d98dc7c3033f6f41c311375572876efd28df354a87d819297578c25a91580e273db27bf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639812238, "uuid": "2797f390-2566-48d2-a647-a785f0048a49", "value": "T1B193E1106BA4D467E9B24B312D706B678FBEF92426705F4B03501E9D7E323C2DA6E361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639812238, "uuid": "618ad9fa-7689-4b81-9a32-6c74197a9cee", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639812238, "uuid": "9ca42774-61a9-40be-a1ff-9b3f3cec54d1", "value": "1536:K/T2X/jN2vxZz0DTHUpouMJbPxxE+1fHWUyRCEBaOoqhkG6owwDQCGgVOP:KbG7N2kDTHUpouMJbPxPfHryBa7JNVwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639812238, "uuid": "98370dac-3400-4560-8e1a-a88a3aef41e7", "value": 96104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639812238, "uuid": "45792ed4-fa58-44db-9b90-d7bad6b355c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639812238, "uuid": "330136a9-6c32-459f-8c9e-c1410408284f", "value": "30a35b83c44aba13ee4ea4ee11003419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67230fca-600c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639836692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836692, "uuid": "bcb90b38-e557-4506-81f5-e30cbe3f15a0", "comment": "Malware payload (RedLineStealer)", "value": "2a06fc770c180b66f343eff87eec3fc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836692, "uuid": "fe044df7-0e84-4178-a761-f981eb84708e", "comment": "Malware payload (RedLineStealer)", "value": "fefccc5eaf9f17aae12cb2ef937c9ee5a92598613100dd81b02e9280ffd72a6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836692, "uuid": "b6d94c72-1951-4c77-bde1-7ba4787fa0cd", "comment": "Malware payload (RedLineStealer)", "value": "a12eb98d5c4a2050a404d9d58ee6050bfdc1b5ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639836692, "uuid": "428de39b-3aae-4177-9e9b-7ff7c620671c", "comment": "Malware payload (RedLineStealer)", "value": "671a5de4974d8dfd6772f5d336217c2710a1122365410d19055f1141d9db39b2bc312d5f1ff740122bb0fc39ec9352f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836692, "uuid": "b6f08e2b-66b4-4bed-a2ce-b9e2bb111784", "value": "T1C094DF00ABE0C034F5B752F449B6D3ADB63E79A21B7494CF62D456EA4634AE0EC32357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836692, "uuid": "c81575c7-603c-4acf-91d3-2fdeabdd7c46", "value": "97510e08b27860260a6b4085182271af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836692, "uuid": "0fa35732-6a1a-4f41-bb6d-bb53fbfb19e5", "value": "6144:G/H4UvwYogRhavtZSh7URusIGG+xdWnPbc4dtHMWJn:mYDQwVMh4IGG+xdWDc4dtHFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639836692, "uuid": "af4d9e48-59ce-4b2a-90ee-affaf146c2dd", "value": 419876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639836692, "uuid": "d1305fff-2a1e-4239-9ca6-f42610c1b2df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639836692, "uuid": "f90a2d2d-8e6b-45d3-a68f-c9074d0530d2", "value": "2a06fc770c180b66f343eff87eec3fc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }