{ "Event": { "published": true, "date": "2022-11-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-11-19", "timestamp": 1668902582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "28c62ee7-efdc-4629-b95c-d2bffc1c9d37", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6b9643-67d4-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668839946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668839946, "uuid": "baeb325e-04e7-4051-af6b-927d6ab0c7e0", "comment": "Malware payload (Smoke Loader)", "value": "0fda64f419ef62b20cafa584e9ac965c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668839946, "uuid": "4977b90f-f5ac-4e32-8718-0c29a53370d1", "comment": "Malware payload (Smoke Loader)", "value": "002e81aaa44917c3f31513578174f22fa9eab43e0a64714901a8e1efe8887cec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668839946, "uuid": "eee66593-4642-4c7a-943d-736c71a5e0d8", "comment": "Malware payload (Smoke Loader)", "value": "7647d7db9f22f189f980b43f541b861e6fff97b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668839946, "uuid": "f34f205b-0988-4127-8d62-164c56706291", "comment": "Malware payload (Smoke Loader)", "value": "6f88f13d7c16edc5b2a3fbf63c8a2b69813a668202be16c95fad183cc5a30f5b884fbf79376b1072c74ad2b5fcc0e208", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668839946, "uuid": "0e556b22-49b1-4156-9886-4af298918570", "value": "T1A074BE107684FE32C5C10531882EEBF56E39AC625F2595C776B8FF6F2E302D1A6B2245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668839946, "uuid": "fa641f44-09da-4e60-8d84-10d08d47c403", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668839946, "uuid": "09c72dc0-d152-49f7-85c4-fcb678c91f39", "value": "6144:I+kvUOzZGrAdIjyUHrCJ3UB3BLXjMe3h+3oQ9gOU+fzYBb6:IfUiyjyWrCJcFj89gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668839946, "uuid": "2831c9cd-b15e-488b-8575-e2171fb96a8f", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668839946, "uuid": "ef66ae29-0807-464f-a81f-793096553806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668839946, "uuid": "004a32de-0e5d-448d-a07a-c6727be4f76d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f23a7b9-6801-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668859169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859169, "uuid": "3d8c9f66-575a-4dff-a559-4eb44bcca386", "comment": "Malware payload (Mirai)", "value": "7c94c064cc117887a44aca7d2e003832", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859169, "uuid": "79240353-a1db-45fd-aae7-54fd3629aad7", "comment": "Malware payload (Mirai)", "value": "00c555dc646475fe25e5e654cedefee4486abeeb86c7e62482105a4396283980", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859169, "uuid": "6992f659-448b-4841-99cf-f4969bb88f55", "comment": "Malware payload (Mirai)", "value": "d67adaa43af7a4888057f4fb090c7c47db3da4d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859169, "uuid": "4001a3bb-626f-4ab0-86de-98d0a118b0f6", "comment": "Malware payload (Mirai)", "value": "090592bc60bcd46f6724b926cba3f54bd594e64e979eb8171d524a8e6cb7d1af8b5aa910e6327f118c2335c22a6ff220", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859169, "uuid": "dade9528-6cff-4059-9df1-de398e5a46ce", "value": "T16E330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859169, "uuid": "03520ec6-6d9e-4805-a65d-0de5782e82ca", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oG4:r/hqaJMcjeqK806MHdMfQXoHuC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859169, "uuid": "83546bb1-ab8e-4653-9e64-3edeed2e3397", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859169, "uuid": "0696eaf3-7001-4993-86ce-0f21e9a23e2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859169, "uuid": "68fdd04e-526f-473f-8c89-e9fffaf1e0d8", "value": "7c94c064cc117887a44aca7d2e003832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2a0b7d-683d-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1668884717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668884717, "uuid": "8013323b-a1ce-4d7c-b8f5-6ce192bb89d3", "comment": "Malware payload (Loki)", "value": "2c153411631a27b95c091c3733f8e8b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668884717, "uuid": "0789aa6e-50f6-4e6b-a847-869cb096a3f6", "comment": "Malware payload (Loki)", "value": "00cd574afc080c98bdf3dfce859123fd452ff1f3bbbd6c220b2c8fce14725971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668884717, "uuid": "ba5f8024-38bb-44dd-8548-bac8c4fc27ef", "comment": "Malware payload (Loki)", "value": "0ee92b323100da1c4cc8558d0194c0051b7d62ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668884717, "uuid": "a6b32a0d-c388-4339-9792-791ba6456c41", "comment": "Malware payload (Loki)", "value": "82bba1c21d8337b7400b2dab012b43f7bbded10c52c769d9ece94d9111a5064ed9403061cb402cedfd5d0ce502cf3b6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668884717, "uuid": "7c6dc17f-5f50-4fdb-9cfc-4c0a657f8194", "value": "T1CEA31942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668884717, "uuid": "f801c858-8edb-461f-98f2-6046305690e8", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668884717, "uuid": "d7db5c75-21ab-4088-bd71-bf80373dced1", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/Eq5Izmd:nSHIG6mQwGmfOQd8YhY0/EsUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668884717, "uuid": "8c8ebe00-c3f1-450b-8d86-83cbb6f69726", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668884717, "uuid": "cdfa4306-4109-4b19-9d13-82aa223c6689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668884717, "uuid": "20822cf0-1991-4a0f-b416-0d196690fb13", "value": "2c153411631a27b95c091c3733f8e8b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79cb756-6821-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668873007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873007, "uuid": "0febf4dd-c21b-426e-9939-dc95287b2641", "comment": "Malware payload (Mirai)", "value": "d88ef612b4d0746bf9ca8cff138e7a96", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873007, "uuid": "aa8c4dc4-21c8-4502-b522-996ab45724f5", "comment": "Malware payload (Mirai)", "value": "0131ce0b65a7f389de12e6cc16c30bec32a72209d146284ccebee3f9ecf01793", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873007, "uuid": "6c28d711-a96c-4050-9ff9-d52da81c0f7e", "comment": "Malware payload (Mirai)", "value": "91006e5721b619e6307b215c1d5252b7006ba4ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873007, "uuid": "5c672303-f90c-4522-a211-e4e0d0f66c7b", "comment": "Malware payload (Mirai)", "value": "2f463fc8ee00324da3d2c5295fa0a325da1b1ce729cbbd6e160bd1532a12adb4c8087c6cb7a79c0288fb3dd4457bd37a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873007, "uuid": "1fbe8b31-599b-4087-a8c1-28ed0b86ccdb", "value": "T16C534AC8A5C3E5F5EC001D79307AABA1A973F53F2075EE8BE79E25639903603E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873007, "uuid": "ca35eda4-9f43-4858-8fec-a0659bb853d3", "value": "1536:V5nD4pXoqVExGxRP3MFnKiejGKO18HKaPW8AkXUnD9oAG9N:7D4pxuxGxB3MFnKNGHCHKg9+VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668873007, "uuid": "4f517110-a1f0-40d2-8724-ff56e7f00cf4", "value": 63696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668873007, "uuid": "f3aefb20-f37b-4d23-80a8-2cbf37930838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873007, "uuid": "71a2bd6c-7b4f-49b6-a110-8504e933dc86", "value": "Mddos.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ad642a-67ca-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668835665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835665, "uuid": "6b46d16b-fb83-432e-95f4-7dd1699fc172", "comment": "Malware payload (Mirai)", "value": "4aebfd15a42c0aa3074a1752dcca4020", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835665, "uuid": "762e290e-0005-4cad-b406-4915e4020c1e", "comment": "Malware payload (Mirai)", "value": "024c2ad1f54c513fd44a790317cfa74885cdc0faf93bf8cdc0b6f20e5c1478e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835665, "uuid": "f2851245-ecdd-4db9-8b63-9aecf79b62ed", "comment": "Malware payload (Mirai)", "value": "315a7a14cee34edfaab469ebe0076aa945635ffa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835665, "uuid": "032b0143-3481-445e-ab28-be724dc5adb9", "comment": "Malware payload (Mirai)", "value": "f6924c55b63acd2ac5bc03cfb039a33252a547bbf4b313adcc91483bcc31fbe6c5084bef8450685bfc2d9273702d3aca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835665, "uuid": "fede96fb-da9b-445f-8311-6dc3d31d219e", "value": "T1EEB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835665, "uuid": "211a1086-eb81-4795-98c5-d6790614ee8b", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1a/LWy:c9sSyzz36YaWWgg1aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668835665, "uuid": "3ad2acf4-e162-4de0-8591-c7349dbfe877", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668835665, "uuid": "03b66ef9-36dc-44e2-8d66-f3f6deca0dc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835665, "uuid": "b1e19875-bb0e-4d03-a06c-bb7a39cfb25c", "value": "4aebfd15a42c0aa3074a1752dcca4020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a1cbcd-6829-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668876224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876224, "uuid": "d2c88353-fb7b-4606-963e-6a65867b9f7f", "comment": "Malware payload (Mirai)", "value": "aad53a8ff86cc75c9210769520e42afb", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876224, "uuid": "38ddcd8b-79ca-469d-af0b-05427e879768", "comment": "Malware payload (Mirai)", "value": "0282a1b75a4df8b00f15cd73d0088ee9356b97a856fdb92bae536a716c5e44db", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876224, "uuid": "899696af-932d-4953-9331-806f569d0bb2", "comment": "Malware payload (Mirai)", "value": "70947dac7a146ba12b7e54d904d0923cf56567e5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876224, "uuid": "4ed308d0-f447-4427-9782-0363b915dad9", "comment": "Malware payload (Mirai)", "value": "7dc82aaad8dde30c3f16dfa684c33745300d68a2d83e69dd20864cb74a3a6168e044903b980b213fe9fe3ba54bc74057", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876224, "uuid": "e28694dd-92fb-410f-89f0-ef9d7aca0e1b", "value": "T1A1D2CFEF54BFB2B1D0BEA431D0100584FA38751BEA2B67FB0E8AA6F959390C01721995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876224, "uuid": "88726690-f4b5-4a6e-85d9-b8d2b097bb94", "value": "384:hXYRQoX9/JZ+WkZYkg3h5B5xnmZPcHciwKnQI2JtKF8tBM5WbjNClzk/BnRGnUxs:NYSoXdJZ5U05VmMhjDO/1RGSx0s+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668876224, "uuid": "1ec5b9b1-a68d-452c-a1a3-2416fa51b0b0", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668876224, "uuid": "9bfd625b-1f1e-4323-9f0c-a9a69c0c779c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876224, "uuid": "e48732cd-2aa7-4044-b73f-9fad2c7d164a", "value": "aad53a8ff86cc75c9210769520e42afb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4868d5-6825-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668874710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668874710, "uuid": "d0e24c7e-e727-4890-a4a8-9aaa2e7469dc", "comment": "Malware payload", "value": "a19ba7f0bf808aefee30b29e8f84fc83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668874710, "uuid": "630536e1-7340-4d56-8e74-30189de961bb", "comment": "Malware payload", "value": "041f891934add72852c8fda245c95da959d7f98cc580383d198e42f2de039634", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668874710, "uuid": "1fc37f28-bc13-4e88-aa12-a24eb86dfa9b", "comment": "Malware payload", "value": "a339f81ccc84ab7c1f93a8f6add6e08fa64a46ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668874710, "uuid": "2bea3828-6c93-4190-81cb-4667f3e2f3ff", "comment": "Malware payload", "value": "8491ea58be8a6e5845a97c24dbe9b209974c19fe7a2ddf4fdc561d0a7197e61448ff34553a469c94cee1c4dea81eba71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668874710, "uuid": "3b8964c9-0bf8-414e-85ed-0062327f84dc", "value": "T12FF34B34F290B476E8F3043598EC93F5AA3C7A3067A548EFA7454F2A1A356C2D731927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668874710, "uuid": "e69f7d75-1839-475b-beb7-cea83c469c18", "value": "69383720a4674c1af0811c68920a535d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668874710, "uuid": "e1ea5141-7f28-4efe-92ae-439a548ad90b", "value": "3072:hi45BjzKAwpzSmWDeGv9qbiFodx9riWesp60sqhxeOhO6bQRKAcTcwFvhD9ck:hvO+GiviRDrOEQcTDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668874710, "uuid": "4a5dfba3-549e-4272-aa3c-6629adbbb55a", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668874710, "uuid": "5d6859b3-fc38-47a9-813b-c123676533f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668874710, "uuid": "f0da2bf0-c109-45cf-aed8-b2699ef21a02", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3546275c-67a1-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1668817759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817759, "uuid": "33ab7377-0118-4db9-9ba1-399f6a8999d0", "comment": "Malware payload (AgentTesla)", "value": "e93b21f54c96e4ea8947cf386d961f25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817759, "uuid": "009c4e93-8de8-47df-b49b-a74d67ad25d8", "comment": "Malware payload (AgentTesla)", "value": "042c9a8e5b4ac0ec1f2a0ee0c9fa0035ee54379eba96ac1293272bc30c991651", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817759, "uuid": "d64ac7db-8acc-4940-a41c-13fb56695700", "comment": "Malware payload (AgentTesla)", "value": "7c8f17495f3eed7ba37cb215870b3a43ee2820c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817759, "uuid": "75a2d45b-ed41-47a9-a7cc-e9d0423bb5f8", "comment": "Malware payload (AgentTesla)", "value": "d3f40d13c0d1dc0aa2ac617a0ad11528750714dacb01540f5bdffd42ccd6067a4dfa699ee45c9e20a398f48ff62511bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817759, "uuid": "8948b2c3-4e5c-4238-a9d3-8442c049ed3a", "value": "T104054A0F2B7FDEF1EA245CFB121417039A3615DABE8ACA78479867C660F270C5B70865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817759, "uuid": "11d8f5d3-9e2d-4f88-81ac-0a952eb8dff5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817759, "uuid": "b8528411-a3ee-4d01-8654-db0a1c2a4ce5", "value": "24576:Y5+L74mBfNUstzoRBnG30YCoqmXCs7oG2AVXpTIpb:YrBn+9dysQAjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668817759, "uuid": "276ad230-8dbc-4dab-97f3-f0a20357235f", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668817759, "uuid": "652f3dcb-bef1-4082-bc83-95b62d9de1a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817759, "uuid": "5b10b04a-1c2e-461e-90fb-dd4b835cb8b0", "value": "commercial invoice-AD1-2001028L..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9569227d-67a3-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668818780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818780, "uuid": "b0df23a1-4bb8-49fb-bf78-87109851c952", "comment": "Malware payload (Smoke Loader)", "value": "5cf5fdcec332dbf9096f3279dfe2e1e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818780, "uuid": "7780cde0-17ce-47c4-bdfa-6ea08ef95017", "comment": "Malware payload (Smoke Loader)", "value": "04789d897a18c7c97021a5d674b2b686c8847af18c3800982431d8c5946fe454", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818780, "uuid": "b3ba2231-c22b-47b0-87b0-4d6cd580a2c6", "comment": "Malware payload (Smoke Loader)", "value": "2c252b4813a048cce5bc5bcb47c74ccfca29473f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818780, "uuid": "46c8483d-1132-4e49-acb3-f472c9133e50", "comment": "Malware payload (Smoke Loader)", "value": "33c4f85511f53db3b5c45b29dc54361ffa30a426ec19476be0f2db683e693f9db78287c8ab62e180eef50d7bc6840b90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818780, "uuid": "a7115a6b-ead3-45a8-9e88-3fe3bdeadb45", "value": "T1D774BE117384FD72C4C14131882DBBB5AE39AC615F268AC777B8FE5F2E302D16AB2245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818780, "uuid": "0b39932f-f11f-4250-bb2f-cf7424f4000b", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818780, "uuid": "94fdae3a-9029-4e8d-929e-40d6674a6866", "value": "6144:kqp2wXzkbgvSz9CSmYh+3oQ9gOU+fzYBb6:khwItcSmn9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668818780, "uuid": "b3b81314-f3ce-4e43-ae48-a9115a3342da", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668818780, "uuid": "499121c8-035c-43c1-b09e-2398cdaaec5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818780, "uuid": "2b207500-5266-4353-b146-875685e670c7", "value": "5cf5fdcec332dbf9096f3279dfe2e1e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384c2119-67f1-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668852124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668852124, "uuid": "d503e7e3-1cbf-41dd-b99f-8334ff62eb87", "comment": "Malware payload (RedLineStealer)", "value": "630466a7abb256eee19c7de3772de2f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668852124, "uuid": "441e36a6-08c4-493a-8f2c-4502ec4e5635", "comment": "Malware payload (RedLineStealer)", "value": "049b29396a93de08a9a598a8dff3cc39bb2fc1188ab568b90447c79fe079d31c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668852124, "uuid": "8c053dc6-cf63-41bb-86bf-e95d7e332e00", "comment": "Malware payload (RedLineStealer)", "value": "af478049e6be1b4586cf4b8da45454e8b14d0cd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668852124, "uuid": "fbf7b852-97fc-4414-ad07-5442494cc39b", "comment": "Malware payload (RedLineStealer)", "value": "715ed64938cd4f5e56cdf0fcbb866fb55a33cb377364a369f24777f93273797fcc74f4d58dcc6ee8256da1b5c4e4b6d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668852124, "uuid": "d219f7f1-5b83-48f2-a5e1-d13285b33215", "value": "T1CFB4E1307670C4B2F9B14670C465CBA5A9B9E9607814D9033654FBBF3E30F8E5A6E239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668852124, "uuid": "f32e7eca-cd9a-47db-8320-23fe0af75592", "value": "045163335c785d665aeb43938f4d94be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668852124, "uuid": "7635bb2b-85a7-4c99-a352-e0bd5443ea05", "value": "6144:i1kfBQi33W4wri5hC1FcUW0jb8+WcwTm7jpPnFwCLLObfwB:iKBQg+iDKFnjWcwTYxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668852124, "uuid": "b8f1410b-160f-4617-83a3-9ea3f03ac881", "value": 494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668852124, "uuid": "f7d253f2-57c3-44b8-8b45-f7a218437e27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668852124, "uuid": "eed2d6a0-8bd2-479a-bb23-4f2756696765", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e73ab8-67c5-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668833407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833407, "uuid": "d96ac6a9-9129-4c42-ac77-de3beb06952e", "comment": "Malware payload (Smoke Loader)", "value": "ca1fbe7c65b7cfc26bdd19f05a8ea117", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833407, "uuid": "251b8e0d-c17d-4d67-8385-13a067786f3e", "comment": "Malware payload (Smoke Loader)", "value": "04abbe388eb383955ba7a2c4a357efe9db00feae6bfe734620484c60676ea130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833407, "uuid": "07c72372-3c42-454b-8097-335c51a7d571", "comment": "Malware payload (Smoke Loader)", "value": "c7f8f2832563756a32d876b0ffd91d57e40f3640", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833407, "uuid": "d8463313-a4b4-48e8-a93d-e8ca49a1e65e", "comment": "Malware payload (Smoke Loader)", "value": "01b56aaed1d8addba61954ff2452b09669f99bce80653596bef1926343073108968536ab76dfa857c08c94e4190f550d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833407, "uuid": "46c9aeb8-8cf6-47d4-9655-31127edc2520", "value": "T11374AE1072B0FD72C4C20171882DEBF5AE29AC615F2585E773BBEE6F2E302D065B5256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833407, "uuid": "1d450b5e-2db9-4534-adf5-2709543edcce", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833407, "uuid": "929360bb-5043-4248-8e74-ad89271282b4", "value": "6144:RbIpVzexaXRbkmkcC96isCUh+3oQ9gOU+fzYBb6:Kp002mlC96isg9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668833407, "uuid": "9222df66-0197-40d2-8e47-97d45779b99b", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668833407, "uuid": "c02e4b96-4b2e-4504-852b-f0e3b6db1c03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833407, "uuid": "0dce53a6-6457-458a-862c-55fe7bbc7e6c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdb86c7-685d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668898732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898732, "uuid": "4b949ad4-7f96-41c8-9e77-1bd37d50c018", "comment": "Malware payload", "value": "1d7ae2c168a052f0aa3bd22fe3792876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898732, "uuid": "f89b07db-2ede-4f89-aae1-73a49110136f", "comment": "Malware payload", "value": "0670a29dc9d0d44332f04b658ffeef485db0be2570ea6426136d071876ffad30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898732, "uuid": "86c9ef02-2e19-497c-93f1-b7e3ce660387", "comment": "Malware payload", "value": "b1d32bfc1194eb7b773c4253a8f1737766e00b53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898732, "uuid": "464967d2-a34b-4057-958d-33d78f95f76e", "comment": "Malware payload", "value": "acec6a98ed4e646c73ecfa2b422917d360470cab77d5d425873cbf891d25d9d8985588d22cd6a1db3cfec87c69a8b901", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898732, "uuid": "6c099be2-7566-41eb-a5ae-040e23d038f6", "value": "T1DF74BE10FED0D0E6E5BDC571BA16CFE85678BCA16A21D91373746B5F2EF02908E62231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898732, "uuid": "a0855403-a4e0-4d90-8c63-599eea13d7e7", "value": "9fabaf303efb2031ad569e397ab31c33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898732, "uuid": "5be60cbf-b1a4-47c8-a10a-686a643d85a8", "value": "6144:2JOhXYi16ewn8jQDUICZhVV4E+O13oXc:wOZYY6SjQM0DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668898732, "uuid": "6eb6e1ec-d8d8-4346-872f-ccb6496d79b8", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668898732, "uuid": "9b21084f-a6b2-4f3e-b83f-6a45ab692b7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898732, "uuid": "924c4e5f-1bcf-451b-b4e0-d00add7fd1b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb062ac2-67cc-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668836533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836533, "uuid": "fa9df2fa-957c-429e-a452-bf20ce05f6b0", "comment": "Malware payload (Mirai)", "value": "603a9c60c7dba83a1bf1b6419a04e72f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836533, "uuid": "9e454d26-4caf-4f2f-bcc7-2251de766560", "comment": "Malware payload (Mirai)", "value": "07585523163f30a691ebb8c6f5e4915cfdc94c8ff012d1dac3566b7f771dca11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836533, "uuid": "c6268db9-aff1-423e-be05-6995d76537c2", "comment": "Malware payload (Mirai)", "value": "28f34def4950b71b3c0eedc2dfbf0610e384a16f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836533, "uuid": "21589f1c-b62c-4251-bd34-a687348627c8", "comment": "Malware payload (Mirai)", "value": "c7860d7cc0b880c030d37e7465fc9541223c3a1ddcb8c1a50a7b7e708fcaf970794402e04f1159476627a5a7b0e6be30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836533, "uuid": "83af6bfd-fdd6-45b4-9ed7-9cce13a7bf62", "value": "T114A2E015BF18868FC832693455D9EAD61292FC72F2ECCD592950C15FB0B33E92474F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836533, "uuid": "3f05a45b-440e-4149-a573-9f5004ce505e", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKb:M98o08kxofBE+ZkXaqGbp2F2TWul0c5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668836533, "uuid": "c26c5320-624d-438c-bb90-e1e61ca6eac2", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668836533, "uuid": "344d4b1e-2dda-4d11-8912-e80356069482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836533, "uuid": "b6ba9e5f-82e1-46c6-853e-8ce72376c9aa", "value": "603a9c60c7dba83a1bf1b6419a04e72f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423055d0-6829-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668876193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876193, "uuid": "0e4337f1-aeff-4021-9f9e-1f9ba2511425", "comment": "Malware payload (Mirai)", "value": "9f96be5463eaadef58ae9e1c50c6dcdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876193, "uuid": "6ab86617-b361-4b8e-ab2f-c5b15ed93904", "comment": "Malware payload (Mirai)", "value": "091ae3813b8d5b0e1b199f93d4372c30b14fd1187a2b2d00fbf485f607d22e99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876193, "uuid": "8584c51a-7fa9-4f19-b4f8-b47aa5628f40", "comment": "Malware payload (Mirai)", "value": "28178e0369d31425fded8df3260cdd05269420a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876193, "uuid": "bce308cc-d6ff-4c49-a1b8-61070186e8ae", "comment": "Malware payload (Mirai)", "value": "780ac4f6858e14cada9f3225d1ace83709124d1e42b1d9532133d7ab772ecf453c7039eabae662a92d1aac4e86e7a68c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876193, "uuid": "df146dd0-9e63-4e8e-9f12-d888d7559722", "value": "T115B2D0B092C7EEB0E370083ED868C9426BE72E76D4B5753E14845F3075828165AFE35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876193, "uuid": "b2766dfc-4102-4540-82a2-922af732041b", "value": "384:tzvqMeus+1pVGyezaa3Y0aLnp07XJU50fS949CQwUMOtF1A6LJilUeLu9hymdGUP:tzvgTcpQlma3byiVUWfScljoU9s3Uozs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668876193, "uuid": "7397091c-d1ff-4e1b-bd93-18a7b6040f90", "value": 24528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668876193, "uuid": "395748c9-08fc-4fe8-8fe1-4923c5d959e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876193, "uuid": "41712315-c854-4770-82f9-d7ccb4acb4a3", "value": "9f96be5463eaadef58ae9e1c50c6dcdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee37e583-685e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668899245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899245, "uuid": "3a947157-9b5f-4b9e-8ee7-409815b454b3", "comment": "Malware payload", "value": "c81badb5ed9b6b8e1dfe98500244cbeb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899245, "uuid": "4df838b0-bde5-4b84-9ac8-888c24dbe651", "comment": "Malware payload", "value": "0b1482290fad57d42705337dcb0c45acdc60f4925c1e8fd673638ebf41c78c23", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899245, "uuid": "230372bb-719a-4309-9f87-386a269052be", "comment": "Malware payload", "value": "d449e5bd20c9722ba5732d1868aaa14161f6f2fc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899245, "uuid": "634fe7e3-1012-440c-89a1-15ad8fcbf3d3", "comment": "Malware payload", "value": "23297bf7505ba3a8c66d8e3e47792d948a0dee0caa24b52e93910477567409842295e322456d134e5621dcc417c4b0fd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899245, "uuid": "952b4148-4eac-4e70-bd98-4576e3159486", "value": "T1972308003BEC812BF2BE5B78A8F26145867AF6637603D64D1CC451DB5713BC68A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899245, "uuid": "7adf561e-6b28-493e-b136-916f273d5e3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899245, "uuid": "fae7ecc0-305e-45c0-acc7-4cc7dc38582d", "value": "768:wuwCfTg46YbWUn8jjmo2qrLRT9khPIazjbngX3i5534mieqb2fwLGS4sjCBDZmx:wuwCfTgp/2+a3bgXSHIiqqfcL4Y8dmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668899245, "uuid": "5da5a31c-266e-4064-b680-ef096a46870e", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668899245, "uuid": "9df4f82b-81bc-4398-b36a-e775fd6df198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899245, "uuid": "0b935541-c47d-481e-865f-4fe683843ba8", "value": "bHl1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c79218-6857-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668896056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896056, "uuid": "aedd6be3-3513-4508-bdc3-db3847186868", "comment": "Malware payload (Mirai)", "value": "ae8c0a9f062452c5675fe53d8d983d49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896056, "uuid": "ba14278b-a1ff-4792-b090-34540bd5fdfc", "comment": "Malware payload (Mirai)", "value": "0b918c3493aec0447a11847803dc188a6ab26cb851f1b844592c4d20b4f89404", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896056, "uuid": "7240a68b-7043-4a24-97bd-fc2d51d65dfd", "comment": "Malware payload (Mirai)", "value": "f27ca27dca0a0b3ab39e1116130da09fb193f67e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896056, "uuid": "7bef675c-650a-44d8-a682-470b586231fa", "comment": "Malware payload (Mirai)", "value": "8a1e98d01deb484cf4715053a8117b64908029227f661760782aebef2a5774c9282ac96db0ddfae22347369b1cece996", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896056, "uuid": "a62b2b88-6690-4183-9f5b-dd7cba81dc3f", "value": "T160C2D0E07726F931C420AC3DE52B4D893A51063C91FE353664259D359FC2A5A63E48F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896056, "uuid": "1a5e5c64-a135-4cb9-a091-df6dfa7e1966", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrY9q3UELu6:NKy4qfqoeJdXWgBLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668896056, "uuid": "611d92f1-c87b-418a-9174-6dd142bd1270", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668896056, "uuid": "814f8f9d-c0f0-48af-88f8-225d967c907e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896056, "uuid": "f4e19668-3339-481b-9818-0bdbbdec2f81", "value": "ae8c0a9f062452c5675fe53d8d983d49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffee18f-6800-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "b87a8273-01c4-4643-9a16-d42faa69ae4d", "comment": "Malware payload (Mirai)", "value": "06890d423a136585aa4f961c2999fa05", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "f08a9529-3bcf-43c6-96a4-2bd625048482", "comment": "Malware payload (Mirai)", "value": "0bfd9ead53438bc76307ffa73ff077d93859f6d4c11fcec74acbd3a2641485fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "4ad74f10-2593-41c6-aad1-1f2eba0885fd", "comment": "Malware payload (Mirai)", "value": "389028bec57866c182ec0cd18e137386c9a1555c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "50e1d1e6-8ead-4ff6-9728-dfa204ae6e51", "comment": "Malware payload (Mirai)", "value": "c80a02e8d92025584679c888d003f06e833e562c19faf41bc2a8f39f2e4e653510c24bb82f2b8e848b2901081bbf3da5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858606, "uuid": "dddd6abf-e251-4bf5-918f-c596dd715190", "value": "T13CC2E1BFBBE62967FA5C233DE035801B03A9F41C97A92B9727404532A95E81D7132CD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858606, "uuid": "5f471e39-5be5-4aa5-973b-7a59e32510c2", "value": "384:MX1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHtKKOGD:qMwxdyoEUnDz+Y8tqHWXmNFi70NL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858606, "uuid": "ee3b5567-a707-4442-90fc-20b99c663c31", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858606, "uuid": "6f510aba-0c72-450a-8903-2b4931542d0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858606, "uuid": "b298122c-84a3-494e-b6fa-cee950adcecd", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30205e3-67ff-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858316, "uuid": "8ecbe17a-1e16-4f9f-8c03-7a861e288b6e", "comment": "Malware payload (Mirai)", "value": "77a2afe71c4f93677e836ab16ca36aab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858316, "uuid": "7b8b3b28-d25c-44fd-a08c-c3fcce19dd64", "comment": "Malware payload (Mirai)", "value": "0ce76e53a62366c438b24cc7d06e3c42bf348f2063c2aedd951891ee2aebb71f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858316, "uuid": "7657f356-7953-462d-bbb2-99e1d491a36f", "comment": "Malware payload (Mirai)", "value": "1f09066c2684834c84ce3eff8154fc82986f6e99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858316, "uuid": "946b620d-5e56-49c3-933c-289dc246fb4a", "comment": "Malware payload (Mirai)", "value": "2fc058186ec972eeb4230f7f42f39016978656d08c89580684f60669db99bbb35bf3af19dece4eaacf83c7986bf821e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858316, "uuid": "6d860a63-11cd-45a8-9d79-ad50a14835bf", "value": "T1F1F2E1FD81D82DC9CC2D197972A903858C7272823B9907091377C4D9BDA678EFC86C69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858316, "uuid": "9fb4f934-d279-4673-a2bd-f735f679d2be", "value": "768:lnKh0BBIroCRXARNlRVJDPxRl+ZqI1gApDnV9QUvYQDmULAZqmWwgPWX:lnixL9ApRVJDxRI0+gMV9QUABUL6rgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858316, "uuid": "8e6bd198-0f2d-4652-a089-4a4db0838feb", "value": 36696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858316, "uuid": "c25998a5-b5ca-448b-ac29-26bee93ae192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858316, "uuid": "7f37c193-5229-4a4c-b21c-d0f66c86c044", "value": "77a2afe71c4f93677e836ab16ca36aab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3054868-6808-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668862209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862209, "uuid": "f466a10c-6160-4e40-859b-ff9521aa5347", "comment": "Malware payload (Mirai)", "value": "d2535a8e503ad1ca00dbb2fe59e17a76", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862209, "uuid": "6609958c-8810-4f67-9199-6841284a7213", "comment": "Malware payload (Mirai)", "value": "0d3a5f0d43b7746160ebf558542c499329f201e15ef67e3a860999c060bd6db5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862209, "uuid": "f644557d-d259-4722-b5e0-3e62d13c335c", "comment": "Malware payload (Mirai)", "value": "a26e531540549c452faee4d9df88e8cbdeb663d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862209, "uuid": "54435d43-e471-4ae0-8ce9-9d2fa346b27b", "comment": "Malware payload (Mirai)", "value": "9826bd111bfe8a889498c116b4a17adf5bdd58db47f0e39c6ae6864418db50ec1d21af7b7b7b8bfefa4c990362463f1b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862209, "uuid": "85b1802f-be74-44e0-a321-a85ddce68901", "value": "T121733A85BD41A722C6CA527BFB2F028D332613E8D2EA33078E255B75778782B0D67715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862209, "uuid": "508165f1-d13b-4187-9a19-1c2df807ee97", "value": "1536:TcJQ1lDz8UJk4F7OeIhe0lpVTJn5IHo1cjhXOaEWdn1iMhvyE:TcJQ1lDgUJkWOeSbDKHokRV1TyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668862209, "uuid": "339c02c1-4c61-492a-b465-225db1495f5b", "value": 79172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668862209, "uuid": "49276fe8-7943-43f4-886f-77fb835c042e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862209, "uuid": "4dd9f0c2-c69e-4d99-b991-7e1c3ef91f2b", "value": "garm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad945b1-67f6-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668854383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854383, "uuid": "9e4aa0eb-28a1-4d54-8f11-e90c09ba22d5", "comment": "Malware payload (Smoke Loader)", "value": "d02db620197436caf9b9dc698d147c02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854383, "uuid": "d82d4149-4b5c-4454-817f-b6118b76b24b", "comment": "Malware payload (Smoke Loader)", "value": "0dc25696937be51fca6c3051b9f113b1246dd1e377e6b9641c4d5e34883f5752", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854383, "uuid": "706a561b-a5c5-450d-82bf-94399be8cf90", "comment": "Malware payload (Smoke Loader)", "value": "741f54a9d47b02fb758d1ab4c373e7a05c622767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854383, "uuid": "7ecf28c9-c365-40b5-9667-917670a49100", "comment": "Malware payload (Smoke Loader)", "value": "77026858fa7abaac0c7a1ae9bf2b55dcc1ed624ecab342bac135ac7525f87255ffbbd05f29fa982a8848612da4b6e7ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854383, "uuid": "b4cf11b1-f9b8-4140-9f93-88f5c2c9e474", "value": "T14074CE3472B0D4B1F1210670C425CBA465B8EC227924DA533755FF7F2E30A9D96BE27A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854383, "uuid": "9f02568a-b956-4a29-9e00-3746818fe79e", "value": "045163335c785d665aeb43938f4d94be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854383, "uuid": "a02e383b-eb89-4d69-b648-98df4d6597ec", "value": "6144:4fVmJNqVZMtA3aSAY0rcClw3jpPnFwCLLObfwB:8mJNYZMu3aZZwTxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668854383, "uuid": "6733dfeb-b9c2-4b35-b23a-72aba0fe6e9d", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668854383, "uuid": "da12300b-2973-4c64-a9ae-a2e50a0f3c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854383, "uuid": "555ff487-53f9-4b4d-9b1c-d8a95b70b3f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84611aa8-67e5-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668847098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847098, "uuid": "65e17472-0101-487a-98b6-e6c9e215bf16", "comment": "Malware payload (Smoke Loader)", "value": "9a0321eba1cc76eb06acf4ef2712703f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847098, "uuid": "81ee985c-adbf-47ab-8fc4-91141f617139", "comment": "Malware payload (Smoke Loader)", "value": "0e5ae8474e5977d343b2564659a7aec39933ad310f22bc0961723498d53192a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847098, "uuid": "1cdb8d8a-ae2f-4f8d-b5a6-37c41c3b6b2a", "comment": "Malware payload (Smoke Loader)", "value": "3cecf7bbb42cdeb83e40590dc4d0d03de94206a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847098, "uuid": "458799fa-dce6-48a5-93e8-f9298ddc0359", "comment": "Malware payload (Smoke Loader)", "value": "b9d22a5ab76029b85a961c1f41c29fcf6ef37dda8af6cdc339c3937872ba16a6684ef04f3692f245af1f9faa97a65ded", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847098, "uuid": "fd6793de-82bd-44f1-ad3a-04513ccebb64", "value": "T1B974BE3472B0C8F1E1724674C825CBA16AB9F8317914DA037264FB7F6E30B9C56AE275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847098, "uuid": "51d9e381-0d25-4063-91dc-e5f36df696b5", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847098, "uuid": "c3792a49-b527-486c-8e1c-3a0608f13ddb", "value": "6144:GA6atoznq/+ch4k3a8ctgBUZajpPnFwCLLObfwB:+at6O3V3RctIUZMxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668847098, "uuid": "b10b0c9d-a3a6-40e4-8476-14762462373c", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668847098, "uuid": "af929899-fe74-4dfa-9221-8846b9ab8268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847098, "uuid": "cc209f9f-42e2-4644-94dd-2869eaa8b9f5", "value": "9a0321eba1cc76eb06acf4ef2712703f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8534b0-67f7-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668855009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855009, "uuid": "e39e0574-a50d-4fae-9427-3c370dd89b75", "comment": "Malware payload (Mirai)", "value": "42c91c791dc948fd5169cc0ac785bfb2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855009, "uuid": "52115434-fcc8-418f-bd2e-53f44154364d", "comment": "Malware payload (Mirai)", "value": "0e641721f2ea49d601f96ca9df0555a38f8d57f5a2fc54d13c6b5de2585a0c8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855009, "uuid": "7115477e-e146-41f3-ba55-5bd40780c2bc", "comment": "Malware payload (Mirai)", "value": "80bdcaf5a909ba81616f46dff9f03b1fe0c69032", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855009, "uuid": "560994b3-2385-48ff-a2ba-84727a0a89f2", "comment": "Malware payload (Mirai)", "value": "caf6ac455dde6b6772bfde556c72d9af7fe62a2a7bebd846c112cd7fa0913cba3f08f7bdda04a5c65630828d8639d654", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855009, "uuid": "b5b95c37-5adc-4f1a-a693-e2ef434a5536", "value": "T121E2E0915042D171E8F09533BBF4C31AB23522B487F97BB35D5813EAAEF5B80137968A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855009, "uuid": "2446a13d-4339-4c69-905d-059073e40f9b", "value": "768:E/QOcps3PpS+KMUzjMwIrQZi7AXMcQEAO95k9s3UozSy:E/RcG3KzOql8a1zZzSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668855009, "uuid": "d833eb8f-7694-4d5c-90d9-d981ee307841", "value": 34008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668855009, "uuid": "cce4944d-37b0-4662-a75c-2c577c3dd185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855009, "uuid": "9a2a264e-9072-4a72-a4f3-46d5648c0483", "value": "hotnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9925992e-679f-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1668817068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817068, "uuid": "f795c01a-cf88-4843-b699-21bab417ac90", "comment": "Malware payload (AgentTesla)", "value": "8d3fc536c97e1030886d193c74a45150", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817068, "uuid": "ac6acdf8-d6eb-485f-a6b5-7553f8734be6", "comment": "Malware payload (AgentTesla)", "value": "0e73ec157e7a0a55472934856ccafe17fe94b863172fa080ef3144ed99369c45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817068, "uuid": "643ad8a9-b26d-4bc6-9eea-9a5eb1ebc236", "comment": "Malware payload (AgentTesla)", "value": "d47ee6cc0ae6fa46caac87d5cfc3945aa4397367", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817068, "uuid": "62260721-327d-480f-a0a6-46bdee03d1e9", "comment": "Malware payload (AgentTesla)", "value": "7f17a2a5a84ad1c64234a0f0313b2b1aa28bd6db59ac7ec00d77c02e94fef249de32e2a8e6f98478867d5f214267be3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817068, "uuid": "ec9e3a2f-7fda-487d-b2db-73c5429a0b2c", "value": "T1C9055AE978936D6ED0B8727D54F1E890CBB38C724EC1AE2551A83DC26D336D3B0519E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817068, "uuid": "918c1808-1573-4c6c-bfdf-14597f5ab367", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817068, "uuid": "d008cac8-29f5-4100-ad88-d5456ef10666", "value": "24576:FFjZnbCkITnG3ch9YoFcxVv56THktxEUWF5r:HjZnbCkITnrr/Kx+TEDEUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668817068, "uuid": "9622c9ea-0363-458a-845b-ac1dd57b5340", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668817068, "uuid": "33983e96-023a-4422-a86f-da0262d3f2dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817068, "uuid": "3dc721a7-80dc-4f1b-a919-de382b055d5a", "value": "payment advise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1009528-67cc-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668836543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836543, "uuid": "1f75745b-4e79-4d43-9368-af17f77e925f", "comment": "Malware payload (Mirai)", "value": "c012c888df40ec05e60d5241251e8a9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836543, "uuid": "ea4d4f15-c0ca-4ef0-9146-cc828438506a", "comment": "Malware payload (Mirai)", "value": "0ee40bc9590b0fdb344e74048f020bbb9f1b9285f392ca7a5d9deb980efd19c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836543, "uuid": "b10785f9-8de1-4c9f-b6a0-1c1b6f24cf0f", "comment": "Malware payload (Mirai)", "value": "c8260860745077e89791fea08577b3a4b737b49f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836543, "uuid": "57677c99-b419-4fe9-af3d-d808c9491bf2", "comment": "Malware payload (Mirai)", "value": "25100d04e6e60609da347f89eeb0e78eb7ca703eee0e9d23b1a1491bc9baa1d9b8efb74d7b503ff4e98eada2fc7afad8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836543, "uuid": "b81af73e-a299-42b1-9435-1d3c312dd519", "value": "T19882CF3051AB74E8DBE10431FAAE8EC6971A0BB8D1FC36D217586B78C94200261F92D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836543, "uuid": "64af1e6d-2e74-44f0-a963-9f283fc6d14f", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMamhymdGUop5h5lO:2dV0P6+kom0tVAoNvm+to1ms3UoznlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668836543, "uuid": "c7bb31aa-ff7d-4cfe-a7c0-4b16c9790535", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668836543, "uuid": "1c9102bd-8cb8-4eac-88a0-a87ad57a0cb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836543, "uuid": "c976e2a2-cc09-45b1-93ae-dcad1cc5fc45", "value": "c012c888df40ec05e60d5241251e8a9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b2ed42-6811-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668865805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865805, "uuid": "4f967167-5746-4a5f-a2d6-a7f61f022551", "comment": "Malware payload (Mirai)", "value": "cb5f74a3e824c1a3ce967296373499f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865805, "uuid": "eec49976-2e5d-41b3-8314-1eda6dbc14f3", "comment": "Malware payload (Mirai)", "value": "1053541d3c25d34fbda0bfea9b0ab517cf997d60d0cfb85fcd78cbf00cbc4ee1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865805, "uuid": "2416eaca-5e4f-4e81-af49-be91eb1cd1fb", "comment": "Malware payload (Mirai)", "value": "52581b7a3d8f69c0421ca857368104f0b1dea02f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865805, "uuid": "e6404dd3-ac8f-47ca-8670-e33d1171ae7f", "comment": "Malware payload (Mirai)", "value": "c6005977bc87428deadb6baed9b17564cea2837ea6c0898d1a66742f885165266fe2fff90c866100c41ec974d599a57b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668865805, "uuid": "06482228-fc36-49c3-8901-fe1f5902b679", "value": "T1A703F2E1EB824325FE5C83751EBFB2035500EAAFA082D67FBE4853317264D45316CA5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668865805, "uuid": "d873a3de-8b50-4832-a5d7-c93b09704a4c", "value": "768:SbGHrvv0k7He6VjPWpn558JnW4ADya9VWmlYiJcnQMDS+KYnbcuyD7UHQRjr:iGLvF7HeajEn55cW4Ays+0cJuSnouy8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668865805, "uuid": "1b0ed333-c55b-4c63-baf9-5da440d94781", "value": 37908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668865805, "uuid": "95526b1b-8c21-411d-97ee-deeb68e0548d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668865805, "uuid": "f4e3f2cf-5f5f-4ba2-a534-06a022ed35de", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c34cde2-685e-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668899053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899053, "uuid": "d6587e35-cd04-4eca-8c71-7f6675116e09", "comment": "Malware payload (Mirai)", "value": "36890becf37624a324dc1c07147866e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899053, "uuid": "4fba8db8-b341-447e-b3b5-095bdc587583", "comment": "Malware payload (Mirai)", "value": "1220fa1917d0363510a342147afa5c95bd3e1f05d70aa54ae18e253469202d16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899053, "uuid": "eb2da390-e961-4bef-a13f-00e220157a55", "comment": "Malware payload (Mirai)", "value": "9f88153030e96f3f291e8a4a8198a1fc0f374b38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899053, "uuid": "4da92d8f-b0d2-49a6-a61f-c2482a030568", "comment": "Malware payload (Mirai)", "value": "77a7ec456cd7aebe30fdd8a9af80317d0e2f04e4d7c54a428f6d21b5d0af9eb283b62b1f21ac8f2bf71a98057ce9018e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899053, "uuid": "654e065e-ada2-4995-9f10-d7b507be2902", "value": "T16613F2A8E2336F43F7B399B88901D2C17B260FC717A4CE9752A177C24552C68228DDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899053, "uuid": "265b17d0-16df-40d4-8701-8afb5eaf88ae", "value": "768:1fkoh17Al0eiVagtpFeYCa7mMrAvnRkTLE5DMQQj73sxVW/Rjp52EnraZ4uVcqg1:5H1IHiVvpFeYCADsnR+E5DMjj73sMf2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668899053, "uuid": "df936f46-e285-4a27-96b6-d4471e6c9c7a", "value": 42176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668899053, "uuid": "3877c7fc-186c-47d5-8fa5-e0c5a5051d18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899053, "uuid": "101fadc9-c579-4e13-be39-c3a38c8c3325", "value": "36890becf37624a324dc1c07147866e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bfd8c55-67ff-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858304, "uuid": "191d4f4d-d028-4e80-8ac1-c393398ecb79", "comment": "Malware payload (Mirai)", "value": "0aa50f0b2860e7f1c79c7bbf89e995a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858304, "uuid": "72d7afb4-db63-4f14-b3b5-67f2ffd7e366", "comment": "Malware payload (Mirai)", "value": "12ea30e2e916f034667b2120d28515bfb51d0d48ab9674d3fba098630a942e93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858304, "uuid": "bbd30a22-07b0-4cb1-8ade-d759b31addc9", "comment": "Malware payload (Mirai)", "value": "575517998f745bf6f2935fed698aa2eb7ef7adb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858304, "uuid": "98ba9154-2472-46ea-b02e-ba7b2730c92f", "comment": "Malware payload (Mirai)", "value": "333e3226b692ae327131222705b88257fd31a7525ce18e610146ce8f77b7cde0f580c6b747166b7602ef26c9604d8620", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858304, "uuid": "39fa460d-04aa-47cd-ab2c-9c77295ed611", "value": "T1E403E1D641121CF1C5B054B6DC18094DBB638FB5E0EAB1A56D5BD08899CC98B2FBF4CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858304, "uuid": "2dfeba8b-f98f-4ff9-a407-ccb1753a04ea", "value": "768:gZ0fR2wkuUW2rBTF6BbOj8wTuF3s2RknvV0q9ULkk0GVOTPR9Qq99q3UELP1:o0Z2puydMBg8uuF3sdV0q9UofgOT8dL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858304, "uuid": "ee3bf4e7-6f38-418d-9c56-f26e896f38aa", "value": 38688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858304, "uuid": "e4edc9e6-963f-467d-95af-1e8a1587fd8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858304, "uuid": "c713636a-7213-4255-b9b2-4dae4ca1df04", "value": "0aa50f0b2860e7f1c79c7bbf89e995a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b509fa-679e-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668816388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816388, "uuid": "4a144ea6-08d5-43a5-87e0-98d2bebe995b", "comment": "Malware payload (Amadey)", "value": "dc406cbf8bda34be18bd9c63a1eecd4f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816388, "uuid": "dcf6ea6f-3f8f-490f-96fe-4197b838d0a6", "comment": "Malware payload (Amadey)", "value": "1313f33294a3be99ec0414918ff91059c8e3cdb3916d4d8e7302cd822f99a2b2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816388, "uuid": "234edd4f-9395-4f00-bdbe-8204f307b39d", "comment": "Malware payload (Amadey)", "value": "b93a0ffc22418d9d2316e81083f1f3202bf16430", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816388, "uuid": "68b15b1f-178c-4ee3-93eb-b2f59e2ebd54", "comment": "Malware payload (Amadey)", "value": "d42705c441755ad4fff42e23372d92c27ad86d25c5cf2fe757809efd9672b4ca5bcc0803112a1ff408088c34d56d48bd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816388, "uuid": "62d6a288-80b2-43a2-a1c1-a36e2ecf5f52", "value": "T14084BE10F280FD72C5910A7188DDEBB6AE6DAC516F158AC732B8EE5F2E341D065B234D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816388, "uuid": "6983a795-07e9-4442-8eaf-137c9fc0cd0a", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816388, "uuid": "afb6860c-ed5f-4bf8-8bc1-c097b4d65f87", "value": "6144:58Y8ezrUR74GaXIoCIMP+rOnzKkOh+3oQ9gOU+fzYBb6:n8wE8jYoCFMOzKa9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668816388, "uuid": "70d75dd9-ee38-4305-a1cd-2e9b33b2f81d", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668816388, "uuid": "45aa3094-1026-46d6-8f57-bf2cef16ea9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816388, "uuid": "68c561d8-29a2-485d-a997-501193dec53c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0373d5-67d1-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1668838311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838311, "uuid": "21d537dd-eca5-48ec-97a2-b14b43cb6286", "comment": "Malware payload (RemcosRAT)", "value": "e2de5b66b334794c444f3957b2b22d3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838311, "uuid": "9d808086-a38c-417c-91b3-caf3c61afbbc", "comment": "Malware payload (RemcosRAT)", "value": "139d0b13776f8fea46db2d77f0391b480cf290abcca453aacd2e003e7a618787", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838311, "uuid": "271d177f-1bfe-4662-9f02-4adf16569307", "comment": "Malware payload (RemcosRAT)", "value": "2d3e7fbd7fecc2fe68a0889cc648b03de4144e41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838311, "uuid": "09566f09-4381-4220-9795-2ba7ce2d916b", "comment": "Malware payload (RemcosRAT)", "value": "3a940eb9dc7cec24ff1c478693df3e45c5aa2d36759b21b643b5e49c228b894c702b00b5c82d030c0460340d389d98b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838311, "uuid": "43bce8a1-8497-4116-bc08-0114e6a62320", "value": "T13DB56AB2DE3A0C37F44B45AD908319E51E38C46F0358643E2551F9B37A8F6F9483AA9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838311, "uuid": "69df068a-aae3-4b71-b832-8f1fc805ecbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838311, "uuid": "c16b173e-0b4a-4f84-8b9f-821e1056c9f8", "value": "49152:dvBRQgqEulcHXpJGtr6YzOAsNK10BfJXA:dBRQG3p4BdyAsw0BfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668838311, "uuid": "f5cc8fcc-1279-451e-8e80-204e14071fa3", "value": 2467840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668838311, "uuid": "71843e20-5158-4d5d-aeff-694e5e65b32f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838311, "uuid": "49d7e053-5f7a-45d4-b55e-2c97a7eb3a3c", "value": "e2de5b66b334794c444f3957b2b22d3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d474f4-682b-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668877217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668877217, "uuid": "3e058a16-6945-4585-a74e-84c805295c83", "comment": "Malware payload (RedLineStealer)", "value": "2688c4212d4efc2afd98f2547c556988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668877217, "uuid": "edd8e563-b4cf-4437-859d-6645395ce51a", "comment": "Malware payload (RedLineStealer)", "value": "13fdfb7cb605ccb2cacf3e14906d1954e44d9c25da990d3f5b8e4f1ab052e1cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668877217, "uuid": "eac6acf3-ab85-43a7-bd82-f44ad31ba7f4", "comment": "Malware payload (RedLineStealer)", "value": "85478882fe5928d72272173f768320d1d7a29b1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668877217, "uuid": "822fa440-59ac-4e4c-94ac-45ae65b6f0cf", "comment": "Malware payload (RedLineStealer)", "value": "460ac1e273647f43fc888b92f53c8bdeaff6295efceebd8388d119c103c140776c3a9bd054a6613b20198e659e4f0249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668877217, "uuid": "c3d8252a-2501-4325-af41-1eecc0dcd10f", "value": "T14C85CFA296073F5BD3D516F4C463CE0635775BD80A1C4AFBA7E532EF181AE05888782E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668877217, "uuid": "8514feda-c233-4c06-908d-63b6fc055b8d", "value": "c87c269684dd62d98968492b86dd710d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668877217, "uuid": "03870436-33c8-4f37-9044-700de60614af", "value": "24576:1o3IkOFE5Va83xI+xNeKoyMGBatirzL3712s/x1O8fPtqE7j5AGy8qAgyNk:1o3nV3e+xNeKoL+n371J1OucSiGyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668877217, "uuid": "09b0ab07-7495-4b4c-9cac-0d0996f89182", "value": 1831400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668877217, "uuid": "785e2cfd-a433-4ef5-ad43-17f8d648c3d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668877217, "uuid": "7c42fe88-641b-4cd7-b393-5aedd63f2592", "value": "13fdfb7cb605ccb2cacf3e14906d1954e44d9c25da990.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe6f71b-6831-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668879920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879920, "uuid": "c69c1775-b889-4c2b-bcf1-72d8f38b7d44", "comment": "Malware payload (GCleaner)", "value": "33f2d9281aff0a4603b84b6cd0faedfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879920, "uuid": "45a35698-8356-435c-97a0-911018e007cc", "comment": "Malware payload (GCleaner)", "value": "140ebd198dfa91959f8f8c06b8c4c9efcfb421293d4d1d27b52b40774b1f1a2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879920, "uuid": "0c60e1e1-3d12-49c1-9be5-04e5e480c02b", "comment": "Malware payload (GCleaner)", "value": "3bd631ccf7eadd28df12d22b16f8b33be7dd9dc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879920, "uuid": "21e6796e-89d8-46da-bf0f-196bae9be38a", "comment": "Malware payload (GCleaner)", "value": "4b7a9fd14dcd8ebca46f398afa711659f1e11cc122aea5a724a2202b553151b599d9b4add256de6633f4aeb7e051fb6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879920, "uuid": "186c0875-fb4e-4271-b59a-49e0adb56df2", "value": "T19BC5F0556A42C2A1C92F5DF0E65130F98DB63DA2E82E827BF7967C0DFE7D347840A502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879920, "uuid": "ff2bedf6-5a60-47e8-8932-bfc9b716d921", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879920, "uuid": "856b588e-241a-40f3-8fd6-ebf9c18a53c6", "value": "49152:q26290KrA2Ljpc4OdnHiEJIUrmN5MOcbzc6lh/OeKI/9nmY8UxVkBaFwnm:r629PHROdnHnHnOI/OU8UxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879920, "uuid": "3d78778a-2166-4c6a-835f-2e4a149bd0cd", "value": 2497731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879920, "uuid": "8d3b22c0-4cf0-4e92-b453-2e47570e1bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879920, "uuid": "9edaac31-a035-4034-b38e-61321164c334", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee9ad40-6843-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668887408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887408, "uuid": "ec59a46a-c35c-4126-a7d9-a51022dd76cf", "comment": "Malware payload (Mirai)", "value": "b0476110cf68842347c982633c26973b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887408, "uuid": "8dfa9243-64fe-4275-981b-2520c100d9f6", "comment": "Malware payload (Mirai)", "value": "1428c3957d775feb0f27754f2dde56a2d62a97839393af195e8d11d1413443cb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887408, "uuid": "beb1d7ba-a9cc-428e-896e-13640744ca97", "comment": "Malware payload (Mirai)", "value": "98c95e6883671b602107ab58c9a6749c71f9c134", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887408, "uuid": "54c6f034-759d-4a8b-8f75-de1eded94fb1", "comment": "Malware payload (Mirai)", "value": "3b9a9b88a30fc6a4353de67245d95e6fc21538ec010724c32a3b1750cde363be145d2e5208ff4e8e780e7cb84287133f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668887408, "uuid": "dab04238-697a-447a-aa40-c80d9e74e500", "value": "T1C4A2D042935B8DB2C9F08D3BCB3987CAB2598F5D90FD71A9195D055C9A0938B28FF182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668887408, "uuid": "40cf20cd-67d7-43f8-af9e-fb86137a4332", "value": "384:87AAOl5tDfreTpLbbnSMs762kil5+tkORa0s9MKT1WYdxEZXhymdGUop5hz:pAOFDfrelLb+l76vi2td3s6KT1Wwx0sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668887408, "uuid": "a64a217f-0af1-4441-8dc9-b1aef9775691", "value": 21848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668887408, "uuid": "7cfb0054-eeb5-4f5e-8038-533650fc9f35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668887408, "uuid": "53fdb00a-ae6a-4ee4-8033-dcad3d5d724a", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff80ff7-682d-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668878149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668878149, "uuid": "e679ccef-e24b-45a5-a30f-8d63e52cc4a7", "comment": "Malware payload (GCleaner)", "value": "7ee073b554a6da074572f8c7a092e7c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668878149, "uuid": "15b14f2d-236a-421d-a5ab-df2487457ef5", "comment": "Malware payload (GCleaner)", "value": "143a47acace8e68dd93e4d9570606866bc0230c5291168dbd06b1832a0adfae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668878149, "uuid": "89c4799b-0d8a-4285-a1d0-423fabfe47ac", "comment": "Malware payload (GCleaner)", "value": "c48a94a1c706c5d352ab891d351c8aad5e59c0c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668878149, "uuid": "9aaa689d-cdc1-45f1-850e-6e882f85e6b1", "comment": "Malware payload (GCleaner)", "value": "da90ef4bed4956156143344c9a6e1f1997dc22584e1b9d2b28858a04b29ce77f26f0266a3a2bc6c729f495a861b68e11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668878149, "uuid": "f54250fd-d3e4-4f74-83e0-c2138c4063eb", "value": "T177C5F0016A46C695C82F6DF0E66474F889BA3D62E82EC27BF7823C5DFE3D3978409511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668878149, "uuid": "014f9aab-93d5-48b8-9107-b5aaaa652776", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668878149, "uuid": "78434433-1690-4160-85bb-029bde35975b", "value": "49152:q2jeuHFGg4k/FPPFiaYFYLHL6BZH0WWrmB6QDYPRsN4AUxVkBaFwnm:rjj0gRFPPFiavTY6QkPRsN4AUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668878149, "uuid": "2324f24d-c25c-4aa1-86a3-37a3503841ff", "value": 2509578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668878149, "uuid": "bc98f317-3c44-4012-a0c0-5114e9fb45fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668878149, "uuid": "155f7eec-e81e-4724-8ed0-5c554d4fcbdd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f21c2bf-681a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668869718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668869718, "uuid": "f0febb38-7bb0-4681-8317-d9b602b1f9a9", "comment": "Malware payload", "value": "1d3c8ff94dac97046e1981e1281431fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668869718, "uuid": "266cdbec-06aa-4aed-91c1-1b6b289c78f3", "comment": "Malware payload", "value": "1616e34f3c32750dc17ff79b5bf26e98b9b5cc183424c5d4961e64f148ce5b5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668869718, "uuid": "7079064f-8a86-4e51-80b3-a07b5912890f", "comment": "Malware payload", "value": "497c40eb907601df4d1f967fa4bc9fd55b34c685", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668869718, "uuid": "8c6d7cf7-d8a3-461b-b750-1deb3914ae88", "comment": "Malware payload", "value": "cdb9ec05bfd79c510d6097c05caa58b3791f4fbfb4c82866277b37fc1f415b8fa676b541821b334dafed5d06546dc942", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668869718, "uuid": "24203692-4d56-4b19-b951-3984d1d937b5", "value": "T18584BE6A76A98A14C3843E71D1A356386BA2F5477633F34E2F49A5976C033F08E483D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668869718, "uuid": "4a06d46a-8cf2-4386-baa3-2d7f60dabd41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668869718, "uuid": "d95238a9-a2b4-4960-9884-9ece9246a06d", "value": "6144:EEIjYgqELAYGVSjTAaxgg1u6ok9LCwKInejTKXkY4TRLQ2R7/TlUudTJ:U+KAyrgWhlCwKMXkY4TRLr/xUuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668869718, "uuid": "ce779d58-0467-415d-8ae3-a02b90e53668", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668869718, "uuid": "2ab9ad77-acc8-463c-84da-fa7b712d2e74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668869718, "uuid": "677c6f6e-1bd6-4687-8755-c6f56e9c6cca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b7e96f-67ec-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1668849914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849914, "uuid": "2bbec9b5-61f2-4ea6-a148-8b225c5899e6", "comment": "Malware payload (njrat)", "value": "72ee3e5c858ddd7b087aedcdf72b1a78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849914, "uuid": "ce4d11cf-baa3-4fdc-bf54-992f6b7a572e", "comment": "Malware payload (njrat)", "value": "1691129a2da4f7e3dbbb7ecafc38d52a64a31b8c5af67f9fe9e8aecc8d6a699f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849914, "uuid": "e0c97d8a-5856-4c12-8d61-de3eba782f1a", "comment": "Malware payload (njrat)", "value": "f2d957f98623aaf4e512ebe4c4071a23198c0360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849914, "uuid": "0f60e414-baa1-4264-8a0f-124c6fd64900", "comment": "Malware payload (njrat)", "value": "4abee240b1e2549ba238efb454cc547f6097197239b9215984e0999e2045e3cc92d099ad69d1817663df698dffcedacd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849914, "uuid": "71b676df-8c22-4468-9e66-74d2bcc10cef", "value": "T137E21BADFBE64466D2BD0AB50571950053B4E003E523F77E4ECA24E62B6B3D84B84DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849914, "uuid": "dcb371a1-2236-4fcc-afd4-b04c0fab9c16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849914, "uuid": "4b45a294-39d2-44bc-aad5-4dde2ecfb63f", "value": "768:2Nu5RgJZLrGzxhuc0v0qvZhvv8dQmIDUu0tiySj:XUKAVR4QVkYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668849914, "uuid": "134b548c-b491-42f7-b7ea-ed61a45e874f", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668849914, "uuid": "6d8a1c53-a308-49f5-9e6b-089c99a13e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849914, "uuid": "241e7c5e-8dd8-4f59-bf91-a6ff2cc8057e", "value": "72ee3e5c858ddd7b087aedcdf72b1a78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767cdf61-6838-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668882723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882723, "uuid": "96ebb1f6-c0a2-4793-b7b1-fa7d963aa58e", "comment": "Malware payload", "value": "3ea93c845decd6168ecdce865a6ad0b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882723, "uuid": "a9d48936-822b-407f-bbfa-0c29db145322", "comment": "Malware payload", "value": "16bce1054e53a69df603900dfd733bb849d15c2fd800f445f36c7bb4cd6b81ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882723, "uuid": "198247e2-27df-42f1-97c1-8e1091aa12e7", "comment": "Malware payload", "value": "af6ffac9dd61ed17e645dc71e7967fcd5efd6b58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882723, "uuid": "50dd7bfc-eb64-426b-bd29-ae0b3609b2ae", "comment": "Malware payload", "value": "0cac219ad47b76f972498324fde2652b402a3323994e54933661b1e8741683617f0d1f8211507e41002aa9c3b62eb1ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882723, "uuid": "f4dd1090-05a2-4f7e-bbaa-9a8f734ac72e", "value": "T15FA33901B2D18472F0B35E3218B59AB15A2DFD318F649EEF2798125E0F641E19E35EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882723, "uuid": "c7940b3c-6528-48d6-949c-9e9fe6ac2b8b", "value": "61d37f3a8b5a155487f5b8475e46e132", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882723, "uuid": "e63d999e-3ebd-4898-be6f-6c526c42d405", "value": "3072:KYXTE1eEZ7z58oZIGDO3Dy+jBUWHwJhT30:KYXo13A4T30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668882723, "uuid": "ea7c4075-ffb6-44d1-a31c-2fd485570872", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668882723, "uuid": "50c7e535-e8cb-4868-b1fe-d7423d0bba6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882723, "uuid": "20624219-e70d-44a6-91d4-4e4fc94ce217", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5428c8cb-67e5-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668847017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847017, "uuid": "2ef29bab-b0fc-46e3-838c-d1d5b3bcad7a", "comment": "Malware payload (Mirai)", "value": "ef7f1df6735d72eeeb515145314ebfe1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847017, "uuid": "38ee6370-139c-4fa5-815a-aa8ab6926ca6", "comment": "Malware payload (Mirai)", "value": "18426a8eaf85036a1dc5153876fbecaf7cacd21fdf3d69e10a80cf0745c8ffd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847017, "uuid": "9accf64e-fbce-4f0f-ac87-3783f59fc4fc", "comment": "Malware payload (Mirai)", "value": "df9ce482d3afdcd901ad99be52097a119c48afbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847017, "uuid": "4567e709-d2c9-404d-b8ba-6852cc1c3d90", "comment": "Malware payload (Mirai)", "value": "338dac92168767d84471d15e5bfd1973331793ac67fce2742b0dd53b89e8a3ad7676e76e7ac3966e864d7eb64eb2c36a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847017, "uuid": "65fb87b0-1f47-4299-81fd-75cff0ec6d74", "value": "T103C2D0DA99587E49E5CDA87AD1CF0B15BE04F1C0369FC64A53060D899BF5B5EF08C039", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847017, "uuid": "31988221-7197-4f64-9363-da63bc7a4de6", "value": "768:6+8EZZj1+pDlH0bJQxs7q41XWOnLvVl1+oqWL:6+8EZfOlX2FbLAoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668847017, "uuid": "2ee1004b-3bc3-4dc5-9941-577ce112b3ad", "value": 27440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668847017, "uuid": "d53fd0f0-d99f-4796-99fb-70dd479ced9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847017, "uuid": "0a75f642-fac4-4d59-bedc-5eea9d748295", "value": "ef7f1df6735d72eeeb515145314ebfe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ec6e7b-685a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668897407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668897407, "uuid": "7d82f602-f6ff-4f8a-a472-2ec8ed66430e", "comment": "Malware payload", "value": "ef76a74036042f3b5078b1c72ce6d041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668897407, "uuid": "f8288d15-2f67-4d0e-ab46-ce71120b0b0e", "comment": "Malware payload", "value": "186aa69a35918ee690948c8db77751881d5a3396daf9d5c9dcfc5319a6f02d33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668897407, "uuid": "4f638320-9162-40c6-b4ec-9ab56b303fd9", "comment": "Malware payload", "value": "414632d963276f2439e1d5b94ecb6092d50bcf32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668897407, "uuid": "5447cea6-b8e8-469e-978d-77c9685c529f", "comment": "Malware payload", "value": "fb97ea19cdb0f89af5dd24fbbfe11feea460b4b275dbae1b0887462605ab56c4e14366b0d6516d02bcf9baf62353716d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668897407, "uuid": "3bf08772-3045-43e4-9c54-0c9b835f1b68", "value": "T12D84CE10FED1D0A6D5BDC171BA15CBE8177CACA17A20DA1733346B9F2EB02918E66335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668897407, "uuid": "38a7e2ad-61da-4595-884e-b3a7cb4eafc2", "value": "9fabaf303efb2031ad569e397ab31c33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668897407, "uuid": "7a6184ef-6ee6-4a35-a4eb-9a6245e2e287", "value": "6144:C5n2XmH0Cf38aQF2XNGXol0ovL0lbptvCZhVV4E+O13oXc:KndfMaQFoc+tL0lbHq0DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668897407, "uuid": "ff4255c1-4465-4c1e-a33b-25073c26c640", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668897407, "uuid": "5abafe1d-9db4-48ff-b068-67e403860847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668897407, "uuid": "b1096f18-e5ae-4efb-ab67-61015fdd3bdb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae89c02c-67a3-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668818822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818822, "uuid": "a6ba62cf-280e-4ac9-b40c-ea59470e5c5f", "comment": "Malware payload (Amadey)", "value": "f1b152e7df1943cc9dc537014da6686f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818822, "uuid": "95513733-dd7a-4573-9df7-8b3b85f42a66", "comment": "Malware payload (Amadey)", "value": "1885affa5c3764182abf0390cf8f69de94d4b61bb22b0dbc797ac5d66c37fc51", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818822, "uuid": "897c8bff-6ee9-4a2c-9880-75fab840ed07", "comment": "Malware payload (Amadey)", "value": "25fbb5bfce3dc0b8beb41c56810702ee1b2ca079", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818822, "uuid": "e7134879-2e88-470a-a729-d8bbff7912c6", "comment": "Malware payload (Amadey)", "value": "f99639ce503bb893625b8b61dfa827b1f6577eaa2f50711b6dc629588466e3bd7b1c193083ff41ebe1e8289cf5da26d6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818822, "uuid": "f5080336-d38e-4ea0-8735-e36171309958", "value": "T1CE84BE0176C4FE72C5C101358C2DABF56EA9AC616F559AC373B8FE6F2E302D1A5B2211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818822, "uuid": "998c22a8-96b1-405e-b7ba-1a334be2f786", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818822, "uuid": "3c0a7b6c-7cf4-448e-8e49-e1de541081a0", "value": "6144:sKwSUzlCjGA7QEA3RzBwQfOkT4IxhLDz8ewG6h+3oQ9gOU+fzYBb6:4SQIGlzNwQRRhLk69gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668818822, "uuid": "5a77ac8e-28af-473b-b6ca-e95b51206bbc", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668818822, "uuid": "62ba4033-2091-4fa5-b335-6928f87b0026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818822, "uuid": "4d5b5e05-4176-4d4e-aa02-063b6a938dbc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5828e09d-6864-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668901570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901570, "uuid": "ce94fc12-eb18-4acc-9a0f-3f67f441a658", "comment": "Malware payload", "value": "956773211afb98c11146d2a822449291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901570, "uuid": "b8a7046c-e326-45c6-b71a-90048684726c", "comment": "Malware payload", "value": "18ed6d39d05126296e0babbe6e0ae39dc7bd89f9da77b0484742cb72dc246705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901570, "uuid": "f15f63eb-7404-408a-8bc2-3f6bac8155a9", "comment": "Malware payload", "value": "91e26e74195e020c10782148d6c9b241108f29bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901570, "uuid": "3a9886a9-bca2-4fb3-b892-0d206aa0f79f", "comment": "Malware payload", "value": "3337b1f5090af3fd6f4902df116b6d4e25e0ebf9e2df802216c390d457a430e2b52c657b09942bc6284ce2f92e57f411", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668901570, "uuid": "5e59091c-3803-44b8-9064-7d72c7896570", "value": "T19CB5F0516A46D2A1C82F6DF0E66030F84DB63D62E82EC26BF7967C0DFE7C397811A550", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668901570, "uuid": "6a965232-c020-4927-8f7e-9db5976f0bd8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668901570, "uuid": "5edf97fc-d550-4844-ad67-fbc044f92b15", "value": "49152:q2nDtfpKy+xFy7vmlISf9od7EVdWoWPpclKGzZe0UxVkBaFwnm:rDtfpUE7+lIi2RGWooahzZe0UxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668901570, "uuid": "40c90ba1-0d0a-40ca-b21e-f4421d145024", "value": 2377264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668901570, "uuid": "935b5aef-2458-40a3-b156-b65b43b8b86f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668901570, "uuid": "45a32c1a-cab1-4d67-9a98-cfd4488afe32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925390e7-6806-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668861295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861295, "uuid": "5fafe3a3-34e8-4e5f-8f74-f12155f6e0b6", "comment": "Malware payload (Mirai)", "value": "a4aa74954cd09cf527d9bc544be1e275", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861295, "uuid": "03e3edf4-00f5-4d0c-8197-ebd71b1ed0ce", "comment": "Malware payload (Mirai)", "value": "195a86b63752e3a6efbc543ea52d12756eddfac34d552a773cded1cddaad2bf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861295, "uuid": "b3760e24-db84-48f0-a1aa-6fc6b97ea4fa", "comment": "Malware payload (Mirai)", "value": "4425781a795c17e970dbc5242a79c2c7d3b37739", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861295, "uuid": "6f4931c3-8432-491b-bb58-393de3c6a4fa", "comment": "Malware payload (Mirai)", "value": "d4b2275308b866b238a2c37049ec06b1f1ac652cf63eb1ef7bc6d3d413605e09d1a44942280849398d076507e8f5f548", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861295, "uuid": "881a76fe-8164-40df-b26f-b4927fde0b1a", "value": "T113D2E14976D752F68CCDDABEB60F002570DA74A9B7B29373B306D453477A080EA42D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861295, "uuid": "aa98b5f9-fd72-4343-9c8c-65463d90a537", "value": "384:MId/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BKf3jYNy1:blxKd29WcxEns+V6IHE4RlY99003jt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668861295, "uuid": "d6c3ee79-3567-4eeb-9638-c4b27545d94f", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668861295, "uuid": "e643ae89-b6a2-4a06-97fd-63eb5b2f59d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861295, "uuid": "5b46ae7b-858f-443f-8bc0-64ef53be6d4f", "value": "a4aa74954cd09cf527d9bc544be1e275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9c05ff-6801-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668859250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859250, "uuid": "e441b1ad-8811-4bb3-b94a-f6c1864c47a6", "comment": "Malware payload (Mirai)", "value": "066c1311cb7c2daea866b1cc68e115ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859250, "uuid": "673ade3c-a527-48c8-826f-091cb5de491b", "comment": "Malware payload (Mirai)", "value": "19e6f0ce5bc98cee525649418d7f4007fea647af45a6021d502a83210ae970da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859250, "uuid": "6f09e709-9c7a-4794-9d6b-7b4ab4dac200", "comment": "Malware payload (Mirai)", "value": "f69df9c8373407b13377c7cd91be4d661fa15c50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859250, "uuid": "32c744ec-c499-416e-830f-022c1fac132b", "comment": "Malware payload (Mirai)", "value": "6b1ac0d3efca4b93d477d26bda0a8f67a42d3a55b70701c7c509aea2b0dcca51fe4bbd55ae87e9c5ad853411fe9520e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859250, "uuid": "473a0285-eae1-473f-923d-6c8fd569d3bf", "value": "T180A2D129D345AFF4DFAF9D9452C1C2C2B6E543C7278AC8E340EEBF016916042BB89D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859250, "uuid": "8cb7a188-780c-4b62-92e5-686b3170aff5", "value": "384:7/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5fDM4uVcqgw05VxJB:7RxsSVsMD6xiJJE5zRWN+4uVcqgw09j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859250, "uuid": "d53c170b-01b6-4c85-9f6f-dd076a9ede46", "value": 21892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859250, "uuid": "b45504ae-67eb-4505-8361-d184516d1bf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859250, "uuid": "45d83101-c1e9-421f-ba35-d516207140bd", "value": "066c1311cb7c2daea866b1cc68e115ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d80f4ca-685e-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668899082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899082, "uuid": "801973cc-b30e-4e11-b84e-d25a30ee7173", "comment": "Malware payload (Mirai)", "value": "48533664beb8f4b089429aa5d47ed5b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899082, "uuid": "a443aee6-863f-4bd5-b2ad-a81863ba17b2", "comment": "Malware payload (Mirai)", "value": "1a240fd9f3624723ede7c38e3ef707f12c6fd018987e05ea0efcd837c248ab44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899082, "uuid": "fee61fe4-ef63-418c-bb80-5873c161005d", "comment": "Malware payload (Mirai)", "value": "ce4024dd148eb4e9046c3a8c776044921fe01c6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899082, "uuid": "75794ae0-ae4a-4ff6-a049-a083de1e4234", "comment": "Malware payload (Mirai)", "value": "8d6292589bfadac47a785f9d64d2c450aaeedd56322261e300017d574c244f4c9547b8e28114d5a94dc76892f1bada64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899082, "uuid": "13b5520e-7db2-4c34-87d5-947072bf3a8b", "value": "T1E993BE67C8342D50C2048A3934F68F388323965585D72EFAD194CA6DA853DEEF136BF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899082, "uuid": "b9bca77a-430f-4a16-8e21-f13fdd873dd3", "value": "1536:tyAby1v/FpIdFgjhUMqTphCMJfq3riuQKK9ANxxDklM1CYiKlu/VFPc5hA3:0bdDIqmMqTphCGMn3KKDklAm85h+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668899082, "uuid": "eaf67db7-241d-46eb-b90d-a532d6177e4b", "value": 91768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668899082, "uuid": "d4d015eb-f967-4438-9efe-dee38df69092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899082, "uuid": "dd46ead1-0b4f-4b6c-9437-94aaacb86f51", "value": "48533664beb8f4b089429aa5d47ed5b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfaafc3-6837-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668882413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882413, "uuid": "8719d56f-a2fc-4eec-b70a-825d458a4d07", "comment": "Malware payload", "value": "9ca8fb528f751005a6fa5e43441ab168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882413, "uuid": "05303e05-523c-4ade-bf7e-35404b83decd", "comment": "Malware payload", "value": "1b679b7b07daff5acfafb8d134126a28e748fb29f600219112ddd5f53fb3ebf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882413, "uuid": "4fed7e80-e80a-424f-8eec-9c635b1c74d6", "comment": "Malware payload", "value": "2dbd815ab5e2ccdafbf5f2c2fb443f6055728fa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882413, "uuid": "154ca4f3-9c55-473e-b86f-cd2553ad749d", "comment": "Malware payload", "value": "43d7b0a63847a4804554f710db3bb910a81780764531199d80100afc0c77c86c96cf03930f82243da952b72e4d3cb705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882413, "uuid": "9e22a3fa-94c3-46d5-af7a-58ba71b4ed32", "value": "T1D085224279C89571D53129340BF697716A3E7C325B768EEBA3847B5CEE700C08A36B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882413, "uuid": "583df188-d572-434e-87e7-2cf7d398d789", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882413, "uuid": "0e891bb3-9e5b-4877-957a-2b8145f6a04f", "value": "49152:I/oSQJjX1NInc3eiSlnUTFHzChbaH6zz7:I/oRdX1Snc3e3VUT5zChbk6zz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668882413, "uuid": "f1c44311-a98c-4581-b46d-48f53bc3c69f", "value": 1753643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668882413, "uuid": "4505f25b-3f74-4c23-9870-cb0487a214cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882413, "uuid": "480b9373-8475-41cf-a04d-9bbc45766e15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9da6138-6837-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668882433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882433, "uuid": "21630d50-8a26-4bd6-86e7-050c18269377", "comment": "Malware payload", "value": "71e233203c407d3cbd1e63d25bbd60c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882433, "uuid": "b59f700f-9938-4b49-8220-a19110b69633", "comment": "Malware payload", "value": "1b67efa690ee66657a7d2a1e7438bdf7e74e64f4fdfa85e4aefceed1e0e1040d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882433, "uuid": "2552e599-3ef4-4d15-9f70-3ac4d5b164de", "comment": "Malware payload", "value": "4f6e108fe624b92b0cc11edfaefc9b782132fb1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882433, "uuid": "e3478148-2617-4faa-ba53-fc173ad20e9c", "comment": "Malware payload", "value": "f079df3d4abaa21a58036498b85698791b50c8cb943f76a6b899bd5c198a194c9ec406f46cc91e077f14911a34261c50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882433, "uuid": "0cdaecf5-594b-4d9e-bfd0-2deb5a8f4227", "value": "T1C1F512DD6208336CC45781784933ED14B2F2911E0FE999B9B0DBBB907B5B861EA47F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882433, "uuid": "d977ea6d-6042-4059-8de5-0ce3b8d20ee2", "value": "8d939a9f08b2e4af619c3a0048b8a3d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882433, "uuid": "927ab324-e95d-4d6f-9d67-b95bf4a5cb77", "value": "98304:cJlEnAzUH1aOUIe2+xLNiCIzTLclprGZ6UTpaGtDgQS:cJlEgUVaOjeLdNFIzTLIKTpai0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668882433, "uuid": "c0f2c808-8a69-40f3-9fdc-bbcf795ad9d6", "value": 3629568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668882433, "uuid": "e3f701cc-e4b1-4085-97ea-0bed352200b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882433, "uuid": "1ab882e8-cb7b-4110-9779-def9b86231e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed553ff-67e1-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668845424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668845424, "uuid": "716f5fda-c80f-432f-9449-579b942366d7", "comment": "Malware payload (Amadey)", "value": "6fe4cf062cf4a5a8d6cc8bfd2182acc4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668845424, "uuid": "325937d9-0c59-4a2b-a1b7-80bf45478601", "comment": "Malware payload (Amadey)", "value": "1bd3d7db0827b6ffd3f763e35ac1b043f2a4b93141df7afad327ba6231d9d9b6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668845424, "uuid": "b285257b-7de6-4063-8b5a-35a29bc68e3c", "comment": "Malware payload (Amadey)", "value": "c907b0f75ea6c5ed95657c0c2f4b6ac816395ca8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668845424, "uuid": "241a741b-beb9-44af-a9b5-7b647cbfe0ff", "comment": "Malware payload (Amadey)", "value": "21e600167fcd0b37898b1c67b5fb9448d58de25505a9f87c473be4b3bed96c8524a7c196ed99099f3d335d7c387d58e1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668845424, "uuid": "a151aeda-69a1-4411-af08-786407b30bc4", "value": "T15084CF3472B0C4A2E571C670C425CBE166ADE8113A14DA8F7618FB7F6E30ADC967E235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668845424, "uuid": "6b409b2c-7a73-4f98-8a35-f17581d7ef75", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668845424, "uuid": "f91384f0-e5d0-4f5e-9fb6-a706e3c2905f", "value": "6144:N6CkBs+zLGI7/VQdBJFYm1Eue8UU1rjpPnFwCLLObfwB:N+BswnRQ3lJxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668845424, "uuid": "4fda2799-13d2-48e9-bbb5-eb36c20ac94f", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668845424, "uuid": "bdd4c0d0-e403-48d4-9a53-d764888e1fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668845424, "uuid": "39e79631-b123-4deb-895c-45b8812f64ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9865ef3f-6831-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668879773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879773, "uuid": "79e485f4-5e96-476d-a9d0-e8c0030455d8", "comment": "Malware payload (RedLineStealer)", "value": "c43501d22820973740491807f9f15498", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879773, "uuid": "14ba3f34-77d2-4a15-928f-79e7968ef60d", "comment": "Malware payload (RedLineStealer)", "value": "1c110f50ab897a5f06dee641a8827439ed33abd81db410831bba0fbff86a6518", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879773, "uuid": "77918baa-2d1d-4dbc-9d18-83e626563d8f", "comment": "Malware payload (RedLineStealer)", "value": "10c94bddff700a4acc1fe2c167ea78fd973643b7", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879773, "uuid": "12565ae1-2e2b-4b8f-9da9-66ec229f266e", "comment": "Malware payload (RedLineStealer)", "value": "0ba6c4aa34c06b34cc111d71728ca739aa4f6112a0a90cb6cd9b7f413737f45cac00fdf071598f0e637a717d2b339b06", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879773, "uuid": "14e60236-6f0a-45b9-8aba-85de6b20bdf1", "value": "T16A94BE1A76A4DE00C3846E74D1A3563897A1E5873233F35F2F4D72AA6D432F08E493DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879773, "uuid": "914f8668-8f4a-485c-9c7f-723b77023638", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879773, "uuid": "a60176b9-5d46-4fa4-b157-28570cae8e40", "value": "12288:n8A1ZNbH+G+0nIwFtQzcJGmc2NcKpjud3Tgkd:8A1ZRJnIZcgVKJud3TN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879773, "uuid": "53fb760d-ec86-45eb-b465-49c74021b919", "value": 433664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879773, "uuid": "727fd68b-c9cb-44b2-8abb-224cfbd52a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879773, "uuid": "14397af3-af3e-4a5f-a3d2-245775286d02", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d48d09-67f7-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668854836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854836, "uuid": "c6b68c58-1db3-45aa-a5bf-61b845c7a8f4", "comment": "Malware payload (RedLineStealer)", "value": "a8150c09777efeb0e755abd6cbc36b5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854836, "uuid": "3199223e-6524-48e0-9e5c-fe3b1fd8cb5c", "comment": "Malware payload (RedLineStealer)", "value": "1c2eda4db0f0cfb353ff0646672d055e2864daaec0bae7e66c90a405dcf3ea39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854836, "uuid": "7857add6-4ebf-4a1e-ba9a-33782b865b89", "comment": "Malware payload (RedLineStealer)", "value": "1a208c6722924c568dc86fc51ac580a4f459213e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854836, "uuid": "7b17a2cd-6dc4-4666-bd50-803b97646cb0", "comment": "Malware payload (RedLineStealer)", "value": "70a3ef56a5e9d2237880df31aeee1f97f59cff504f5d1bbdbecbd1a5fc85fa77ddfa1a8e83fcd15702b2ec2c2cf0817a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854836, "uuid": "236d163e-fa79-467e-8e7c-e645aa598088", "value": "T137A4F11EB3546AE1CA3464737614CB9087B0DEDA8C8CDAD66D7E3DC0BD72368385A8D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854836, "uuid": "3d3f85ba-a398-429a-ba66-f6af9b316b2f", "value": "12288:5h3DJ51cfJnPPaP9oysOM+YACPP/tOMyHoNxTVLqcYVkY6RLI:5h3DJ51IJnPPw+ACh9mV0RU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668854836, "uuid": "939bd24a-0c1f-4286-a8e4-6f0cae4126ee", "value": 478720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668854836, "uuid": "cdea5dc6-f938-41e4-a5e7-00d8260d2061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854836, "uuid": "e2537131-8f2d-47f5-8b72-b0522d030723", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8335b5-6830-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668879408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879408, "uuid": "4af6d6d5-9877-4c50-988d-efc069324cbe", "comment": "Malware payload (Amadey)", "value": "974fbcd260f47f4ae849ae07bb68b9d9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879408, "uuid": "7427ac20-594c-4e05-934a-adea6f11694d", "comment": "Malware payload (Amadey)", "value": "1cbbdcd2a8fce6a0d6dda5c0c5a7c889057c7918c3f5adaae9a24c23b1acb22c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879408, "uuid": "ce519ffc-017c-4550-b84e-14f99c86a201", "comment": "Malware payload (Amadey)", "value": "08918fbce1b6c6170c7794c2d00edccd6f19bcfb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879408, "uuid": "71a93a5a-485d-4023-9870-df147d5101c4", "comment": "Malware payload (Amadey)", "value": "286c3d2da61141f7a0467bd178e39bee09c8577f6a59a59b3dd4d837ea2afff721878e71004ae014262846530bf58dac", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879408, "uuid": "daffe0fd-5807-4e4b-ba27-99ab3d73f21b", "value": "T18274BD00FFC0E065F4BDC570BA35C7EB5679ACA16A20D91333366A5E6EF02919E62335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879408, "uuid": "56693dfb-d59c-4447-a320-298bfd7d15d2", "value": "3a28fc6cbd66b78dccc28e56534d2c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879408, "uuid": "f363637d-42b7-4d3a-98b8-01ad610b65f2", "value": "6144:wie0ZQAJCyosOOgtqjbt9dTnuhVy7AHSPhVVPE+O1voXc:wie0ZVhOntmj7uh07/ZDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879408, "uuid": "2fe7a273-f720-4404-b4d0-3c5353865e8e", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879408, "uuid": "d56cda75-25e4-4b8e-ba15-df806773d3e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879408, "uuid": "ca2e1598-d596-4fe8-8945-8273bc179ba0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e49a44-67cb-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668835744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835744, "uuid": "b4b9b36c-3283-4fab-b7ad-a10485e1b850", "comment": "Malware payload (Smoke Loader)", "value": "cb111f91393ce1955ea4e56a296ad6b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835744, "uuid": "3b72e5c4-bc9e-4994-b1ca-0c3b3df99eba", "comment": "Malware payload (Smoke Loader)", "value": "1da92fb1cee2d2e50507e9794fd20675785dc1d951787c101c0640ece69236d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835744, "uuid": "a1ff1714-b09b-43ae-aa0d-2ddfcbc251fc", "comment": "Malware payload (Smoke Loader)", "value": "032e33e325cc7e9a44972d35874d100ca85f99d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835744, "uuid": "fb0218f0-18c7-4e00-b1e0-41c512583d6d", "comment": "Malware payload (Smoke Loader)", "value": "ef9295b40773cdac1dae7751ab2227bb2a0b239d0fc4f2fbd9579d459dcd29fc6a009dcebc42bb7d0b2b676e20aa2269", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835744, "uuid": "3d82a694-50d5-40ea-b62c-681865f521ce", "value": "T1CC74ADD47290FE73C4C10171882EA7B57E29AC615F2589C377B8EE6F6E301D0A6B2257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835744, "uuid": "094cae61-7d21-4e1f-9a22-c27ce5131adc", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835744, "uuid": "eaae064d-62ca-46a6-9586-9b60bbf66669", "value": "6144:3AQ+oznArTJbqZHJnWcJECXq83udBVh+3oQ9gOU+fzYBb6:x+6+1bq7WS93T9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668835744, "uuid": "a94f6dd3-6370-467c-baba-3ad95e0a0c91", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668835744, "uuid": "d375bb1c-452f-4753-b90e-d3d4f789f9fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835744, "uuid": "ecc99463-b3c2-4ea7-97a6-472eca8db815", "value": "cb111f91393ce1955ea4e56a296ad6b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bfbd0c-6847-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668889028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889028, "uuid": "c02e9e56-f76c-475c-9cf9-3bb40f4a7b94", "comment": "Malware payload", "value": "125e2fe48882f6bc13df98acc65f3f69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889028, "uuid": "2d8403d8-86eb-4979-ae10-0dab3e06732b", "comment": "Malware payload", "value": "1ddc7f7bc3c36f26c077a5c6ab408a62855fef2f82081f8b18a7a6894bbfd7f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889028, "uuid": "ebd1bfb4-810d-4e95-ba66-40f43821eae6", "comment": "Malware payload", "value": "58b91b13dbd1503e191cbb3e603d778873adef29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889028, "uuid": "2cf6678d-9f65-4492-8758-239f0050756d", "comment": "Malware payload", "value": "8bfb7ecb28ca4e7405e15e25980c4ef78b5b27cb42070379d7e86aafa73a46d6c7810d2fec200978d5b35869cc30afcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889028, "uuid": "9a70b30b-23f8-4e5e-a975-d5c1efbc56fb", "value": "T17575236B3AE8CB61E9630F34AA3693F156267D65CD31A36FB281775C6EF1B019C00712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889028, "uuid": "07ecafa2-f8ab-469a-8155-16318118f2f6", "value": "9afb0666d352ea8205ea9826c6e3e438", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889028, "uuid": "145a957e-ba20-45c5-a06f-80baca36a794", "value": "49152:C3aNybImK124OALVogaoU2IqY73ZuMtQMVTY:C3aNybFl7AJraoUfqqJoMtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668889028, "uuid": "a921a883-03f4-4f00-b467-e14e6f9e0100", "value": 1660552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668889028, "uuid": "b0cb760b-6f48-42e1-88f2-328f75444bbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889028, "uuid": "d80c04f5-daf6-4c4f-86b1-db714333032b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c081e53-67da-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1668842279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842279, "uuid": "a034e7af-e872-4a34-a590-762aa219b2ef", "comment": "Malware payload (AgentTesla)", "value": "503edafa2dbb4a97ede555d33687d2f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842279, "uuid": "dd68cdd4-b347-4121-9927-8d8ec355a8e1", "comment": "Malware payload (AgentTesla)", "value": "1f0ce53c95af874c9fdbceb5780c81e36cfea0aab0ab7012877094bbd5d774f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842279, "uuid": "23a3c92a-5139-46f7-91c6-024bf5e61768", "comment": "Malware payload (AgentTesla)", "value": "9d7006e45eded485f0b1e9ab5408ec08d885d2ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842279, "uuid": "8cd8bab5-bed7-4d69-9bfe-4d6622ee982d", "comment": "Malware payload (AgentTesla)", "value": "d4a7efe20b042869edd73bdd1b92a723ff696d17a15f7b2d2eb805184d6a62e8cc7b7439a680b6ac3fe6e4228916175b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842279, "uuid": "7ce5a36a-72c3-4e23-b037-ec4aca8edf29", "value": "T17BE1A510A3A94672DFB68BBB5CB393C11278F3815A57DBAE69C4410BDC167980EB3770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842279, "uuid": "21958535-d8a3-4f46-884d-50474f469854", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842279, "uuid": "fad4b4d4-f204-454d-ab7b-eda6dedbde6a", "value": "96:4NaIz1vD88n77KWLLTXTWBkYPHIxCqpRqhOpS402kQf97zNt:4NawW8n77/LLykY/OnvqhOpS407Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668842279, "uuid": "8be023c6-9b5f-416e-8d67-5b99ca2e7e46", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668842279, "uuid": "10ba4d7f-b645-4f67-b191-abdf29ab267f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842279, "uuid": "f74ec5bd-29f1-40bf-b817-90fb574d5b4e", "value": "503edafa2dbb4a97ede555d33687d2f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b024827-6850-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668893065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668893065, "uuid": "c331299c-f726-437d-9cf0-0c20b80b3805", "comment": "Malware payload", "value": "122907a62a6ade198e94b87eed4b4810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668893065, "uuid": "a5a4fff1-6294-4174-8dcf-df3c83e349ba", "comment": "Malware payload", "value": "1f7b35e90b5ddf6bfd110181b1b70487011ab29ca5f942170af7e8393a1da763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668893065, "uuid": "ef93b3cd-ccdd-461b-ad9a-fb8c94ea737b", "comment": "Malware payload", "value": "3dbc6dd12652fad8cd18a4993a76b3f0bcce3fcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668893065, "uuid": "3993329d-68ae-4dc3-905d-30751115b2f4", "comment": "Malware payload", "value": "df12b294e60c4e3dcf7125c8467c17188c9b7add4e3d57343f5401de0d35498f8ed441e496cb0a601914762f9d7cb5fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668893065, "uuid": "20cfbaf5-4d89-4a1b-8730-d312d0e2bee4", "value": "T10B345B083B94994FC65F8F76E9905A10A770E96B5A0BF347788327FC5D4E3AACE011D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668893065, "uuid": "93d315f8-0c90-4339-a6f6-3a0252949ba7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668893065, "uuid": "4b82e3db-1a06-49f9-8c81-dceebc0a9885", "value": "6144:+hTBeRr9O3l2dDEPC2+5ao7HKs5pOPMXE/:+FYr4l2dbbooDpuMXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668893065, "uuid": "da4edf77-8017-4849-9fb4-1f9d83849b89", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668893065, "uuid": "f46cce74-f70c-4fe6-81c6-655a0d77e40a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668893065, "uuid": "bfe2c571-b36d-486a-8234-6cc6d8780744", "value": "1f7b35e90b5ddf6bfd110181b1b70487011ab29ca5f942170af7e8393a1da763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3536f42-6821-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668872973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872973, "uuid": "ed68a88e-6a72-47e4-b385-a146b588cd24", "comment": "Malware payload (Smoke Loader)", "value": "1867f25f4373d5a6fa010e3111a5e212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872973, "uuid": "0f83af00-2435-4c2a-bbe7-84a374a7be5c", "comment": "Malware payload (Smoke Loader)", "value": "1f9560ad4b91c8f5bcf832485f4250fb980e844174f1efb05e225b5f9f0b1646", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872973, "uuid": "800be07e-c084-408d-807a-e4bcb21100d1", "comment": "Malware payload (Smoke Loader)", "value": "bb85ab9e1f385229becf977b41aadee017e6683a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872973, "uuid": "3b983764-fdfc-42a2-b131-648f56a97035", "comment": "Malware payload (Smoke Loader)", "value": "7815a070cb0e567bc914e8210e5da1168cadb860695ee72caddae0a2d80b887e876f11c5c287570640125858e43615d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872973, "uuid": "3aaf92b7-1a05-40fa-93e5-113063b83626", "value": "T13974BD20FEC0D465C47DC470BA29CBE86678ACB17824D95377747F6E6EF02918E62236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872973, "uuid": "00403088-c857-4ed7-b210-ea7fd64c13f1", "value": "063e5449636b8762744e9ce9f5564a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872973, "uuid": "0df9d0ff-5be6-4eed-8628-7f89240ee459", "value": "6144:O355nMyS0gyu+ReoN//ShVVPE+O1voXc:mjnMZyHxkDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668872973, "uuid": "9044f679-360f-40c2-9e99-06de345e8db6", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668872973, "uuid": "1725a201-1a22-42e4-9409-0e702096924c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872973, "uuid": "107f1d12-d837-40bc-a248-3c4ebe87be99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4221edf5-6860-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668899815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899815, "uuid": "991f70c1-36fd-4e8b-8598-24704d9cc444", "comment": "Malware payload", "value": "e3d51084f05b09ec6ca3c31e935e08a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899815, "uuid": "d7439eb0-46a4-44d2-bf4c-796f97ba955d", "comment": "Malware payload", "value": "1fbd2f898e3abb6422047475da988086dea20275a9651e56bf7ae9f05c6e0a56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899815, "uuid": "5e243199-92e1-4417-ad24-bdb45821383f", "comment": "Malware payload", "value": "330816fa5fc27910d86fe27a996ea9b82d0b1ef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899815, "uuid": "b5dc19c1-a0e0-4a73-8dbc-596342725497", "comment": "Malware payload", "value": "fb9f2807be50879a6bc0ec50e721e916b6f15bd3256f012d7b7d1339ac583d28424bd8a0cb120eefa8b34695cef9c06f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899815, "uuid": "3bdaf24a-02c6-488f-bb8b-95d7e01c37b8", "value": "T19BC5F051AA56D295C82F6EF0E96071F85CB63C62E86E827BF3953C0EFE3E3578009541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899815, "uuid": "ae04575f-4cdf-4509-ab1d-78f89daa3507", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899815, "uuid": "792a07a5-b147-4770-8d6e-f30396955e30", "value": "49152:q2pcablZYKHbgkhH7FDhQh6ozH6D6omfRQQUxVkBaFwnm:rDlJgkd/e2XLQUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668899815, "uuid": "968ad504-987a-4c65-8c4a-ac96b4845b85", "value": 2517888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668899815, "uuid": "38b95907-44b4-4cc9-b68b-eb0529c48c63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899815, "uuid": "45d30508-363c-4933-87c9-61d56d2fe594", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a414b96-67f6-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1668854409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854409, "uuid": "1e54376d-f3c1-4b71-930f-d568d91ae0a8", "comment": "Malware payload (CoinMiner)", "value": "4feca0953dfc14482f0127fbf3c1f159", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854409, "uuid": "b5173d56-8bc2-4b6d-b755-5c2f4b59286a", "comment": "Malware payload (CoinMiner)", "value": "1fe79136a42bac10cfefc51ecf9514f6d6a83fbd5cce335967ed1599bf9072be", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854409, "uuid": "46bb0480-9d24-41ea-a1ec-5dd5ae3a0fcf", "comment": "Malware payload (CoinMiner)", "value": "04f13960412826b81e7b0afd3bdb1afbbf544d1a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854409, "uuid": "d06adb0e-0fc7-447e-8951-c426b8121160", "comment": "Malware payload (CoinMiner)", "value": "e986d4aa20633974f31657be4453d5a60bd8a54a3b5b752ff1fdbdc5396675e992dad71b64de6059e4f804b1d0187354", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854409, "uuid": "413da5a1-0123-4c50-a749-4c67a2b0f815", "value": "T1F2657C17F34486E3C4191434A91763A21AB0DC876E9FA34B37A8735DAEB3BC17B52394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854409, "uuid": "bc2c823c-29a3-459f-ba9e-e5f250155370", "value": "de3f3aee2769c5753d81bb6346b035c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854409, "uuid": "bccd63a4-ff98-48df-8403-017c8c6e3357", "value": "24576:g6ae50LmNbSIa2Nqxt7dz0E2b2Z+2iipHAAFdZfhLNq:Haq0KFNgL1XZxiiplbZJLNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668854409, "uuid": "ecdf2865-c8c0-45af-8cc6-a18986691188", "value": 1513632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668854409, "uuid": "25f80a7f-ec5e-49c6-830a-42ec7c6bf097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854409, "uuid": "7bc6ae5f-b8ae-4956-b0bd-ce4d627dccdc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c066fd5-67ee-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1668850815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850815, "uuid": "5c951082-86e5-4ef7-9abe-e5fbd90daf6d", "comment": "Malware payload (ArkeiStealer)", "value": "749d2b89871d258942d90623fabf9735", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850815, "uuid": "9816b804-dcb2-41d9-ab8a-045cf5d192cd", "comment": "Malware payload (ArkeiStealer)", "value": "2008a0b477ab28eb7c2159600563a4b054be02892a6a1686fce71ff07294487c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850815, "uuid": "1ddacccf-26cf-428a-a2f8-1ecc21b0db6a", "comment": "Malware payload (ArkeiStealer)", "value": "3bb4e08ecead19c7f6539e9a6d705fa839336e78", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850815, "uuid": "f87f0a3d-9a6e-438e-b817-1f6429179e44", "comment": "Malware payload (ArkeiStealer)", "value": "ab6beffe90cf099be6b54705ed4df6274dab80d2652d3e305a537b8508375ca593e0ffc3e97c292a44f71a5a2f9036df", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850815, "uuid": "870a1ade-6509-4a4c-9b6b-8d6b82056628", "value": "T1F5866DE1750BB5CFD04E27B8D96BDE42A95D43F842214602EDADF8BE7D63C8125CAC24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850815, "uuid": "e2994293-9625-430d-b8a9-d9c1e16afcbf", "value": "8765459ecb275a89f3fa3dba64bddf7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850815, "uuid": "a7fadefc-aa5d-4aa6-b8ab-621e0c18ff81", "value": "98304:PGnvt4MFHmE1h0D2Pl9C7/POtq+b6jsqVixyX2cC1u3e38Ommvzg70xNWHrZo3qE:uuMFHN1cwMm070mLZo6wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668850815, "uuid": "16af493d-5b0e-49aa-b911-b8ad1d04bf7a", "value": 8339680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668850815, "uuid": "ed352bcf-b64b-4b90-9b64-b656a74a56eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850815, "uuid": "82cca706-e365-4989-9707-a77d9d9c928b", "value": "749d2b89871d258942d90623fabf9735.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4da51b-67f6-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668854416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854416, "uuid": "6f9802de-019d-4641-adbb-a06885f5c1e1", "comment": "Malware payload (Amadey)", "value": "470521fa25eeb10215139a4af8ae4d99", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854416, "uuid": "444feb8a-af05-4f82-ac1d-3320e287df71", "comment": "Malware payload (Amadey)", "value": "2229a1a3d8304e6a593a89c2e097555f3770470437d5d471d7d326f5dfd13fb3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854416, "uuid": "e31eaee4-c22a-4c25-a98d-c4aac4309e53", "comment": "Malware payload (Amadey)", "value": "9aedd185d7d90e19af35f75667c42596c385843a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854416, "uuid": "b18865f7-97ae-400e-b34e-918c02d42440", "comment": "Malware payload (Amadey)", "value": "a5bb21e5396b2161195119fc0e6bc289161d14c48107a9acfd9a82c4fb2d6d52d07c94dbd9b83a34f12631b22ce79988", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854416, "uuid": "15d9ff94-83de-4daa-a4af-4621dc45a7bf", "value": "T12984DF3476B0C4B1E0620674C827CBA56ABAEC217C14DA037264FB7F6E30E9D656E375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854416, "uuid": "019e7d9d-3043-4a1f-93b3-113ada948964", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854416, "uuid": "57a57aa4-6ced-4c6b-8916-29baac31755c", "value": "6144:TbL2qDbzCvNaZ5PQCU21JqJ5GMVg3vrljpPnFwCLLObfwB:TGqD615e3RxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668854416, "uuid": "3e7a3004-554e-4629-9d95-23eb0c1a3cd0", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668854416, "uuid": "bdd8500a-d316-48c5-8a55-c24df7c8be15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854416, "uuid": "8ead85fb-1382-4fed-8cb5-e95b4b037e50", "value": "SecuriteInfo.com.W32.Kryptik.HACT.tr.17625.18344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f660a1-685f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668899575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899575, "uuid": "48dbbef6-cf9c-4966-ad0c-83b8cd55ab35", "comment": "Malware payload", "value": "74a0e7c042c7d3a1c4d02c3e79bf5c10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899575, "uuid": "ebe158cd-5e77-4eea-a103-973446c27d62", "comment": "Malware payload", "value": "233d21e6fe5248890cbfb8259457c881c26192054b7671c7cd0816e8dc0564f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899575, "uuid": "bba63512-15a5-4d37-87f0-b05dc6834724", "comment": "Malware payload", "value": "e4c1ecc2be9d34719eaedf95c30f9e56457073bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899575, "uuid": "7fb4fe49-3cc3-4c78-b663-5f8ff1df451b", "comment": "Malware payload", "value": "32ae61b1c24add40e988f4d9fcd19844b831dd2c4a7b0801b1b6b79f8e2967aafbe32fc1a2eadd8c6f22454674be56b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899575, "uuid": "feb3c39d-9440-4a9c-a1ea-47df5c83c9cf", "value": "T1BF7633303690D8FFF195043096157BE196B9D75915B90C8B97DC02B6693F0E3AA328FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899575, "uuid": "0bb13807-d842-461f-830b-da3d5c4110c6", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899575, "uuid": "036c6084-1957-4303-aca8-0534d70adaaf", "value": "98304:91OgsUvtEi9CKPTKW8YyEJTFTb3fQOgbvBHzeAHuZSIizgk4QjJG1L8Zd8h:91OgsetEiZ7LvtFTb35Gv5zRqCptGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668899575, "uuid": "aa9401bd-36ea-470d-bbed-918098bd4131", "value": 7641527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668899575, "uuid": "71946eb6-7706-4623-8782-2669b34fd646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899575, "uuid": "adbdff7a-0a62-4cc3-9f87-6f724f1a442d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04fcf7b-67fb-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668856594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668856594, "uuid": "3deee537-e222-459f-bf1c-759e5b1268cb", "comment": "Malware payload (GCleaner)", "value": "0e95577c665d509ddba2663cf0795464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668856594, "uuid": "8104da22-acaa-4431-84a3-ae5a96760eef", "comment": "Malware payload (GCleaner)", "value": "26496822cc6809fa1dc7a0fc6dbdebd6999cd016d684585b7e9690d3568a7665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668856594, "uuid": "f55aacc6-2089-489e-88c8-abb5f620c21e", "comment": "Malware payload (GCleaner)", "value": "a66448bdeb2a7ecd9c2bf927eed06ed5f05c8771", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668856594, "uuid": "c948d228-6ce4-46f7-88b5-62a7c2f99650", "comment": "Malware payload (GCleaner)", "value": "f9ffd7ec53e0d852010a920f541cc343a5d4abe93dc4dff69436a6c59320078c0bede3468088058fd48dbcd965e62f88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668856594, "uuid": "bd13b28e-d322-4920-8126-faae933bd8f7", "value": "T155B5EF116A96C291C82F1DF4F62034F999BA3DA2E82EC16BF3967C4DFE7D3978409540", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668856594, "uuid": "30284565-9d6f-426d-b53a-fc42143373d3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668856594, "uuid": "9b5e2ca6-116d-4fd7-b436-6154dc0f97dc", "value": "49152:q2lM0B81qJIeNk5zZFKLfGB+pUWO5gd6W3k19NayUxVkBaFwnm:rlhl/Nk5zZQppbd6WDyUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668856594, "uuid": "0207b5f7-dce2-4e5b-a5b3-fd3e82d505f1", "value": 2348649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668856594, "uuid": "cd420510-c681-4ba6-82e8-c4137985ca3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668856594, "uuid": "a3ff2118-505f-4ea0-ba1c-d90f37eb9a60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634be2d8-67da-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668842318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842318, "uuid": "7fdb13ba-ff81-4e68-8feb-727f31433896", "comment": "Malware payload", "value": "83c099e60a6dc42ab9f5bfd1de5867ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842318, "uuid": "9199e17a-edb8-4ce1-b76b-5d8ff8b05e0d", "comment": "Malware payload", "value": "266a52a74ce9a008c8436ffd773bf138f19dea6846c221ca1e969abff38f3135", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842318, "uuid": "6a45e6d8-17fb-499e-a652-0788a4047745", "comment": "Malware payload", "value": "b5d75eeed1583f19bfa077a3f235d656f45c3225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842318, "uuid": "87a36944-605f-4300-a1a7-2dcd41a6ca21", "comment": "Malware payload", "value": "e962fbd5f82cb31e263594883db6c36817b8f2ae9ac6df31b403fd9646bd3ed775cd5575a16466723508eff61599d543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842318, "uuid": "0a819897-3ac3-4a93-8f0e-dfeba20c20eb", "value": "T1314512107250FE7AC89541724D3AF7F19E29AC519F5489C33BA8EE9F2E702C179B130A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842318, "uuid": "19291630-96dc-42fb-b68c-cb5a2dab004b", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842318, "uuid": "da0092a8-935c-4c4e-a5bf-63dee0333f30", "value": "24576:bqY5abqyRk4Z2oUwMnKfbtlyS56toIg/S+9gT6:bqkabjRB1KnaU9gKDT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668842318, "uuid": "67ee20cb-4b74-488a-a09e-b522cc1977c0", "value": 1230848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668842318, "uuid": "c14c56e1-cfde-4b48-81f4-eed9a18f98a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842318, "uuid": "6c6d35c1-0ce9-41ef-afcf-2eb5aca061b3", "value": "83c099e60a6dc42ab9f5bfd1de5867ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764f8e80-67a9-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668821305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821305, "uuid": "80d820d7-bdd3-47b7-97a6-8c4c20b88ad7", "comment": "Malware payload (Smoke Loader)", "value": "bf7079f1e54fa12fcb016aba047c7484", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821305, "uuid": "9afe170c-61b0-45bd-a790-b714a8102cb9", "comment": "Malware payload (Smoke Loader)", "value": "26d3c8bd54e97accc6a7ccd0e4f20c1c0f6b97465dd0c919c28c509bc45c0233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821305, "uuid": "84a58fb0-9278-41ee-9041-4214df47bbc3", "comment": "Malware payload (Smoke Loader)", "value": "f9dc1104c0b53ccd326d770f12d5f9297304df6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821305, "uuid": "fdeb43d7-9900-490a-9d15-bfad976a011e", "comment": "Malware payload (Smoke Loader)", "value": "25ea34bc111daca6410dc20ca6f3e6aac0405799a72ce27b18f2d3ea2864bf53aba5175bef4e421c5bf7abb18f812139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821305, "uuid": "34b2bacc-b033-4ecb-9d8e-62b0676b9b38", "value": "T1DE74BE117684FE72C5C10471882DEBF56E79AC619F2686C737B8FE6F2E301C0A6B2255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821305, "uuid": "3a02b249-b655-464d-8f51-a13c9ac9cd29", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821305, "uuid": "1544cb28-379f-4281-84c9-2cd7fc70cacd", "value": "6144:CbUQTzhSfIaivdvlivxJm/H0tP5pQh+3oQ9gOU+fzYBb6:pQBSw5fuxyG5d9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668821305, "uuid": "204f8e15-c248-4f1b-b11f-79d25f40a2d0", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668821305, "uuid": "5b5be916-4d4b-4a48-8f0f-dc72671cd6e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821305, "uuid": "caa7c4ec-50eb-42f2-9a8d-fab43d5728ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a68bf0b-67bf-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668830787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830787, "uuid": "54921a51-b46d-4886-a699-5f69100fd61b", "comment": "Malware payload (Mirai)", "value": "1d16443d73049f965066097120fdd9fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830787, "uuid": "c5884d82-1ff0-4ff2-b961-7355da332ba7", "comment": "Malware payload (Mirai)", "value": "27f7f12ffd1f49fee3c2cb9e43922eac94994e37b82500ce0c385cc4f7869b82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830787, "uuid": "483b0f63-40ed-486c-8d13-8bf0207a20ef", "comment": "Malware payload (Mirai)", "value": "3944ae24ced391be67264ef4eed1dd4e6609aa6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830787, "uuid": "f4d05e96-f2f2-473b-ae8d-ee06a7875f50", "comment": "Malware payload (Mirai)", "value": "e8e56a67b2331a3af9ef30c9b2c6dd1e583faf438916b09b56c82d77bb475018778ef482f99b41b0a64455765efde148", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830787, "uuid": "cbd615fe-0f4a-46b6-a862-1cc4d3551bb0", "value": "T150430752BC818A16C6E0527AF92E85CE3B2123E8E2DF73079D211F6176CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830787, "uuid": "0ea19b1a-9d2b-452d-9193-d72a661c91a3", "value": "1536:Q64i29YzaK1r5mTPAzHcEe721suV27cshMDHs:Q6ia7dR1b27Hhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668830787, "uuid": "609f4f86-1ae9-4856-8ba3-750a2b5d7026", "value": 60444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668830787, "uuid": "dd9fec50-10ff-47c5-a8b8-71061b87a05f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830787, "uuid": "d619851c-00af-4e7e-9c6b-ee34a68c4260", "value": "1d16443d73049f965066097120fdd9fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0336a8-6801-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668859192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859192, "uuid": "d0ea8df5-c042-49f0-a882-b9717eefa9b4", "comment": "Malware payload (Mirai)", "value": "597ce1dacaf67b6fb63cdb490414626b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859192, "uuid": "7e838e7a-e3da-420d-b18b-f0f72d9e92d2", "comment": "Malware payload (Mirai)", "value": "29289a5b70ab08d40c9f50eaba747ff76a36dc63717815cc386bb5375d12c84f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859192, "uuid": "14469bb4-731b-4424-84aa-c541f6006a8c", "comment": "Malware payload (Mirai)", "value": "8d1f0f533bfe1310c14b868e327b22512aa3a03d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859192, "uuid": "14dcd308-8cec-4232-a560-576b64932796", "comment": "Malware payload (Mirai)", "value": "28de326c91901a73ad0dbf3cf64f008c995560d4bc018a330de7ca60ee751a8516b5d4e136bec7549f849a5cf0001099", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859192, "uuid": "c48b65ca-2a63-480d-8de4-6aca848e8a87", "value": "T1C082CF3061AB75E4DBE14431FAAECEC6971A0BB8D1FC36D31758AB78C94510625FC2CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859192, "uuid": "049c35cd-6582-49f4-9861-4a56ceec2aee", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaR9ihymdGUop5h5lX:2dV0P6+kom0tVAoNvm+to1Rcs3UoznlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859192, "uuid": "6c0dc185-416a-4f81-9e68-ce42039150b8", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859192, "uuid": "76505a71-955d-4eda-b5f7-e9f2a3715ebc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859192, "uuid": "1b5ae9db-a051-4d7a-a135-4d55b8627ccb", "value": "597ce1dacaf67b6fb63cdb490414626b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06e6ccc-6801-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668859198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859198, "uuid": "0da6e536-3df3-4d58-a723-643a88228c8d", "comment": "Malware payload (Mirai)", "value": "e76f6c9f759eb6dfd308a9f72059da59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859198, "uuid": "2edaa210-cc6e-4cf5-9969-f558fc1e1f28", "comment": "Malware payload (Mirai)", "value": "29cb8ddb89e4285ca7a396fa1002f69f41e20ba03ec17d21e10caa8bca7d0963", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859198, "uuid": "2673242f-05ca-42a1-9b08-b8cceb6966e1", "comment": "Malware payload (Mirai)", "value": "e0d6c92468e18ae18171e5705cd2745e95e0a947", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859198, "uuid": "7bc42a7e-35f0-42b3-a24d-d1d5a5eb8703", "comment": "Malware payload (Mirai)", "value": "335830c4a12aecfa40059547b75145a66ea975264817c0370d5c17c1b2927fc162b7dcb87a6d573b7689d66ae45e50ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859198, "uuid": "7463eea2-030f-48d6-baea-ff5563350781", "value": "T16CB2D0CC50843084C98D7C7C178D4A664F6CA1D0BAEE9B26E354CDD8B3BEA4B745D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859198, "uuid": "36e2e98c-3c54-49e7-ba18-eeddcb22ddc5", "value": "768:chrQlS07dEv0UXqUhvQE+CXQKMQKCXBpFjZqaWvl:KQlS07FUXqIYSXQKquF1ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859198, "uuid": "486b5065-bbef-4cde-a38f-e860b212a488", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859198, "uuid": "ad1ac9f5-601e-4131-940a-7c69e4884b1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859198, "uuid": "304174d7-fb45-46f7-9547-92e885e01df8", "value": "e76f6c9f759eb6dfd308a9f72059da59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04674bae-67f4-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668853326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668853326, "uuid": "061957b2-d3ee-4e6d-ab34-3b0a3e25c411", "comment": "Malware payload (RedLineStealer)", "value": "ddc7b73267a830986bd3f88d0fafc4aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668853326, "uuid": "cc8115fe-8a24-4d2c-98f8-69d948cd9dd9", "comment": "Malware payload (RedLineStealer)", "value": "2a7b4330b0f92e2f07a053d2e4da5bd28de34e736c37ca7d799642519f6a6ef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668853326, "uuid": "2d39a7a2-3723-44b1-b006-7f94683e22bb", "comment": "Malware payload (RedLineStealer)", "value": "1f2f08a4d88ab0492855450f5ec5ba8674d06f13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668853326, "uuid": "f1d78766-9dbf-413a-80bc-6ad0e5efaf87", "comment": "Malware payload (RedLineStealer)", "value": "7c7448a587f240c6dd17d40df8314b3cd86ad62e67d9be3c01f117fff5844a317d7d7bc52cdc8153ddd3caf4bcdd9404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668853326, "uuid": "8827a9fd-f7a6-46f7-b95a-e5fdf01519f6", "value": "T1D4B4F1307670D4F2E6614AB4C865CBA665BDF9613810DA073704FBBF3E30A8D566E239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668853326, "uuid": "48ed9257-087a-40a1-b1ba-a85797b49117", "value": "045163335c785d665aeb43938f4d94be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668853326, "uuid": "0f48330a-d138-4f23-b6b8-def38921c5d3", "value": "6144:HC2Ii9FUmevAO3/JRfSmW0Y+JCungaItjX9O0KnK4SjpPnFwCLLObfwB:xIi9amW/JQm9fCk1W0exqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668853326, "uuid": "1bcf5036-8b67-4195-bb12-c3377bbf7354", "value": 495552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668853326, "uuid": "865ba166-e721-47b4-b045-4898677d0179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668853326, "uuid": "9f15f3b3-8b6c-4e2c-9533-800797a9188f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e6d2d8-67dc-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668843017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843017, "uuid": "d049e089-954c-4f3e-aa9d-6f33fa375835", "comment": "Malware payload (GCleaner)", "value": "c96ac779d1042979fafa65da091a78aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843017, "uuid": "b6ea4a47-27eb-461b-a748-6f2eac7a5634", "comment": "Malware payload (GCleaner)", "value": "2b1cb9da1da685c3fd747662eb7084056d0f380aa5bd7b386a0c6bc5c33a4d26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843017, "uuid": "a001a925-2e33-40b1-ad54-20c65c6b1334", "comment": "Malware payload (GCleaner)", "value": "5692415cbb9d741109fe9df467a8cb1f8b0b0421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843017, "uuid": "fdef4457-e9a4-4c09-bdcf-1eba5406ec69", "comment": "Malware payload (GCleaner)", "value": "8943fb9cff6fdd97b3b42ead6d0ab7bc61ca44979e0634da545e5431deeb88ba54d82206916fb9e47b883dc1f0fbb4df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843017, "uuid": "6d049612-9b28-4461-bc14-c820dc9b58e9", "value": "T1A3B5F0506A56D2A5C82F6DF4F96474F849B63D62E82EC22BF7927C0EFE7C3979009401", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843017, "uuid": "1f3382d8-f36a-483b-97f4-4d67c1ca3847", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843017, "uuid": "2fa60c31-c830-479e-aa7e-86f971957a55", "value": "49152:q2TZuznj6wE8lyo1mokquURF0gvl7Bfj3SEboicVgX0TAUxVkBaFwnm:rQzj6YlJmokNURFjhj3SEboRR8UxVkBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668843017, "uuid": "29f38df2-781f-4c34-8b15-8cd3cf00644c", "value": 2343131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668843017, "uuid": "e0592d5e-b524-4e01-8b77-92b09a0c7c25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843017, "uuid": "c6266c85-bfeb-4702-8a6e-2bc239819e53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc57bfc-6806-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668861337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861337, "uuid": "3142aa42-93f1-47e6-a2f7-6e0e221138ee", "comment": "Malware payload (Smoke Loader)", "value": "a20dc643bf40172ed03a79308a30a476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861337, "uuid": "07e9b463-719f-4add-a4ad-dced806ab669", "comment": "Malware payload (Smoke Loader)", "value": "2b205c53b94128f8276486d39094fa971fec341764fd8d8215625b457b9310f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861337, "uuid": "4661d93e-4e98-4b15-a510-e3dcb3598f31", "comment": "Malware payload (Smoke Loader)", "value": "d887017ea2e8e1ea68a08cdf89d7dee768fe0070", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861337, "uuid": "f9d99ba2-fdec-4912-86e2-d50f2b3c5210", "comment": "Malware payload (Smoke Loader)", "value": "63a447c0af7d056f4f23a7e8478190dea2feffb1b51eb00530d561b4b73faa1c8dec7e95bee9b0129cd4bbfaadbb1a2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861337, "uuid": "56aaf844-4d93-4d35-bb6a-8db610953517", "value": "T16D74BE7472B0D4B2E16106F6C829CEA469B8EC107814DA033755FB7F7E30ADD96AE235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861337, "uuid": "e61bed44-1b79-43cc-ad2e-170c0977dd38", "value": "063e5449636b8762744e9ce9f5564a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861337, "uuid": "d5fa1418-de4c-4b5c-bf77-9c909a83065c", "value": "3072:QdELCSjk+ec334IiWz+XBem5fKHDqRasXZUNX9yZTj35PKeBHFw0tZG2QMisvOb9:4Sg+F4X4mt7xphjpPnFwCLLObfwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668861337, "uuid": "d41f07be-2ecb-40be-b140-2d643ccc79d3", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668861337, "uuid": "d82e2b2b-c188-4ffe-a6cb-ce4b029e2566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861337, "uuid": "aee147d0-ef6c-41d9-8414-c42bd95c2c76", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33c40e8-6851-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668893643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668893643, "uuid": "809a75eb-74a7-4a8e-a50d-5b8eef9aa21f", "comment": "Malware payload (Mirai)", "value": "eff329552145f55c672e215d4bca5840", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668893643, "uuid": "3ac6d86b-e301-4b53-8ac0-3742450cd969", "comment": "Malware payload (Mirai)", "value": "2ba49e922d3b6f3609e13e4ec6526c9117b90ca99ed06dbf5d8ef328ec8760ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668893643, "uuid": "28385364-62d5-4a47-89bd-909be17538d6", "comment": "Malware payload (Mirai)", "value": "f3669ce49d97928f44688c9e6e9be5bbfa94dc59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668893643, "uuid": "fc1ce8f3-2a9a-45b3-88e2-5dbdece7803b", "comment": "Malware payload (Mirai)", "value": "0557f7a56e4f137257ee4e4561559bdf8c0b40051c31d51a4423e4a837b9f38787b022ee2f29a68b468853387eb46efb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668893643, "uuid": "b4fb0944-1992-4414-8d48-40d2d7d40fce", "value": "T15BD2E11E69112EEDED69C8F504E917D07DB21F219C23CD66A6F8EAC10B2346D64E33E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668893643, "uuid": "39736ede-5aba-4794-a9d5-de8d604eeed7", "value": "768:NG/hTPDTE8VrvwbxThl9BChggJgGlzDpbuR1JP:NGJXE8NIbxTTEVJu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668893643, "uuid": "a8758159-8f98-49bf-91c2-d1f521efb7df", "value": 29416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668893643, "uuid": "71b48756-ca0d-4e65-88c6-bae1f24528e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668893643, "uuid": "be18368c-120e-484f-8ea4-70a00bbeb89c", "value": "SecuriteInfo.com.Linux.Siggen.9999.14068.24685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb43405-67a5-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668819651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668819651, "uuid": "9f00ab14-5e42-4eb2-9b78-dde7957c6631", "comment": "Malware payload (GCleaner)", "value": "88af9d2bc916cbb1e7e243e64e9afcb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668819651, "uuid": "37577c19-bb0a-4529-916f-85bcbe504cf1", "comment": "Malware payload (GCleaner)", "value": "2d03665fab59c590dbd323a60d22dd3115afb919ee5ec029b74b75a0f6c3ec9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668819651, "uuid": "eada1122-3e62-452f-ae80-fbeff9f62570", "comment": "Malware payload (GCleaner)", "value": "3b142baf8206d7215b3ed4ff1a4c476697fa38bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668819651, "uuid": "3066e2c9-6814-4ef8-881f-b4ba8ed25812", "comment": "Malware payload (GCleaner)", "value": "14e5adf2dcd1bcbc9c98941b93d8b24ebc7e0fa176b388550e30c98c03cd195e02ab3c584cfb4937c05a0611a9c5cec0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668819651, "uuid": "25d3842c-5667-4651-a1aa-fd7d79262bee", "value": "T1A795330FA4069171E49323F54AF89D98EAAF723E59376E78B46D6D8C4D275C301183F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668819651, "uuid": "75de97d5-240d-4f80-b2e7-b9a9f032f51b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668819651, "uuid": "9d0fb647-7bb0-4359-b681-6357e527f1e4", "value": "49152:q2b86mdjenB1hgko3mzGfin6cCQpwd0NuchD6Oc2+hfyHfRx7Pq2:rTyko3mgEv1l62+gPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668819651, "uuid": "f490aa82-626a-420c-88f5-535244daa0f8", "value": 2059738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668819651, "uuid": "35ace5ff-a972-4030-ae9d-644326a6bf90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668819651, "uuid": "53fdb4bd-72c8-4c84-894b-5207b5d5dc81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b6edcf-6808-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668862156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862156, "uuid": "b0f8b585-4e36-44c3-90e0-90f7de669a0f", "comment": "Malware payload (Mirai)", "value": "7980b65bfd9c62cd8df8139dad1005e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862156, "uuid": "5aa0587e-5fd6-43fa-8d6f-2233cf25605f", "comment": "Malware payload (Mirai)", "value": "2d881d4da35a66279cf246198a6d0d1225e2f48d3bb448e98b0ab3c38ffcf206", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862156, "uuid": "dd7b0df8-049d-4dd3-ab74-889b8d7f3280", "comment": "Malware payload (Mirai)", "value": "5980cb81cabde0d72d3c4e890fe72a754ab8ed0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862156, "uuid": "532aebe4-e90e-4ee6-8e2e-310081910e4c", "comment": "Malware payload (Mirai)", "value": "48f7c68cfd5e034138b2342c33be8f544a9ba217ac58a471c95df5c00325bb80094d615b82afb17d6cc4952ed715c15a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862156, "uuid": "f9a74b3c-b674-4260-ab9b-0a97c9d9b8b2", "value": "T162E2F1A7D3725452CE7C2BF5F96985CB2ABD0BACC57630A3160557283E5B0435B3C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862156, "uuid": "be7d466c-fbb3-45d8-9b6b-55bacea9d01a", "value": "768:koiWiO031vpAPbrVWZK3XVGxm9XSKs9q3UEL5I5:korm1vpALgUJj1L+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668862156, "uuid": "bd2cbe1f-db51-4f6d-b7d7-fe1da89ee00b", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668862156, "uuid": "c13c76d7-0bf8-43ee-aaf9-cf39d70826cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862156, "uuid": "e9197e5a-ecd6-4777-bfc5-73bda92193fa", "value": "7980b65bfd9c62cd8df8139dad1005e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f737ac-680e-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668864893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668864893, "uuid": "f3815656-972c-4006-a320-d971d26f5abc", "comment": "Malware payload (RedLineStealer)", "value": "7d94454ee94ffd2669477a1888d01f39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668864893, "uuid": "8b7feded-6b3e-487f-a423-77fb0b18f1f9", "comment": "Malware payload (RedLineStealer)", "value": "2f067abf432e132947018cec390ed0a6a552a32f77bdad852d1adb75266c2e58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668864893, "uuid": "cf377e64-8d4b-479a-be01-4f590c333364", "comment": "Malware payload (RedLineStealer)", "value": "56697ff8329e795651bddeb93482670cc854e1df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668864893, "uuid": "779c73ee-0684-4855-9317-59eacf01c650", "comment": "Malware payload (RedLineStealer)", "value": "33a5f96c5c3540b748519e3cb8a5d1b218bc0d1fd474f0a899e1230d4e6a3937c7a3832da180129622150a2e52007a9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668864893, "uuid": "160773c5-a960-465d-9b4d-47f92386d658", "value": "T108348C1374807536E5ECC7F9C89D9E56457FA7E1278022CB152C072946F27FEEAA830A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668864893, "uuid": "fcba25f8-9ef2-42f8-835b-a93c8b38f5bd", "value": "19f81fe756f31ae8a7d11110e6e81c7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668864893, "uuid": "ed4cf29f-c66a-4199-9962-2144672728ef", "value": "6144:o208XSOBUewg89TjLctzA1jqb7ZdGv2GkLZmHxYKcTrL:p08COKe2TjLctzA1jqb7ZdGvlVmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668864893, "uuid": "94d12349-5cb3-46ae-93e3-58018f6bb3c9", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668864893, "uuid": "e5132a78-a97c-43b1-a30b-98bbc50fcc16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668864893, "uuid": "6b1c89f0-d83f-4da6-b30f-4935f1c0ad11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5119cde8-6800-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "a2616e86-4df1-4df6-a914-6739a9b8796b", "comment": "Malware payload (Mirai)", "value": "02b3615112a6d7a0dd66b91fe01618e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "d791e845-5dae-4734-b31c-0cc04156e7d7", "comment": "Malware payload (Mirai)", "value": "3029ac3eeb05eb80e023378a7db40a22a5ea49e459242e827ee789d3a3a27b77", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "5fdf66c5-e915-4b7d-8b50-30dc67417482", "comment": "Malware payload (Mirai)", "value": "fb0217f9f8124912a125f5fc13d0ea8025e43570", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "009efd81-b07a-4d6f-936e-d32938da6a67", "comment": "Malware payload (Mirai)", "value": "3b12237a0647b69c8dcfaf97f506cc502f93a23f82ccc0d6877ea637047cf75ccaeb20d81659bc3799bad5cd5ab09d1f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858608, "uuid": "df3705ec-21e6-4d21-ae1e-17f3935737aa", "value": "T14433F272676E29E151B05773FC33EC1A669C16F89D6730DA2CF0A61977C48024FF2686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858608, "uuid": "639b5c33-55c0-48f9-84f3-2a3c4c51b6e5", "value": "1536:69O/ZMAXIxNUk0KVLcPqF1aBexo4opKZbP:69O/ZNKy2VLGqFUFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858608, "uuid": "d9c72d78-42d9-46b3-b8e4-e65cf87ccdd8", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858608, "uuid": "7bd3d26c-6a11-4c95-9ac5-9ed75ace9220", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858608, "uuid": "519e8b58-ece6-4c70-b9c7-e9e013151286", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5c524a-6836-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668881770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668881770, "uuid": "0536495e-88d4-4776-bbfb-b8e4b1c6718f", "comment": "Malware payload (Amadey)", "value": "f2400c5832ffd6e2fcdeb1c599cfd269", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668881770, "uuid": "c089d6ad-026a-470f-908e-0d44ededcc25", "comment": "Malware payload (Amadey)", "value": "30b29dc5b32ae4fc1772a0a7feca6db4030fd27cf32cf0f56daef99239db1c72", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668881770, "uuid": "4c5d467f-e210-46fc-a0db-16ca64fbe9c5", "comment": "Malware payload (Amadey)", "value": "e21a5e5e2841aac3f7b96b9112d354f183bb6221", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668881770, "uuid": "b8d81385-babd-4410-86cb-c163055f58e3", "comment": "Malware payload (Amadey)", "value": "cccaeb81de80c909013fec0af68f9892d01168bb533bfd51f1636c83271625c2e808b4ae3544fa83eab50f449747a0aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668881770, "uuid": "e75789b8-a85d-4eb2-a644-ae2d0af9ebcf", "value": "T14F74CF10FFC0C0A5C47DC570BA26CBE95639ACB17921D91373386B5E6EF22918E72A35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668881770, "uuid": "f68e44a8-a9c2-401d-8565-a9bc735a2d19", "value": "3a28fc6cbd66b78dccc28e56534d2c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668881770, "uuid": "792c7124-4d70-41c8-81b4-e883bc7b3ca0", "value": "6144:bTFTVjdq/aHfuPVkY/eVwUtSJg/nDxA68ThVVPE+O1voXc:3FTVjhOQwUgqvDxArDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668881770, "uuid": "e018c16f-a12a-4b17-8699-ba7035d7c466", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668881770, "uuid": "bd83f6c2-fe5c-4398-9c8b-6aca58fbda07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668881770, "uuid": "a7c2bdff-2d8e-422d-9273-cba99411977d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74464e0-685d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668898777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898777, "uuid": "6a9c4608-26fb-4561-8177-77cf1ab18856", "comment": "Malware payload", "value": "43f253c0b1dae622bf7cf77fbe1acf99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898777, "uuid": "83732888-35c1-473c-8983-0c5745f2b10d", "comment": "Malware payload", "value": "317cf4b2a0a0fd896252f04a5f25570384768f1d6b895d66e7b950da58b62832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898777, "uuid": "9878243b-8ca8-442d-8bbf-d45cad57144b", "comment": "Malware payload", "value": "5e26811d5c56f9c4b0ece621793c229d0673300d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898777, "uuid": "99b7cdb9-3c2b-434b-b6b8-50e23a38fabc", "comment": "Malware payload", "value": "a78239f3c8a3775dc12202f83786370a043bcdb68de44ca83287bfa01d3785d2070738aed049551ddd144a3e32b3c41c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898777, "uuid": "fa49b188-6a52-483d-8f9e-db5735e9712e", "value": "T18674BE10FFD0D4A1E47DC570BB26CBE8167DACA1AA24D55337786E5F2EF02918E62231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898777, "uuid": "1b85b70f-3a66-44db-aaa5-bae252e28873", "value": "9fabaf303efb2031ad569e397ab31c33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898777, "uuid": "c967ae2b-f362-4c55-b1ae-12a003f4adbf", "value": "3072:n1iM/XncBXWaETBo11UkQpq/Hyd8PxLpzc/EaZ6oOCzv+PlCmfG7lOmV25lFE1mS:1iMR811cY/7K4CZhVV4E+O13oXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668898777, "uuid": "54cc28dc-5ca3-4483-8f92-260ebb8b68da", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668898777, "uuid": "2671a8c5-cf63-4d8a-a7b3-f123805b3505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898777, "uuid": "05db0b43-7fa1-43d7-a724-367e398802ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c35b6c-679d-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1668816094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816094, "uuid": "c22b8fbc-819f-4a22-90cc-39bf76f7779f", "comment": "Malware payload (AgentTesla)", "value": "aa1c1a4d9701267e20c3d68348b7153b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816094, "uuid": "5d9b9895-927d-4d53-9b52-261b5ab0b7e1", "comment": "Malware payload (AgentTesla)", "value": "324abb3a4a0266f9dc15c538a962d517d3f8d9774062ac05ea46097b955e6740", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816094, "uuid": "c9ae0167-7101-4eb5-ae64-003b64f84d63", "comment": "Malware payload (AgentTesla)", "value": "051838bdaf6641cd9a93a9a63de448f541dbaec7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816094, "uuid": "ea292a5e-d3a7-4f8b-8805-d61d0c52aa9f", "comment": "Malware payload (AgentTesla)", "value": "0dbfb9dd4c6fd4a2ed294c6a701d3a88fd9c484de0d015dd47384ea15fad4913a655baf56f42a45defc4487315ca0545", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816094, "uuid": "85ce267d-29dd-4245-b632-7785caf37df6", "value": "T119157BE9A893796EE5B9B27D15F1E450CAB38C724EC0AE2445A83DC15D339D3B021DF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816094, "uuid": "4b07c888-ba1d-4b4b-a1f6-48e0f3a7d3d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816094, "uuid": "14f04f20-ed14-4286-b35c-2f6d6f4db736", "value": "24576:kwgh//1PBnG30YCoNfDRMWG/G7u4EWns2T2H1hGjZnbCkI:Wh//1Bn+9hGWG+7u7Ws2T2VhGjZnbCkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668816094, "uuid": "8dd4e0bf-71f4-44e6-9a62-494d3e57d5b1", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668816094, "uuid": "308a8c38-929c-495c-a1a5-4cae030ebe1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816094, "uuid": "c5323220-bc91-41fc-a964-1a3d363fd99e", "value": "aa1c1a4d9701267e20c3d68348b7153b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec45bed-6836-11ed-9266-42010a9c0072", "comment": "Malware payload (NetWire)", "timestamp": 1668881878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668881878, "uuid": "1a08e1ee-e1b1-4baa-916f-90a48ff2c85a", "comment": "Malware payload (NetWire)", "value": "97ebc55be1229c2fdec3edd582a4b7f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668881878, "uuid": "75b84331-2f5c-4344-a5c6-3355d34acccc", "comment": "Malware payload (NetWire)", "value": "32ad4debd99aa2f13ce76dd248ff89710130e18e0427466179217256fba79357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668881878, "uuid": "7287826c-a7d5-4a9d-a5fc-b1e2e248ec29", "comment": "Malware payload (NetWire)", "value": "2d27e899704d74a88696c402f638f83d6b733f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668881878, "uuid": "04bd160e-6dd4-48c5-9b54-574998713488", "comment": "Malware payload (NetWire)", "value": "29d002928802c30227ccd90a31bc6aa666794afd72fd98ac42e0bedb86d9af6af8b0910e0e23c460d767f4b4187c0b4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668881878, "uuid": "ee8db4a1-38d8-4fbf-b4ba-d00d6f69868d", "value": "T184E1C810ABAA8336CD66877B9C7393915278E7419943EB6EFCD4111FEC063584E637A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668881878, "uuid": "eed2d9eb-9048-4e7e-820d-0b1e345f5cda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668881878, "uuid": "982ea930-d526-4ebe-b138-a254fa0fb062", "value": "96:aXaIztK8DAKuxcDFlIdLfTXTWBkYPeDsOpDOxk7AVdbFRzNt:aXawo7KPKdLfykY2oOpDOi7ARz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668881878, "uuid": "03855279-6820-4bb9-bd69-35f40818eb94", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668881878, "uuid": "ed542d1a-07da-4fe6-90ef-4eb5f8f5b039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668881878, "uuid": "410ac226-e1c5-4bd5-882b-723b87957dba", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab2a24a-6816-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668868288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868288, "uuid": "c8df8992-071e-416d-bb6c-4abc1784f02f", "comment": "Malware payload (Mirai)", "value": "a3cc924514fe27f14519db57bcedd471", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868288, "uuid": "19bab36a-6b9b-48bc-93da-aa5316604005", "comment": "Malware payload (Mirai)", "value": "33e46d23069d2abf8a5b7bd5cf3ec3fc11d9a91ea627356dc12cb4d9b4eb5c95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868288, "uuid": "3fee9926-ad1b-48e3-a69a-8d398a7db342", "comment": "Malware payload (Mirai)", "value": "617b03e5802fd40ff46deb167280366461412d3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868288, "uuid": "a8974936-8371-43f2-b120-b580de8cb075", "comment": "Malware payload (Mirai)", "value": "52953d88fbbd3aa7b6cf6bc78df5f53085493168722196e13e981937192f5e0a84363ebb7cf4ad705fcd5a8ccdf947a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868288, "uuid": "89840516-4b9c-4e43-97b2-20bd8be23624", "value": "T1C2E2F29C56009677C86688B54B9B07E03DD62F46B64BEC0F12D4F357A58DC5B7082FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868288, "uuid": "991c85ec-d7a0-4875-9b45-c69cec436158", "value": "768:44yUFLK2F4tS1f7xLF4FjyUZR/kj9oJgGlzDpbuR1Ja:44tJKQ0Qf9LF4FGUZR/s9oVJuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668868288, "uuid": "3c890337-9b4f-4d0a-9ede-2d68a60a6e5d", "value": 31704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668868288, "uuid": "124a8a1d-a9a6-417b-afc1-68fe94ce49b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868288, "uuid": "7fb0a830-5859-4657-8b99-39dc15962841", "value": "SecuriteInfo.com.Linux.Siggen.9999.11659.28246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e200f79d-6818-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668869159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668869159, "uuid": "a637d2c9-9905-4849-bec4-1b67385a9663", "comment": "Malware payload (GCleaner)", "value": "7c6ddaf251fa5120015b6d21201512be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668869159, "uuid": "271fbb56-2be9-4777-a047-526db205ee83", "comment": "Malware payload (GCleaner)", "value": "354085e73e84ce5c128c3627778203de7ba500235cbbe7c8c1e8e4616503a59c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668869159, "uuid": "a0d426a9-8fc5-4736-ae3c-afc4a683346a", "comment": "Malware payload (GCleaner)", "value": "c6c4d4a327174d52036e41539c64270bff8935f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668869159, "uuid": "ccedf3d2-5479-47b8-bac0-664b02d5e1e3", "comment": "Malware payload (GCleaner)", "value": "4d496e977eb60001ed5479e55aa13655c6e5104ee7f8da84be045ae0fcedb8b8b0fb0299c5a4c09a5c8a50d6693742ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668869159, "uuid": "c4cc1ef0-c193-475d-9324-353d672baf58", "value": "T17AB5F0416A52D296C82F2EF0E55174F909BA3D62E81EC23BF3957C4DFEBD383910A911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668869159, "uuid": "a8bdc304-d181-47eb-820a-705687657379", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668869159, "uuid": "0a4095b9-60c2-4973-93c4-982aad4c3020", "value": "49152:q2ZnIRInYZ815ELEkjsCOmND1UxT7mUxVkBaFwnm:rZnmIYe1fQsCVImUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668869159, "uuid": "c1340c53-d145-4794-9e93-f38230c26f9b", "value": 2364531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668869159, "uuid": "9a6b930d-3c1a-434b-bcfa-57d4e7386a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668869159, "uuid": "07a7208f-db2b-4fb8-8d56-4aa79d886cb2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804dcac3-6825-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668874579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668874579, "uuid": "dd52949c-326a-41e3-b3f4-eeb503910384", "comment": "Malware payload (GCleaner)", "value": "c314348753c725c69aa7702834a647aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668874579, "uuid": "4587a694-daee-4574-88d5-0c4090a4e434", "comment": "Malware payload (GCleaner)", "value": "3647fc4245462cb91449db61aa062024fa0d12412265fbc99dae6d6ab5a6680a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668874579, "uuid": "4d35f1b5-5e1b-455c-8fbd-751ecb8a34a8", "comment": "Malware payload (GCleaner)", "value": "4508e33d9329076f6d1c8daa87c77383cdc65fa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668874579, "uuid": "4877e251-5a73-4181-a55a-124b42009225", "comment": "Malware payload (GCleaner)", "value": "ffc633446db5021474695599da383e61280e19c08192b81830cb9849e798f0df1e87d095f9c8b70a7b451b099d110ca1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668874579, "uuid": "5e711a27-7ded-4b79-a3f7-62293e027d3c", "value": "T1EBB5F0556A86D295C82F6DF8E22474F84DB63DA2E82EC22BF7A27C4DFE3C3574009541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668874579, "uuid": "19a6a16e-32fe-40e0-ae24-9a01c13389c6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668874579, "uuid": "e6610e62-e3c1-45d4-b7df-4050c963e451", "value": "49152:q2NZ+J/lF4Gz0Q/nHsNKJ/X6PvzpIUPyNUxVkBaFwnm:rel6snHltqHzpIUEUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668874579, "uuid": "b330691b-342f-4ced-a571-36ba340d3668", "value": 2342711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668874579, "uuid": "cf1dab06-d0b5-46b3-93e7-8d406e69a140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668874579, "uuid": "b09b744a-7c83-43e1-bebd-c168d1ad955e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19db5f0-6857-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668896190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896190, "uuid": "11638bf4-410f-435d-a2b2-183d781f8e55", "comment": "Malware payload", "value": "6a14bb7917974805e6e2300b1a1e6f5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896190, "uuid": "6560eb0a-f132-41f3-ad08-69d81f5bd8b5", "comment": "Malware payload", "value": "3771010ad488543f75fad1eb4deb1430b8c2c7eeca88efb77faa3d618a167983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896190, "uuid": "29886256-c936-4042-99ba-fdede5d449d8", "comment": "Malware payload", "value": "b87739bc2277b927c8dec19cb712e34296986e31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896190, "uuid": "a5024861-1810-4fef-bdd2-65d2515f539a", "comment": "Malware payload", "value": "79e21a91df3fe4c248f1d633d84b6c9044eb31c127efb4f810e33e623158e746c8d105f5e4c9ff61e2ccdc3fd773dcfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896190, "uuid": "e0033fe4-6ac7-407d-b5e4-e40004d715f0", "value": "T188C5F0406A56C2A2D82F5DF0E66464F84DB63DA2E82EC27BF7927C4DFE3C3678149411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896190, "uuid": "5156ee51-c20c-4ba2-810d-dfa7f2d4c1e5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896190, "uuid": "83db2d16-acff-4f4c-b6b8-8fb0e2fed23f", "value": "49152:q297ucgNtocBLk8skmXp7m1ToL/Xy1BwDFoXDCa36UxVkBaFwnm:r0W0LJstXpATgXy3w5kDt6UxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668896190, "uuid": "12cde914-1fa2-46fb-a8bd-d63257b191e7", "value": 2523125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668896190, "uuid": "1939ce08-5620-42e7-986d-cd459670b728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896190, "uuid": "e4f2d925-fec3-4e43-a22e-00bb067d5e38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5997da9-6813-11ed-9266-42010a9c0072", "comment": "Malware payload (LaplasClipper)", "timestamp": 1668867045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867045, "uuid": "fa2d7ece-63ec-41d7-a354-6e67a033d5d4", "comment": "Malware payload (LaplasClipper)", "value": "3766798cf24a515d31a3503ae8568eee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867045, "uuid": "437acd51-d54d-43f2-93c8-00909fb3df11", "comment": "Malware payload (LaplasClipper)", "value": "39989ee85d56ae59453e4ab5a7336b393650d4f5c0ae45d7a3854a8cd34b11fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867045, "uuid": "7bc04095-2261-4e19-a691-625a1820c15f", "comment": "Malware payload (LaplasClipper)", "value": "6060525e98e32674352b6307f8923636e0696fdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867045, "uuid": "d30a995f-e8b0-4935-9a3c-88ea54ce78c6", "comment": "Malware payload (LaplasClipper)", "value": "26abfc3938443bdc6fa431e17b712612c46b3a7ae9d6842a709253dfa730e6ccd5a54de97336b12f30cb4becc390ac33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867045, "uuid": "ff8619d9-ebf0-455f-b702-2a0154c38469", "value": "T195F1D805BBD88669DA9E473504B743150732B726F633CB9F18CC91AD2CA76980A423EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867045, "uuid": "e3f52e03-84f4-4051-bf56-2acb7e6e9fe3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867045, "uuid": "489ac011-012d-4787-89d9-e09d5232a51a", "value": "96:Y8M4co5EAspdZYHmLG5rUVAVZB/uxOAyKXYHzhlVQH6WBme9qw4cKsP0M:YXo5ELtYHmLGeCP/ZIYTJG6ume9qwFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668867045, "uuid": "5a61fda0-96d8-4230-9ee5-99b4ab0f1856", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668867045, "uuid": "1aca750c-4057-48e2-9d95-7286f7caff4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867045, "uuid": "469a054a-18cb-48b5-b71a-c633be0244e7", "value": "3766798cf24a515d31a3503ae8568eee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0366886-67d8-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668841669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841669, "uuid": "de192f94-4a17-4ba8-ae66-7a699ca6b38e", "comment": "Malware payload (Smoke Loader)", "value": "1b26e3cd0be9174302ed5ade699688c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841669, "uuid": "44929573-b00a-43ff-a8c4-270602afabc0", "comment": "Malware payload (Smoke Loader)", "value": "39c07f442dd404c3cba7c2e1253bb3d9b6ddc21dda51697516852adcf636f783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841669, "uuid": "784fa45d-a3d7-4599-9731-4f193607bf7e", "comment": "Malware payload (Smoke Loader)", "value": "d38be0b180b8fd9f164de541d0213acf1bd05f17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841669, "uuid": "8ebaa234-e13a-46b1-bea1-3ea3a76cff95", "comment": "Malware payload (Smoke Loader)", "value": "8c46899a5bac5679b4e8f133cf3dc2f12e20fac06ad4ff44460bf31ead807beae2121a4763936e473acc6d479bdbb400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841669, "uuid": "9e958041-ee34-4f3c-be03-9787ee6ca258", "value": "T16B74BE10B284FE72C4D10771892DEBF66E69AC615F6586C333B8EE9F3D301D0A5B2A15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841669, "uuid": "6f7d8cc8-f312-461a-b135-23bb5a81dc05", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841669, "uuid": "b932f6b9-98ad-498b-b087-e05875d5bd25", "value": "6144:CByQ0YzHgP8ZMy21ygdh+3oQ9gOU+fzYBb6:M0qM8321yga9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668841669, "uuid": "a498bced-6273-4129-8eb6-45994331b84b", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668841669, "uuid": "fe040dd3-2261-44bf-816f-f5e0d94c112d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841669, "uuid": "3ac323a8-b55f-4c6d-95ec-cc569c48c1cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2571af4-67d0-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668838129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838129, "uuid": "1d7e60a0-6624-44aa-ab8f-27b7addeabf6", "comment": "Malware payload (Smoke Loader)", "value": "bd25e91a89601e5cc52c523fa265dc8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838129, "uuid": "23a1fcda-1f62-40fb-b7cf-2c278fb660ba", "comment": "Malware payload (Smoke Loader)", "value": "3a5e240eceb09ac5b323a304ad41341822678a9f589b33a8692c732f844ad731", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838129, "uuid": "25c44142-1fc0-400f-a3f3-89e118378b9b", "comment": "Malware payload (Smoke Loader)", "value": "dd7f85cc02e8540774cb1f82f926da95d88111b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838129, "uuid": "8ddbbe27-ec11-497d-9303-d7cd29538152", "comment": "Malware payload (Smoke Loader)", "value": "36f3864cf071e79b9ce002533d6bfcff875a0a37df07c9a2971c9d4a387d68fe9d149a334a7cbf2009638820abc0eba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838129, "uuid": "efa14ee6-aa86-476b-908b-caa9dbbdc43c", "value": "T1FD74BE107684FE32C4C14171892DEBF46E79AC615F6986C737B8EF6F2E302D1A5B2246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838129, "uuid": "d8230590-0332-4474-92c4-06dccecf56e1", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838129, "uuid": "c1c64c54-5164-4265-8093-fc68a9a6a07a", "value": "6144:uLgOg1z+LVLzKTg49QWhsyFh+3oQ9gOU+fzYBb6:5Og0BLzE9QWhC9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668838129, "uuid": "99563960-620e-4aa1-895a-8cef09ad2770", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668838129, "uuid": "8f267041-d775-42bf-bb82-c9b65d284b97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838129, "uuid": "e36f2d81-e198-4165-a9c4-ed6e04af58df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eccb75d-6843-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668887408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887408, "uuid": "5f5ad336-9553-4b26-b827-d5611afa07ac", "comment": "Malware payload (Mirai)", "value": "ac5ab2e30ddec1b1d37bc434cd5ae46b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887408, "uuid": "63ba0d19-320c-42ed-a9fc-033c98b88297", "comment": "Malware payload (Mirai)", "value": "3b9194c06d2b95f4782dfab1cda1f7b2aa6d4b577f5b4089b5d28bf50fa9b46c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887408, "uuid": "4d6c0e67-9879-44ef-935a-a357b384ee0c", "comment": "Malware payload (Mirai)", "value": "a366ad4916013fc5146c8680521f1ade686f38fa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887408, "uuid": "64f1894c-de42-4583-987f-0fb825a9e2b6", "comment": "Malware payload (Mirai)", "value": "b397ba10b2e83c925305236fecd858cfb8f4df092b6303bb0b2c418a42b6adeff43232d935ea4f745a955317b8520b46", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668887408, "uuid": "a05c3a11-64f0-4d49-be42-ec2726470fe3", "value": "T1A2B2E13AA9A687F0C724447DEE9CD6073AF316F2592F30A92801137C969FD162D75BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668887408, "uuid": "8b767452-842f-42ba-8cb9-675b803bd644", "value": "768:XCJMhrvFhtxRE3gr0WM+ZWkvkCD5ps3Uozl:X5t5o2o8kCDWzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668887408, "uuid": "3e8122fd-7ebc-40eb-8798-28cc6fda92cb", "value": 25196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668887408, "uuid": "160045fe-547f-4f90-9dd2-372cc969a33a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668887408, "uuid": "d0fc28ab-79ff-4dc8-84e7-26ecc84cc77c", "value": "phantom.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77dd77f-67bc-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668829628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829628, "uuid": "6e32aa5d-9024-4a52-a92f-5b933e4d8432", "comment": "Malware payload", "value": "a8668f502a915245b0a52989247cd148", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829628, "uuid": "3dfa7d8c-65e3-4599-8b39-a1ad51975a32", "comment": "Malware payload", "value": "3bc1016d3cc2c0a15557aa9ab7e8c1001312561349a677d0872e9b72db95f1cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829628, "uuid": "bca75c00-dcc0-4109-ad50-e77322319123", "comment": "Malware payload", "value": "30342377cb140e0c1cc1e8833877e125b327d546", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829628, "uuid": "9c5fe4a2-9ef9-46e8-9c0a-b73685c81339", "comment": "Malware payload", "value": "aafbcabd2af6003cd41d74ffeb1291e50362132f850145383374c1621dbead08a9d312493c0d50beae6347d0e145cfa4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829628, "uuid": "5dfc029e-8c18-443f-b969-c0d7f66f7245", "value": "T18C158AD22081F1A7D76596F5D155F4F609FC3C38EA1C22EB40633E60307EE6AD86A46B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829628, "uuid": "8d7c1895-1269-4f59-ae6e-9563b6e5beca", "value": "1818e86e01a8cce8b1f337b9457805bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829628, "uuid": "71af4061-19dd-437d-99b6-b095deb22236", "value": "3072:RSYXGw6CPL8ps6U3vUAlBlbusYkt2OETV3p8zZbni72qlGqG111JvXy0RhPZKwCt:RSYXecod0CTx32hi72qlS11dXY7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668829628, "uuid": "9625f3f4-bfc7-45c2-befe-dbc936964711", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668829628, "uuid": "c03a8251-1f2e-4588-a072-776718417bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829628, "uuid": "f7339d9b-db84-4d9b-9bc1-36c5048d314a", "value": "a8668f502a915245b0a52989247cd148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67732cf-6821-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668873005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873005, "uuid": "98306405-a646-4f2a-b53d-5f9eb1b71145", "comment": "Malware payload (Mirai)", "value": "a6c236a51e4b1874aaf54ada9c21a905", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873005, "uuid": "c91c93d6-6459-4d9d-b839-a25dc31942e5", "comment": "Malware payload (Mirai)", "value": "3c89346f1fdbf260d87ced4ace7b9fca365690738b13418a892f779246156fa9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873005, "uuid": "082966bd-9748-478f-96cd-74a285393796", "comment": "Malware payload (Mirai)", "value": "21bbebdc4c4aec0bbeb81fcd5c8212d78eb85647", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873005, "uuid": "1e2fcd8e-ceb8-46b7-8d9d-cb0f5fd867db", "comment": "Malware payload (Mirai)", "value": "4646837ca217151a465afe8d04c0ae8fba43bae7f26c1389f9266f706b372c99d160215b6328f0ecb793c54c006e924c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873005, "uuid": "761fcac1-37d0-488a-94b2-f92c47337674", "value": "T1CAE33C86FA408B13C5C61B76FAAF42493312DB55E3DB73068D185FF43F86A5E4E22606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873005, "uuid": "b078256a-d4cd-4d7f-b349-393b566947e0", "value": "3072:dYbSBJRwtnTssL3lYqNAnIYTouy3FpzUHjcazWZSM/9X/r:ibCRunTsuBYTouy3rUYazZM/9X/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668873005, "uuid": "9795637f-d3ea-44f4-b317-74f40e3da9d2", "value": 144095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668873005, "uuid": "ab45e272-9434-4968-988b-179f98531029", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873005, "uuid": "27224bed-1221-4a01-a31c-de38ba006663", "value": "Mddos.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612f6ac2-67ea-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668849186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849186, "uuid": "bb0c9d32-4f19-44aa-a2c5-d51cedaecc91", "comment": "Malware payload", "value": "efe40e1d4e1bd9e7f4b7230cec25bb50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849186, "uuid": "90f923d6-726f-474f-af02-b0724c4cfcb2", "comment": "Malware payload", "value": "3d5a787b542e99185d5c151123edefa249851be0a5c1ffada2bd30899a3fdb0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849186, "uuid": "5a90d56b-600a-4684-8182-e153809e206b", "comment": "Malware payload", "value": "527268f4f6c9ee14e2e09211d4de1ef266827aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849186, "uuid": "9ee5c502-b75a-4871-ac10-fed332a9949c", "comment": "Malware payload", "value": "ced1e8535e8243eced2715c9dbf3ddab92866f3281ab9d5e1967faa8e276245142464f36e810bdc110e443ae65c61d5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849186, "uuid": "77215438-9233-45e6-8776-3df33ff6d405", "value": "T149763304B1FAA6F7F131B871AEC05FD066A57E754F2A407F1BDA88402EBD5D0C2A2617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849186, "uuid": "01947be0-c118-4530-bc48-992848a81966", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849186, "uuid": "b8199bb7-2226-4e05-9832-b10a9af430e0", "value": "98304:91O2pPumTijjMHZneTWe1gMN+G7aG9pDij5O239Z0m8FrZbSapTYOTuF:91O2B0sZneDbRaG9pD4l9UF9SLOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668849186, "uuid": "68683619-ec42-4bc1-ac3a-16203ef3f20c", "value": 7598860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668849186, "uuid": "5ae68919-c642-4adf-a174-f3e1a1b483b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849186, "uuid": "8ee0b74e-c883-464e-a5d8-4ad23c5a73ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f04381-6853-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668894159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894159, "uuid": "70ca5920-30cf-4ba7-8440-89ab03b097b7", "comment": "Malware payload", "value": "99e4a45290771971d63e6d94646f2029", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894159, "uuid": "e56e7349-f665-495f-a22b-486ef20d075e", "comment": "Malware payload", "value": "3d68b1e6c89a05f0ccdc50ca3144123c736c31bc818e5078258028abb59401c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894159, "uuid": "238d8273-b6dd-4919-a237-38564614f839", "comment": "Malware payload", "value": "45c231d7e7f31b95a85dff0a92fcc4329dbd8f1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894159, "uuid": "a2a62b4b-e2af-4718-a535-3697c3b0a599", "comment": "Malware payload", "value": "cb292c8d4d4b3eafa4172181163b73abc549dafd3775c75b2b43ff6f5fa08edeebba0b12b804e4d6dc5384fbfcbb0cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894159, "uuid": "52b96f16-9c0f-45a8-a0b6-2be5bc10feab", "value": "T1AEB4E011FFD1D4E6D47CD170BA12D7E9467DADA03921D90733386A9E2EF02928E62335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894159, "uuid": "2d7d8b25-fb71-479a-812e-0185e4ad4267", "value": "c8c0db015ca53b9ef621505ac544aadd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894159, "uuid": "ddfa7752-24e8-44e3-961e-cecd194812a7", "value": "6144:Pbkup7VyiFHqabdnH0d0jqHpOubINk3/vwsGauceFYCZhVV4E+O13oXc:Pbk2nHqaAtbOC/v3hi0DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668894159, "uuid": "5c279b83-2c41-43f9-9819-949db3170731", "value": 494528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668894159, "uuid": "0635d2fe-6b52-4569-80f3-578489cb4c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894159, "uuid": "3d4616a7-3414-4b35-8ece-8030f80c9024", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6c97f6-67af-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668823950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823950, "uuid": "c38f981e-5fc8-4138-a470-1683107069df", "comment": "Malware payload", "value": "d39018ec2d5021247f3ca77f6c6e92a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823950, "uuid": "058cbfff-73f7-4597-901d-61b6cbf00a8c", "comment": "Malware payload", "value": "3de329577da07d7bfd459e2ef41c432e40ff7e7294618faa327f9007a56879fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823950, "uuid": "c5fbc7e1-9f2d-4299-8537-089a46ec0e42", "comment": "Malware payload", "value": "d482aa3797623068c0ac7d4262d3db2d1323483c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823950, "uuid": "5e21fc08-f403-45fc-b072-3ccd811e63b3", "comment": "Malware payload", "value": "5a8f28a4001467793a5bae7514163c0e478d9031fb509e7415a8fca1e55c4ba82b85e37a459fe8352950cfc5a082d1ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823950, "uuid": "358b5263-4f64-4459-b20d-a813028b6ec0", "value": "T10C763321B695ED7BF1F528318D6A27CDA32ADE0C0E4045FBB2D8141CAD3E79D972C261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823950, "uuid": "64e5884d-ce6b-43a7-815a-33b845dc268a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823950, "uuid": "93980b76-d567-4af1-b1a2-5bb1501c0d49", "value": "196608:91O+IVFUy31i2Q5B0nHU2VVZ4DIrIUQrB+pXv+8cocZOS:3OVFPFEA3DZ4DXnOX28cZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668823950, "uuid": "98d0b9c7-b4d9-43fd-99eb-df1e7131bfc2", "value": 7601167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668823950, "uuid": "993e5159-e04f-4458-b051-81ae4273240d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823950, "uuid": "fe4605d9-d66c-4a33-9728-1ee5e3e6eb6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9990b78a-67a1-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668817928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817928, "uuid": "a7efefbe-cd31-4596-9df9-6e54ba35cc8d", "comment": "Malware payload (RedLineStealer)", "value": "de08ba584af5b4baf2031410f9fd4201", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817928, "uuid": "bddffd5e-1978-4965-9d4e-144b5a21c0ed", "comment": "Malware payload (RedLineStealer)", "value": "3e3fa8c5f5cc4ff95f439d86a4be759fbbc124e6655210d887459137d1c989db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817928, "uuid": "0324ef16-de0b-4b8d-86f0-8026fa6d9d78", "comment": "Malware payload (RedLineStealer)", "value": "7b7ebcd40037a8ef8ba33d35eb45019510f23790", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817928, "uuid": "79813834-9219-4051-8239-42bafa0aaa16", "comment": "Malware payload (RedLineStealer)", "value": "118715ed7b90bf06458c68955d5950e3a77bf444a1d9c6f9117f4154873a3af65b510748797e606deb82642052880294", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817928, "uuid": "41b14642-380c-45a4-b811-638e0326b7ac", "value": "T19D34AE03F094026DE1FAD0BC14D693D1E32E9E7EAF9C158BDA7D07695B100E0A671BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817928, "uuid": "608cd73d-53df-44f1-90d4-f7054213c834", "value": "19e0e0a97efc31b1e39a2bb2ebdd6fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817928, "uuid": "670768f7-c2e2-4f91-b899-851a83cd6665", "value": "6144:i4cRMLazRHsMgiqHxyBzqNJrhd02K2WB:iRMOzRMMyxyBzqbn02K2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668817928, "uuid": "4ba8ad93-e817-4984-8efc-8a1f0fec62c6", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668817928, "uuid": "9864552b-6c2b-4184-b849-056a7e7ed36f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817928, "uuid": "89610c50-b06f-4839-b8cd-ce365d11fda2", "value": "de08ba584af5b4baf2031410f9fd4201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535e3f21-6803-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668859901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859901, "uuid": "57a87817-c690-4ce4-91a3-d142ce84ae49", "comment": "Malware payload (RedLineStealer)", "value": "1b1cbe1d9c1559dd728736f180328fe2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859901, "uuid": "c4aa5647-d87c-485d-80d0-9216ca0968ba", "comment": "Malware payload (RedLineStealer)", "value": "3e79825ebc2073617eac207ffaf639a4dd97f7436b4b25b7226617adc59b689e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859901, "uuid": "51858ca2-d72a-4921-884a-6c046365ba4a", "comment": "Malware payload (RedLineStealer)", "value": "825489b3abebad27af119799b74dbddc98baddb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859901, "uuid": "79d878ba-4da0-4a0b-966e-2ab7eff5b5d9", "comment": "Malware payload (RedLineStealer)", "value": "c0b0f451c087a135bb3e068bbbbe9d8cf585df37a7cbc0bb5d638ce397a99d25b7613ab42aab97d6d743fed049a69dbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859901, "uuid": "57d34cc4-ad98-4d77-be40-06f39e0f4666", "value": "T1B2B4F135B671D4F2E1614270C421EBA529B9F9A13820D9033714FBFF7D30A9D5A6E23A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859901, "uuid": "3d863df8-48d4-434f-85e9-b9d3c80a4653", "value": "063e5449636b8762744e9ce9f5564a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859901, "uuid": "b07ce316-b8e3-4cd5-8713-fa976c3a4c5e", "value": "6144:fmaCT9YRK2I8fwCQezt1oPbMpznJNqlZPJx03jpPnFwCLLObfwB:fST9YdIIfQwt13pbUZ70TxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859901, "uuid": "513946c1-c871-4ed5-9fc5-b69991a0e5f2", "value": 496064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859901, "uuid": "9b62ab8c-7fd7-430b-ae12-9dac8281924d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859901, "uuid": "956e97f6-b12b-4b0d-bb45-d453c87b49b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7faca08d-67df-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1668844513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844513, "uuid": "29bcfe3f-b0fe-4764-a8ab-bc2a8cf673ec", "comment": "Malware payload (DCRat)", "value": "651e5d24cef9203b89465fac484e67a1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844513, "uuid": "4c4ce578-14cb-475f-b432-8b8898e6cd88", "comment": "Malware payload (DCRat)", "value": "3eec665cf5bd3b0c408422fb4e494b2212f57600e9b7267a8540a1867aa5fdfb", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844513, "uuid": "b21d73c4-dbc8-4afa-ade6-571d6ef321f1", "comment": "Malware payload (DCRat)", "value": "4e36a4ae78957095fa0ded087b12a430020d37e7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844513, "uuid": "e3838702-efb2-4a0f-8fe8-ba307ed1c97c", "comment": "Malware payload (DCRat)", "value": "a201dfcf8c1ff8ec8c7e724f7307affd5c59579cc58be8f4377b3fd3851395a749159ec2ac485c19eca862b4413d3043", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844513, "uuid": "8ba3ba10-002f-4686-a9f9-fbe4cb1b425d", "value": "T1901575342EEA1029F173AF7D8AE47596DA6EBAA33707995D00B103C60723B42DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844513, "uuid": "4fd94eb0-1d38-4b9c-9199-699585b55b3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844513, "uuid": "212c8d67-a5fc-431c-ac75-80868b38f918", "value": "24576:WYNFzwjpsJwj5PB9+p3vU0gb52GHNHjMbp:Xz1Oj5PCBCyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668844513, "uuid": "9e4197db-4842-419f-8276-ec8b5627cb88", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668844513, "uuid": "59a9054f-8964-4ac0-9296-8480b895584c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844513, "uuid": "1951f984-406b-40d0-8a63-f50fa759f98f", "value": "651e5d24cef9203b89465fac484e67a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62d2d3a-67ca-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668835692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835692, "uuid": "4c68dd12-381a-4c05-97ee-497e48003cc2", "comment": "Malware payload (Mirai)", "value": "df9ed01efbc8bff7f314cea1410f7f0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835692, "uuid": "b46f12af-81e0-4be3-a747-3a4857da4476", "comment": "Malware payload (Mirai)", "value": "3f08fa6986ee9097de722b034f130c9875d45fefcfe7af687010676950adc4ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835692, "uuid": "d7d26d5a-fc20-4cbc-9cf6-740343f471ad", "comment": "Malware payload (Mirai)", "value": "29f3131e806ddcc8346638bb1115497b01fad752", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835692, "uuid": "df571177-637d-4930-a6a7-85b5ff4be88e", "comment": "Malware payload (Mirai)", "value": "9e9766b322eeaaa70d529d7ee4197332ced87e2c1a9904868b0f44a29831dc50edb17a9c1be34c1c8804f277b82c7d3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835692, "uuid": "161f65f6-f2ad-47c1-9848-fab85b0ac0c8", "value": "T1E6B2C0CD61543084CA8D7C7C178D4A664FACA1D0BAEDCB16E350CD99B3BEA4B385D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835692, "uuid": "b30628cf-d58b-4212-a795-e2dceeb7f9aa", "value": "768:c4rQlS07dEv0UXqUhvQE+CXQKMQKCXBp4xZq8Wv7:BQlS07FUXqIYSXQKqu43qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668835692, "uuid": "f16c537c-defe-429d-b2d8-917d22ab9840", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668835692, "uuid": "03b97a8e-5dec-4a24-8eb8-600b3794ad59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835692, "uuid": "1cb3bb28-da6a-4ef4-b545-c1464f137f35", "value": "df9ed01efbc8bff7f314cea1410f7f0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d247c71-6857-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668896048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896048, "uuid": "4c871897-7d48-4c92-9b9a-d40a2d7ea30b", "comment": "Malware payload (Mirai)", "value": "edcca365d94d4136485a5007ba9459e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896048, "uuid": "29b67cd9-1a19-426e-93c1-d4d5237ccc3f", "comment": "Malware payload (Mirai)", "value": "3f450a22abab32ed94d1e1a08fb4723875e834400e62c735cb6b930d7b18722f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896048, "uuid": "b68e1c89-fc30-4b09-ba9f-0d3815a84e05", "comment": "Malware payload (Mirai)", "value": "6a0178540a846c401dc1e8812649ae3afc378176", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896048, "uuid": "f7ad6e00-febd-4664-b8ac-25fc06898657", "comment": "Malware payload (Mirai)", "value": "95e243e1cfff3698804860d8c563084628dc33ce316eccc68e37ed16b32ada066feec415a35c8cc3f504f696aae5d3fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896048, "uuid": "f6451130-5963-47ad-a041-641fe6b9dfb7", "value": "T1AAB2C0CCA1943084CA8DBC7C578D4A664F6CA1D0BAED9F26E350CD9873BEA4B345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896048, "uuid": "341a8933-ef46-499f-8d44-40a25f24d6a4", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBp/AZqSWvK:4QlS07FUXqIYSXQKqu/YqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668896048, "uuid": "3debdd9b-92dd-478c-baf7-2555c3deeb1e", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668896048, "uuid": "9a9ede97-8996-46c0-8d93-de5e9c1400d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896048, "uuid": "efc2014e-d608-4cd8-8feb-05e6358b5d68", "value": "edcca365d94d4136485a5007ba9459e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebf29da-685c-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668898279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898279, "uuid": "7b2e7e51-57a3-46f6-a22b-7de72880a362", "comment": "Malware payload (Mirai)", "value": "b9e8f33add38e3c28254347d241be042", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898279, "uuid": "53aabb88-9080-4831-8e8d-a1adb3c7f36a", "comment": "Malware payload (Mirai)", "value": "40616fff0a2e5d83ec13d820e332eb135f28da51bc213869c028375f63f83ba0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898279, "uuid": "8940be1e-dc10-4372-9e1e-d48ad1cd4b4f", "comment": "Malware payload (Mirai)", "value": "adcc1dbf3ac667ee95e8aff5e39a406b87233c93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898279, "uuid": "f08b6fa1-75e2-4c8d-b955-7b846dcc7229", "comment": "Malware payload (Mirai)", "value": "da846e12b26d1ae79852036dc043e40565c56d893a51d3ec34b9a95c985bcf9d32534a3e8502f9dd04f986e848a312f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898279, "uuid": "67b30b18-a7a8-426b-83c1-6e0ba38ccd05", "value": "T1B513F26060553891F0A09179FBE6444AE30B86FDB2EEF531EB64C2BC28D5347523D4D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898279, "uuid": "8c8e8d3c-ae57-425c-b719-4985ff4be7c5", "value": "768:SmsTVtQowzwbWLl9+M5HQ+eIJ5cAxzM34BIJf8fnfpJx/PdQCw1YCnYPvAQRWs3k:SmsTVtQVzwbWd5HIIsAxzBe8PfpJx/PC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668898279, "uuid": "848175c2-4a89-4bfa-bb0a-3403d4b4e2ff", "value": 41524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668898279, "uuid": "efb3ec0e-8bc3-47eb-87d0-a11cbde5af2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898279, "uuid": "687aa1c0-d07a-4092-8598-616953f12f2d", "value": "b9e8f33add38e3c28254347d241be042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87441fd3-67dd-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668843667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843667, "uuid": "16682ab5-e1a5-4005-9714-3e5ad872eaad", "comment": "Malware payload (Amadey)", "value": "3deff39bbca2db39df2179f2c2e38ea8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843667, "uuid": "3a0ddf3d-8732-4373-9af0-7cb43d31d0a0", "comment": "Malware payload (Amadey)", "value": "40f8dc182cbf02ca46b26a9d98adae54eed934f5fee1abbceaf837feb7220554", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843667, "uuid": "bb5b53cc-6929-43cc-abc6-d5c9d257d6ac", "comment": "Malware payload (Amadey)", "value": "223afe3db0f867fda17280d76dd4accafac991e6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843667, "uuid": "fd4e31a3-affa-4885-ab41-d926f1229b3c", "comment": "Malware payload (Amadey)", "value": "b508a99369ffd2436729418dd3b46e39749c27ed9df384dab43b2ff2fdc8217dfcd027d5f5b0146ba087fb673baf020c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843667, "uuid": "e024e9c1-52d9-4775-83d2-64aff0f14f9e", "value": "T1D684CE117684FE72C9C10171982DFBF5AE39AC912F1589E733B4EF9E2E302D1A5B2215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843667, "uuid": "becfe2bd-59e2-44f7-a568-ee04b6ab62b6", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843667, "uuid": "231734c9-4527-4905-8b39-db19c8e45933", "value": "6144:1YLIcbzCFOzdZgZaVVnWEauh3jRIbLOgh+3oQ9gOU+fzYQ:1Pc6AzdZgZaRh39I2v9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668843667, "uuid": "9b890a53-41bf-4c2c-87ef-09f09a63afe0", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668843667, "uuid": "22509c92-bf26-47d9-a19c-09ef0809f4e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843667, "uuid": "46499d2e-f461-4cfd-a07c-4cd2483f9030", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f171d61-6827-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668875382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875382, "uuid": "ff0ef5b9-4d74-4adb-b883-1a449a5ce48d", "comment": "Malware payload (Mirai)", "value": "74d5bc0af95aa45bba1c46215b14c9c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875382, "uuid": "69d511fb-4a6a-45ae-8c8c-ded83fcec1f8", "comment": "Malware payload (Mirai)", "value": "4162ff7c95f9d830858055e85facd4a22c3dfb471d62be39136f74eba1e30144", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875382, "uuid": "9ee2adc6-7073-4a89-b88c-f9772245290f", "comment": "Malware payload (Mirai)", "value": "87052fb2bca9a6e5a146497e0c1a6396d7cffd21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875382, "uuid": "f0ee34f5-c825-43a1-8add-5bcaaa21703f", "comment": "Malware payload (Mirai)", "value": "69141471770710eac40bde2ba04b1e1f4be259f4a4104db8c08e56c622490ce99af3ce821716b4487e393de74298721d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875382, "uuid": "477c0180-638c-44ce-bdb8-78bb183255be", "value": "T1C5536DC6B4119E7DF5CBE7BE44224D0EB921A22150931B27B76FFC83BD731A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875382, "uuid": "fa51a24a-8726-40d0-b166-baa1fa4175c0", "value": "1536:bvKRgcF4TbSX5lxLepSGoshyFpcrOhOJ23nJ+q6HSo8h:eBTjYuD8gV6y/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668875382, "uuid": "a26c1dfb-5104-4c31-bf87-f185e6ec8106", "value": 66516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668875382, "uuid": "6f1bbb71-c86f-49ec-af1d-a2adf3a71f12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875382, "uuid": "5afd61af-01ee-49db-9bdb-442aeebab756", "value": "74d5bc0af95aa45bba1c46215b14c9c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072fa9e3-6849-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668889838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889838, "uuid": "6f764a51-384a-48c3-b1b0-746d0e444d09", "comment": "Malware payload", "value": "1317267af876725b9c1ffc5ef8fff978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889838, "uuid": "2100bedf-53e7-4eeb-9c7a-08b6c27bcdaa", "comment": "Malware payload", "value": "426f13082c868203c60742031969fc91b7a14f1f19e1666b85afb9edbb971cf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889838, "uuid": "a95f5e71-7a3c-4c3d-8761-d33eea9644bf", "comment": "Malware payload", "value": "dffb72771c1d73bbc2986e7ea3d5d08a54f9c61c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889838, "uuid": "7d0362bd-40be-4343-b437-3553e93bf415", "comment": "Malware payload", "value": "101466d37ed76b54ad9531f93039c7ac20ebccc59b4b0055339eb5699662b1fa451217ae8f1ad079bc7d0193c9f50ce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889838, "uuid": "fee45b03-6631-44c3-826c-b8acf2ccf488", "value": "T166C5F0416A56D2A1C82F1EF4E61060F84DBA7DA2E82EC23BF7853C4EFE7D353944A541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889838, "uuid": "65cb48c4-3c99-45fb-a7f6-5d7eb508eaf0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889838, "uuid": "b22eb86e-4fac-4dee-8959-d17d4ec08db3", "value": "49152:q29wYSg+kpWpXXECIiQigK3/FcpwptdbCagTp4FKu8sUxVkBaFwnm:r9wPk4pXUCIi9gKiwptd4hsUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668889838, "uuid": "bedc5f6a-4bc5-476d-b07a-1bd823d3f872", "value": 2547217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668889838, "uuid": "f5cc52fb-e176-4c34-a96a-d1f9b3592df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889838, "uuid": "7ca57efd-a0d6-4a43-984e-57483496da21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f9fcef-685e-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668899073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899073, "uuid": "56b5a036-01ea-4d32-a3fb-d0d7a7dc5dd7", "comment": "Malware payload (Mirai)", "value": "22abc7234da96a84c5a5eb56234d8fc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899073, "uuid": "4703b61e-f845-4c76-bdf5-0aff16036e58", "comment": "Malware payload (Mirai)", "value": "42e68dbf4a1d5b74cc0f40e03b042b1747c2ee1d372c88f752c4997b29159a1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899073, "uuid": "b41b6123-8a4b-4781-949f-979e3e96ac92", "comment": "Malware payload (Mirai)", "value": "e651f7f8f06872b11e711bc28671746bd601f3da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899073, "uuid": "055f6d09-400e-4348-a54d-5b811b65f414", "comment": "Malware payload (Mirai)", "value": "4214294932d8b60acd18be450b3a6bfe7e1b4106c143b9d2e28c7a3ce0968d3e211353ab4b6ec8ecc4af638f1b53db5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899073, "uuid": "9378a332-8eca-4e00-82d1-c802f8e30960", "value": "T1C8A359D7B800EEFDF409C67640674A0A7231A3B50FD21A33B3A76817ED71194696BF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899073, "uuid": "2c52c056-6698-4dbd-8408-b1ca004cbb39", "value": "3072:Mc4T97sOib84X5Nb8WJE09NFd43SlwljqybxsJ3FG:MeBCcNFd43ynybWJ3FG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668899073, "uuid": "31c8298c-959a-4f99-bc8d-94794473843c", "value": 102888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668899073, "uuid": "b841a7ea-1370-41b6-b0f6-d63023b79f3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899073, "uuid": "c5d937d1-fb78-4537-8977-5c8c6cc0976e", "value": "22abc7234da96a84c5a5eb56234d8fc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b153c19c-6808-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668862206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862206, "uuid": "7f83d3db-e156-449c-8a54-383c02bf4ba8", "comment": "Malware payload (Mirai)", "value": "86e997103c4848f4e1a95ee54204be96", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862206, "uuid": "0ae23236-21cf-4fda-8ed9-660a11ea9234", "comment": "Malware payload (Mirai)", "value": "437f3f679c6345bc69400ca97b31842d8b08622bc79890416a085a8bdb24113d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862206, "uuid": "2e89bc8f-268f-476e-baa3-2d4aa0f5892d", "comment": "Malware payload (Mirai)", "value": "2badbeedf7d4d9a8acc45620a43d6e0c7f5149c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862206, "uuid": "34ab7844-f387-41da-a66a-22b65aabdbbb", "comment": "Malware payload (Mirai)", "value": "10a2b85251fd8f036ce1894a39b8d1583819b9bd4476f527af7b751c1f9fee42b8297adb38b4d2881800f1a6afe5a350", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862206, "uuid": "b805cd86-b76f-45a9-9d4e-f865c369cb8c", "value": "T1B3D2E117F84F4B8DC0F91232687EFE4E0940227DD9A4CA8615BC6437F568E49FD1978A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862206, "uuid": "f236c366-716c-449f-b49c-443aad137233", "value": "768:neDSPy/GNRaLn+Ei8O3SOSp6tKboPcDu3+ECJnbcuyD7UHQRj9do:eDSPl+Ln+EiJ3SOSUt8ot+vnouy8HyRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668862206, "uuid": "c7372b8e-edbb-4c88-b435-94d130386b43", "value": 30988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668862206, "uuid": "0fad82d6-e803-4306-9a9a-904fc4a41f79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862206, "uuid": "ae2a8d2b-c0b2-4d48-a788-0585851dd585", "value": "dark.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79a0cfa-67ff-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858324, "uuid": "4733fbcb-af6a-437e-bdcb-b866bac530bf", "comment": "Malware payload (Mirai)", "value": "4a3098dc663c4f7edf351dd1d1ec0433", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858324, "uuid": "cdb8470b-15fc-4dda-b941-bdf1eab7f5b0", "comment": "Malware payload (Mirai)", "value": "44039475d7287f5a1e967d755508ea2fce86c2c80d195eaca0bad5ac7a4d9236", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858324, "uuid": "8ae3a372-da9d-4d33-8061-3b98a8117a53", "comment": "Malware payload (Mirai)", "value": "d2226df50efde0a4d4faca7eabeb66efa8a1973d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858324, "uuid": "4586571d-7a22-4c78-8726-ce18b97201bb", "comment": "Malware payload (Mirai)", "value": "b8844e368c6700a611adb04412e6c098f0695b95e7ca91c7945d4477564ca7fd1df3a07e2483add7231b965de161dba4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858324, "uuid": "cead3e69-073a-479e-a898-e752ba2cd37f", "value": "T1D9C2E030A3E91CB2C7500532E77856C5BE534FBDEAFE3890124157BA3942D052DEA8DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858324, "uuid": "5d9c9f10-ffde-4542-8cc3-4ee63d4a3857", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE4m5oGrhymdGUop5hb:A8soTAZ3alkXLvFh8nNE4m5o8s3Uozt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858324, "uuid": "1ef3f50a-5fe7-497f-9c92-dd693c1e241a", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858324, "uuid": "1a8e3727-7888-43fd-93bf-ea4f08b05f8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858324, "uuid": "0cb15e33-359e-46f3-890e-44f6e197fcae", "value": "4a3098dc663c4f7edf351dd1d1ec0433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b57d2d-67c2-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1668832168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668832168, "uuid": "fad9eac0-b2b3-48bd-ba64-3a812e8f1094", "comment": "Malware payload (AgentTesla)", "value": "11963c4b53a10705c6f118806433b088", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668832168, "uuid": "c00362ce-e2a3-4c12-b19b-1bb9dfa1cce5", "comment": "Malware payload (AgentTesla)", "value": "441ea6c097b4a90985c33802fbc1023d0d195f946d40afa26121f31e6aff8fa7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668832168, "uuid": "15effef3-426b-4787-8e79-9e2c548565b8", "comment": "Malware payload (AgentTesla)", "value": "5838f144318fb7bc3a485abc228fcf068a895b39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668832168, "uuid": "f766e552-dbd1-48af-8fc9-a9ad00c5d66f", "comment": "Malware payload (AgentTesla)", "value": "edec5698d4f09390ca3b9dcbf62e17c44ab6acbe9e319db29ebbd8904ee7918a736051f18fd20a153a9291b3558ff991", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668832168, "uuid": "ad7f4eda-449e-48c1-87d5-9b7461e3c83e", "value": "T1318423E5D7C7013FB46527AD652501022D2120A4A6FDB34923E62BC737C09BFEA75AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668832168, "uuid": "ae2a06d1-6b6e-429f-ac3b-408af01b5de6", "value": "6144:/T1Gcg/dmG8SNeSd0kSF5vJFl1u5WwDuJ+LsD6N6e5DEmcLzPT1R8I:/TUr/ySQsSF5BfWWIowHoj5R8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668832168, "uuid": "a8ea4ed9-c015-4ef7-8547-f8fd38d358b3", "value": 401373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668832168, "uuid": "5589cee8-fb35-4a13-8f43-371b07165871", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668832168, "uuid": "8473a650-4026-49c4-9541-3d0f82821fb1", "value": "Amended Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069a0d10-67df-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668844310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844310, "uuid": "1b667ba5-ed8d-45af-824d-9fcc2c2c8389", "comment": "Malware payload (Smoke Loader)", "value": "bf74e95d5f42437ee35036e4e3fcbd7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844310, "uuid": "11f0de2b-4b91-4264-b25b-cf055011a11e", "comment": "Malware payload (Smoke Loader)", "value": "44230b91ef57cce74e0973220abc564d8428c9aa742a183f69bf46fe3a6f857d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844310, "uuid": "6256f631-bc49-49f3-8d0f-10a2dd526ac2", "comment": "Malware payload (Smoke Loader)", "value": "3cedb045920a8f11308714d78fa946bc949c1ad5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844310, "uuid": "74a8afeb-e57c-4983-bcdf-177d11e4103d", "comment": "Malware payload (Smoke Loader)", "value": "72260f81dfc643c811ff41572ed491e0ab22776aa12de8055cf183e5e2f8e5999c41df3d3f846ee96c524d01a5fee7eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844310, "uuid": "7f7145bc-f4cf-4b91-b56a-52d67fba89bc", "value": "T1A774BE117694FE72C4C10431882DEBF56E6AAC615F258AC777B9FF9F2E302D062B2215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844310, "uuid": "bf0efb43-10b5-42f0-ab19-3bd327ddc68c", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844310, "uuid": "80d7d512-b512-4722-9cd1-2f64196800e8", "value": "6144:FbUQTzhSfdYG8BQvoNXcO8dABZ/h+3oQ9gOU+fzYQ:OQBSFYMvoqmfA9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668844310, "uuid": "60eea930-3098-424e-9663-e01689303666", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668844310, "uuid": "3d4b3f30-da7c-4bfe-85dd-4cb93e485468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844310, "uuid": "ebd91a55-7232-4cf3-a0f6-ef399e415132", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9e916b-67aa-11ed-9266-42010a9c0072", "comment": "Malware payload (CryptBot)", "timestamp": 1668821716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821716, "uuid": "dd718caa-c6ea-45ce-a962-04f53657fdde", "comment": "Malware payload (CryptBot)", "value": "b405f6222b1217c6c781724370c72cd7", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821716, "uuid": "1b46fffd-6078-4b3f-a1f4-fa0fabddc729", "comment": "Malware payload (CryptBot)", "value": "4488e2e5a11c0c872a2047ab9429f953aa9f2e209fbd2390f8a4a280e0aaead5", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821716, "uuid": "58fcfd0a-f450-4bc1-b42d-b69b7c1c6d43", "comment": "Malware payload (CryptBot)", "value": "6a36b3c99d617fd4aea15911aa1daeb90f69e2cc", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821716, "uuid": "16ddd7c1-5b75-4f88-8ece-919ab8a89ef6", "comment": "Malware payload (CryptBot)", "value": "7f31cdda9d795715e3c348aea56d64fba2c2570ed99d4883ae2d4b3ea62b103ba08f6c6892a6796dab6e0a013d1746dd", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821716, "uuid": "2caf900e-3d8f-479c-943b-4746d6733c1a", "value": "T12976235B51A92169E1D9CE3CC537FCF872FA1A67C9C0C878B5DA2EC63A625B1C113C09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821716, "uuid": "ff8dba0b-7479-4338-bb47-66212420e980", "value": "23f0801e7cb1cc48960e044af057087e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821716, "uuid": "afc96593-d8a2-4ff5-aaa5-b4087d73da6a", "value": "98304:hZsRMHgHTsSuejg72s5uwEgBIZrCIu5XsUElII4hDv9+oYGGBkgYxh:87HYSuejg7B5XarCpHElwv9F4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668821716, "uuid": "a843eb00-7039-476d-82b2-958a94613f60", "value": 7304192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668821716, "uuid": "5509ba50-eeb5-44e3-9007-459cff5a936c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821716, "uuid": "2e609324-ad8f-49a3-ae22-a373036cde5d", "value": "4488e2e5a11c0c872a2047ab9429f953aa9f2e209fbd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658da06d-67da-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1668842322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842322, "uuid": "d31e94e4-aa02-4998-b19f-21482cf64213", "comment": "Malware payload (Formbook)", "value": "ea078d24104981f1d4cbfaf96f7c64ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842322, "uuid": "4ad17c47-3f95-4b85-a386-4d9c1168b0b8", "comment": "Malware payload (Formbook)", "value": "44bfa379d0909c03b402dec91beea39690da79d033823b27a55ec04ff36e1368", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842322, "uuid": "30b82b14-6e51-49a8-9ff1-c478acc6e7df", "comment": "Malware payload (Formbook)", "value": "c48df5f4e377778f8ecca02b3971bdbd01443fff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842322, "uuid": "709f4d6c-5c45-45a0-83a5-4fd40914bfc7", "comment": "Malware payload (Formbook)", "value": "d466b9cde4746385db4e148e3b4b55858d42aa69e310725be4b6d8a6c1f762ce82b7b749e4ffca2b2d68ef76186f8e18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842322, "uuid": "d1709740-d95a-45a7-98c3-36b1c443c95a", "value": "T148055AE968936D2EE5B8727D54F1E890CBB34C724EC1AE2541A83DC26D335D3B0529F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842322, "uuid": "8702aa0b-365f-43da-a023-ba695d48b60c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842322, "uuid": "c14b4ce0-6ce0-49c0-ac91-2ff02c30d180", "value": "24576:9PxzjZnbCkIDnG3ch9YoyrV1Zrp6Aql2fsCA:7jZnbCkIDnrr/y3L6A+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668842322, "uuid": "680efb93-bec6-4b34-826f-1192797a0d8b", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668842322, "uuid": "8b5c8eef-745c-4d7d-b23a-49f25f6ef57b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842322, "uuid": "1beba970-8e54-4460-a6fc-caa213f24a10", "value": "ea078d24104981f1d4cbfaf96f7c64ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdf809d-6839-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668883141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883141, "uuid": "5415ce21-9c4a-4636-8776-4fff9fd88c52", "comment": "Malware payload (Amadey)", "value": "84c49f9de1d3b864c8548f16559fb1b1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883141, "uuid": "98aef210-3860-4973-a05d-33b1fe565cd2", "comment": "Malware payload (Amadey)", "value": "45ec34129540da364345c3dc3c1a246462c8f76930a034fa0a0c19fb4289847e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883141, "uuid": "cc324b22-c337-46ae-a88d-6b1f748961ba", "comment": "Malware payload (Amadey)", "value": "f54e2de5eff90f0f11b277c88f137785a7810087", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883141, "uuid": "70df5c0a-9dfc-4851-8e7a-f7aa4e355fb9", "comment": "Malware payload (Amadey)", "value": "a06cf930d7442e04ef7e0dd60e4cbc25ba3d2dd8ce1d3379a3349277f46710bcc421e5a6c1c5227fbb3d8f900b2f3612", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883141, "uuid": "c6264e72-d760-4bdd-9e7c-4a9308daaacc", "value": "T1AD74CF10FFD0C4A5C4BDC5787A16CBE85A39ACB17925DB1333346A5E3EB03919E62239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883141, "uuid": "d0ddeab9-83f0-4b25-bec6-5a715ec9b1fc", "value": "3a28fc6cbd66b78dccc28e56534d2c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883141, "uuid": "1eccc755-4b4f-4c24-a081-bb5c582258b2", "value": "6144:hOHMLmgp+Grbst6PycQCfmXxWGPPlCrRhVVPE+O1voXc:0HsjfzycFfGNCvDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668883141, "uuid": "aab7bfa6-31f0-4144-889b-c6cfb89ee33f", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668883141, "uuid": "b079e42f-e39f-46ce-8c34-358a289549cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883141, "uuid": "30650b5c-ff8a-4f9b-a90a-2a72ea339479", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e80888-67d1-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668838511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838511, "uuid": "c323b94a-7a73-4b42-b85b-5b88f1185aff", "comment": "Malware payload (Smoke Loader)", "value": "caecd950554a31a4dc20dfec776931c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838511, "uuid": "4cfebabb-cc7f-4253-8160-e7d76b5b2491", "comment": "Malware payload (Smoke Loader)", "value": "46e649d8e3c64221435fc5c0f63459ced355a949a6277778edff0c4b36348f73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838511, "uuid": "ff5080fd-9f54-4b3b-9ab5-e597d711fcc7", "comment": "Malware payload (Smoke Loader)", "value": "814511f5d2c9e22c58c10667ac20267ec4f2e76b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838511, "uuid": "f18f2db7-a856-406b-837c-0667f5dba777", "comment": "Malware payload (Smoke Loader)", "value": "23b567dc39bb6e92b9c943a1b01e0acd373105bbc3df172b0504774d73c00a993958109faa302aa4450ba998bd2eca97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838511, "uuid": "7a55d141-8971-4ed1-9bf9-e098ac174422", "value": "T13774BE107284FD72C5C10171882EEBF56E79AC619F2589C777B8FEAF2E302D066B2615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838511, "uuid": "da473775-75a9-485a-9fe1-6e3c95b8da70", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838511, "uuid": "69f6d361-2e2b-4fcf-a7b4-3e4e69edfd10", "value": "6144:RJ47mhzKNyDaj+fZ733D5Z8EXdyh+3oQ9gOU+fzYBb6:QqEsDacVD5Zdr9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668838511, "uuid": "ffea8dce-e3da-40fd-a6a6-452fa075d26f", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668838511, "uuid": "2da92d8a-8b07-444e-8ce0-76adce83dd95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838511, "uuid": "d6f1f50d-eb0f-4cd6-821b-c312df3e0f2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5eba775-67e6-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668847718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847718, "uuid": "ba11de19-8313-4d34-94bd-af27e0aaf67e", "comment": "Malware payload (RedLineStealer)", "value": "1128f027ec557bdcd5c8267106ddc343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847718, "uuid": "f73612b4-5c87-4e1c-9c38-f4598f90107f", "comment": "Malware payload (RedLineStealer)", "value": "4709fd98726279f1671ff8486d4dbaa7d475972599d50740ca606248d13f904b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847718, "uuid": "93f490be-9ca9-4b22-b672-400d70eb774a", "comment": "Malware payload (RedLineStealer)", "value": "4ba5f6414c8b2d38a890fae176a08e508fa350d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847718, "uuid": "15b4a79d-661c-4f5c-a38f-f7d02a5149b8", "comment": "Malware payload (RedLineStealer)", "value": "accd0d91d83b749d1156921919f928d07f3540ed3b04c09e23b97ff186f0e241ac0c33288d77749baaa37f627130ea04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847718, "uuid": "39b8fbb0-7c4c-455e-9f3d-1bb01e14a861", "value": "T168348C1374807536F5ECC7F6C89D9E56457FA7E1238022CB1529072946F27FEEAA830A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847718, "uuid": "f5e4510a-387c-4dce-9773-9f2fb85d865e", "value": "19f81fe756f31ae8a7d11110e6e81c7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847718, "uuid": "d134a550-8c3c-483c-8319-123578da30fd", "value": "6144:6dm2X0uHBUewg89TjLctzA1jqb7ZdGv2GkLZmHxYKcTrL:Um2kQKe2TjLctzA1jqb7ZdGvlVmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668847718, "uuid": "7b85cafd-e052-49c3-8537-083f2abe1b79", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668847718, "uuid": "2175b302-46c1-4c31-95a3-42446ccf4e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847718, "uuid": "9b264901-6bc2-4180-9994-17185001068a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6d58a1-67b4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668826116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668826116, "uuid": "96c3f3a4-05e4-4113-8f54-71ce8bd17a43", "comment": "Malware payload", "value": "bda40376ffc34b4f64f3a3b9566b35d8", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668826116, "uuid": "181abe3f-5105-47d8-bb99-16ac8eb32a5f", "comment": "Malware payload", "value": "481078f4ef4fcd7b8d04814c36674485095a529e487a8c51ad47317d19a43380", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668826116, "uuid": "ddaf42bd-c9f0-4a1a-beda-2ebdf104ef72", "comment": "Malware payload", "value": "8bae34da5e12cf3447ea29f692d305f5e10cbc71", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668826116, "uuid": "df4d2ceb-27ad-46da-a910-dafe85f9baed", "comment": "Malware payload", "value": "6d56c8cd14230c3ebfba54b1991c6f25312fe6ada018f13402864b95126d8e3c1c65c9bbcda2f6a530fc1fef0e69d241", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668826116, "uuid": "97350223-1de3-430b-9f11-9dfb53835b9a", "value": "T1FE2733630C0A9DD9C53260755A7E2384A875CB2E3AE267221090DFB7D5F3961CDDEEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668826116, "uuid": "e8dc038d-5501-431c-ab33-28b4b1e616b5", "value": "393216:SwQjLOcsJA35z7A79L+5mJ1mbgafiubcOZHbTT9i/zVN2I+TX7t0KpPbNiRSKcsR:SroJA35z7c51/mbBffc8HZi/zVN2IkrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668826116, "uuid": "ca6f76f2-88da-4d49-9b8d-478893560f68", "value": 21469605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668826116, "uuid": "9475135c-d416-43a3-aad7-d63da21e534b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668826116, "uuid": "0af85bdb-6e4e-4c57-aa13-fc509bc8eeaa", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d5fdd4-6801-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668859237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859237, "uuid": "5806ce15-017e-4cbd-afb2-c120ddb96c4b", "comment": "Malware payload (Mirai)", "value": "351a6f2bf0e500bf0cabdc72058344f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859237, "uuid": "2cc1fae0-1fdf-408a-bf08-532c4d383f1a", "comment": "Malware payload (Mirai)", "value": "48aa37ee2dbedc8d2335f8a263f17c0c4538dd818a45b38e7103ccd265e30634", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859237, "uuid": "821394fd-79a7-4945-b1b8-0864169c3053", "comment": "Malware payload (Mirai)", "value": "58716cbaa3ca4ca1f3d40781dff112a1087d7e4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859237, "uuid": "822bee90-800e-4d28-8cf0-baa215bf59a9", "comment": "Malware payload (Mirai)", "value": "89045a16b2fc55c44ef8be2c9827a9a1d496b7062c03738f232940ecdaf24f1c5e68142a16fa425d03af635b652136c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859237, "uuid": "10fb5b13-1e34-40b2-8396-e3463fde7092", "value": "T1FF73AE75D069DEA8D2550278BA98CC398B22818093A33DF7E7D18AE2545BEDCF404FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859237, "uuid": "b33bb3d9-07b0-472e-91d1-8ed874927d20", "value": "1536:bEXmSsmowLwtSzq4okwsjYBuZRpfs39MFyNI8k+ArPCa/tga:b4my5LDqoYBuNf+e828k+ArPr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859237, "uuid": "f8285057-5855-40dd-b30e-4dfaf3d6f7a3", "value": 79456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859237, "uuid": "8f6e3567-0bdf-45ab-a267-29cee4d189cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859237, "uuid": "06508410-4aa4-4ef9-9c1e-403649460cc9", "value": "351a6f2bf0e500bf0cabdc72058344f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88efe25f-67cc-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1668836368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836368, "uuid": "df892b9a-fd60-4396-a1ce-11e65aaf662c", "comment": "Malware payload (SnakeKeylogger)", "value": "55d8b70fa9232b797fc42f88fb474ca0", "object_relation": "md5", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836368, "uuid": "dedbb5eb-4041-445d-8f7f-02e04d187549", "comment": "Malware payload (SnakeKeylogger)", "value": "48afc744d236eec74dbc8b1cc93500b3d2b4fd2258f95ea85c4ba3627dc0fec0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836368, "uuid": "ef7b09a4-7a3f-4cc1-b6fd-ab5a607cdf8d", "comment": "Malware payload (SnakeKeylogger)", "value": "781b09232ca3611f728b816e12afd52ba4523f73", "object_relation": "sha1", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836368, "uuid": "723442e1-af84-4286-9cd3-eff9c0471246", "comment": "Malware payload (SnakeKeylogger)", "value": "39cb59176be27306f81265b3568bbc5d27ad30b1052fe26dd1ffb9591b2d4c4ad9f0fa1355c5e12bef8d937efcdb831d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836368, "uuid": "d56a08aa-5a76-49bd-af4c-ed6772486dc7", "value": "T1C6B2F85BF7AA03788B9211A1661E1FC9EB3DF13D636094913C6CA33433A5C6647366F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836368, "uuid": "598e05ea-3347-4b41-85af-34a8fc70e286", "value": "768:vFx0XaIsnPRIa4fwJMHQ6Sv4p9AKXwi+l:vf0Xvx3EMGK9AKXwfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668836368, "uuid": "90fd2126-ed1b-4d06-a1c5-14bc23271022", "value": 25433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668836368, "uuid": "1fac958f-fed4-43ae-a272-8f9336702965", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836368, "uuid": "f04f062e-a840-48c2-a5c7-c28695fe6b10", "value": "(A01E2B) 0000RP-C-G0-G000-PE-SPC-0001-B07.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60f8c19-67cc-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668836551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836551, "uuid": "918055e9-f9e8-489d-8858-4fe0f2d32a36", "comment": "Malware payload (Mirai)", "value": "eff53c4e528ab3bf7966b645ba152d17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836551, "uuid": "0a32df3f-728a-4167-8432-19a54c453aa7", "comment": "Malware payload (Mirai)", "value": "48ceda56a49152a4567cdbd5a83f91cc6a7464980bac44b49cc6d5dc579fb99f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836551, "uuid": "346ad8f5-b779-4c0b-9868-99db1602b2fb", "comment": "Malware payload (Mirai)", "value": "bc87e3549756c33b7dee79e19766c057bab302d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836551, "uuid": "62d1261a-60f1-4798-adfc-22709f1f6330", "comment": "Malware payload (Mirai)", "value": "a4b45e4e0ddf22a7b3de5f13921d80a4bf421b71169621aaf4f39f724b00a21e8aecb89d029e301a733d4a2ec37c6bff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836551, "uuid": "1d3b03eb-577c-4c11-9093-11b144893b77", "value": "T16D432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836551, "uuid": "6222c84a-6474-4b4a-ac8a-f74b67012a4f", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw7:RqtmZPuutfbltZFBSJsBcfDSTFI+BE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668836551, "uuid": "4b8d06af-55f2-42f8-844f-a345aef305f0", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668836551, "uuid": "2f09424f-e168-48ad-8b59-86babdfbf67f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836551, "uuid": "a4da4ed2-71ff-471e-9ffd-cc76834a4a32", "value": "eff53c4e528ab3bf7966b645ba152d17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75796790-67ea-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668849220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849220, "uuid": "b9b1deed-761d-4178-ab19-9c65e9d9fa4b", "comment": "Malware payload (Smoke Loader)", "value": "1f9bfe8b6987fc91efdb25d4f8a7309d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849220, "uuid": "b3fe269d-9b24-4ac6-8344-5c6a5425502d", "comment": "Malware payload (Smoke Loader)", "value": "49a9687692b60bcce34a98216f4a6d2db164c873681173d8de8fe9eae34e5cbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849220, "uuid": "5fda759c-ccaf-44e4-91f4-d31cd5b2a0c7", "comment": "Malware payload (Smoke Loader)", "value": "2b001546f8628fff094e74cf175ae8109c8843e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849220, "uuid": "542643e5-9d37-4952-bebe-706c3465e82b", "comment": "Malware payload (Smoke Loader)", "value": "c86d8bc49c3760978e40a97fe5b098dbbe1ad1f7c3f5cb240d72049145484289d58218f770619c6b040c54a75d90cd7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849220, "uuid": "ce755718-4207-4bd2-8718-15ddac97d7df", "value": "T19774CF34B2B0C4B1E1614674C825CBE05AB9EC227524D6433728FF7F6E30A9DA67E275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849220, "uuid": "8175129d-0b9c-41c3-83ec-1f37cf6a0ac0", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849220, "uuid": "345a63e7-ad2f-4861-b54c-84d170edbad1", "value": "6144:KkKnAOzZkRNmTo7BezjzJsfVPjpPnFwCLLObfwB:ynAiyNv7GUFxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668849220, "uuid": "f88c5497-3aa8-4edd-a97d-2bfa7c3c8cb9", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668849220, "uuid": "df3cc55f-d8e4-4ec4-ab99-a4043dd06a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849220, "uuid": "a5b17389-b549-41c7-a389-a0f8bd4c1fd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ed8bab-67ed-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668850513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850513, "uuid": "afecc2fd-ceb1-4028-971b-8a044fc589a0", "comment": "Malware payload (RedLineStealer)", "value": "ffb4cf34b38f126c917e1c1e1d26df73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850513, "uuid": "5f73e10f-f344-4504-9b27-52a5391d7df2", "comment": "Malware payload (RedLineStealer)", "value": "4a47fdbb09dd09ea813c0475d32f693cbbded09b3753def43179f91e1a8f8a55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850513, "uuid": "7ee0e600-8453-4d59-9cc4-3dfc47ad529b", "comment": "Malware payload (RedLineStealer)", "value": "36e558fdb10418aa971aea3f02d6ba1f4d566ed2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850513, "uuid": "ce6cba12-82d3-486a-80ae-cf032d046ec7", "comment": "Malware payload (RedLineStealer)", "value": "1d7dcc559f50fd27742244485554279bde8853d3ea7755142fe391f1886f343cf8a097389a7fa1c3d4165e4a5bddbe0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850513, "uuid": "c8c719f0-be51-4ff7-af85-6ebba396352b", "value": "T13974CF3472B0D4B2F575C670C429CAA5AABCEC213524C9033316FBBF6E30A9D566E275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850513, "uuid": "55ae7b96-6a1b-4054-b5c0-666563bbeef5", "value": "938ae2aaaa8ec1fc2d05063ef7a2e3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850513, "uuid": "0f74937c-cf71-48a0-b736-21c9f4c48cd8", "value": "6144:mzE3TFjX0rs2VfUQbgjpPnFwCLLObfwB:jFGNmxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668850513, "uuid": "7595d645-ada5-403a-9917-6a739f6588af", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668850513, "uuid": "ee5ec9af-a3f3-45d1-9f93-b8c78905b473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850513, "uuid": "f745aa9c-0081-4e44-8bd8-969e0b6e8f0a", "value": "ffb4cf34b38f126c917e1c1e1d26df73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ef1e4d-679d-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668816123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816123, "uuid": "04c6512b-0b89-4a71-add6-eb90d06da227", "comment": "Malware payload (RedLineStealer)", "value": "364a5cdc1d0ff73ea488d3b9875ceb36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816123, "uuid": "aca07770-19ff-4ce7-8f28-40a7a6a117a0", "comment": "Malware payload (RedLineStealer)", "value": "4aa2fb304cd3142f4332e1df78fb05c9fcfc9cf4c45a4b4313e1ab3d8c196cf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816123, "uuid": "d7707430-8302-4a96-9f74-192ff0cd0c2a", "comment": "Malware payload (RedLineStealer)", "value": "db29133ee717e4ed17d9c0e7b06b06df195b3c49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816123, "uuid": "ea666523-4eda-4386-8532-a89f7fb30b0e", "comment": "Malware payload (RedLineStealer)", "value": "748ae98337c37bccbd2dd4d0d33154305a5580f0c5670685c5a4caa79d724f4d6b3d6af3bc8004d3aa7fcb8eea80b6e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816123, "uuid": "38ee7f1e-7acc-433b-bb79-b42d9d95b98f", "value": "T18BA4E0117644F972CAC14170886EF7F6AD79ACA12F6586C736B8EF9F2D302D125B2306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816123, "uuid": "ae89f552-2bab-476a-8779-85a86cac41a1", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816123, "uuid": "452f0917-f87a-484e-83b3-246c79b9caab", "value": "6144:3TgwQnzgZdLcqjwVMKpVIXOFyBdL6z/Cg/WCxojTh+3oQ9gOU+fzYBb6:0wQMvcFbVIOK1guCZ9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668816123, "uuid": "c01cfbd1-6e91-4958-a285-92721742c7d8", "value": 492992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668816123, "uuid": "c4929a78-3712-4410-921b-f89fa343ec9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816123, "uuid": "3e48db84-2341-42cf-af79-d08d0feabdc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45169fde-67bd-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668829812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829812, "uuid": "23a1d4e4-b602-4ecc-85bb-368e7987354b", "comment": "Malware payload (Amadey)", "value": "9e6e6f7c2683bbce65570e600df6a7bb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829812, "uuid": "a219272d-8421-47c6-96a3-dcfeed6a9ee0", "comment": "Malware payload (Amadey)", "value": "4bdfe505e72b4bb6b082967fab23e3e1cf282189c5b5c98f9b096d8a525535c9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829812, "uuid": "8241048f-4b5f-4f9d-811c-739bf8694dee", "comment": "Malware payload (Amadey)", "value": "dbb3694b114c0c2edd8455529e71efd97c002e18", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829812, "uuid": "b26ffed7-6066-49b8-b1e0-a80965d67343", "comment": "Malware payload (Amadey)", "value": "f0d25e0ad02abf9df90eb150b6dba079d58537085a28c4c113fe3c68bf3b111c73e5ba3ffe78e8a57c921f5c5268dbcd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829812, "uuid": "d32f34ff-9253-464a-bc69-d7296c92653a", "value": "T10374AE107285FA72C5C20D71882DEBF5AE69EC515F2689C733B4FE6F2E301D0A6B2255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829812, "uuid": "c6e36dcb-6c71-45c3-a5d7-25bf91f0142d", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829812, "uuid": "72121f78-326d-4282-90df-88912ec0a72b", "value": "6144:21IUF1z+RxP9aWU/WKlH29hffn3h+3oQ9gOU+fzYBb6:bE0BaWmjWPfnY9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668829812, "uuid": "d57122a2-3cf6-452b-91eb-f502c5634c65", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668829812, "uuid": "69c1de9f-0576-49ef-8683-5a148841ec38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829812, "uuid": "98161677-6eab-49cf-bfcb-96c51957836f", "value": "9e6e6f7c2683bbce65570e600df6a7bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9491b3ac-6847-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668889216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889216, "uuid": "b51a4864-f7c7-4ecf-a0dd-118c0f15e7c5", "comment": "Malware payload", "value": "d07ce44407b347ecdb3d0605aa44337c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889216, "uuid": "571631cf-5da6-4c93-9faa-0f7dbf24da41", "comment": "Malware payload", "value": "4d19326befe1e850f257a698e144fcdf8f427745fd241e92f26a51da2cb28aad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889216, "uuid": "8154d77d-8825-4260-93a8-0e8afc189224", "comment": "Malware payload", "value": "14b41fbcd699a73857b379ed060b9065248851b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889216, "uuid": "19c95393-71c4-4c26-9400-cd46cb817c27", "comment": "Malware payload", "value": "8af6d0b4fd15146da4b5bc753ee6e3ee753309dc17e225dad416fcaba08a04e7a5d0c10cec8ef5238a8c0498bd9c2be1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889216, "uuid": "c7520a13-451d-42f0-b939-3fe0c994c32c", "value": "T14D74DF10FFD0C4A6C57DC530BA26C7D82639ACB17921D90337747B6E2EF22919E66236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889216, "uuid": "c97fd086-d475-4c56-b6c0-84e0bedc8f31", "value": "3a28fc6cbd66b78dccc28e56534d2c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889216, "uuid": "df0c2b2e-38f1-4c20-856c-4a9c7ddf32b5", "value": "6144:/TFt3PZG9KPTkfNd4WwZmyIhVVPE+O1voXc:bFthGQ7aNkSDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668889216, "uuid": "e737cf46-7c92-4973-9a19-91359904696c", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668889216, "uuid": "63834f66-f0ab-4dea-9659-7b4968272c08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889216, "uuid": "5d7802cb-0824-43dd-ad8c-0c1f7f8c4170", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ad636d-67f7-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668854749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854749, "uuid": "da532ecc-90e6-462b-958a-3fb3c46f08c0", "comment": "Malware payload (GCleaner)", "value": "5ef730785e4c0922afa81e16f5fadf0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854749, "uuid": "665c8295-8c6f-428b-bdb4-55753857e82e", "comment": "Malware payload (GCleaner)", "value": "4d66dfc7c345cd1ff2f36e4afc5c7137ac3536473d87311b731457752b6341d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854749, "uuid": "cfbffccd-baff-479a-aa12-15f61177fa54", "comment": "Malware payload (GCleaner)", "value": "721a2381c8e63465cb36a81fe2b5842e91fc96be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854749, "uuid": "dc2b7a62-9313-4b39-b53b-eb2ce6503abe", "comment": "Malware payload (GCleaner)", "value": "d0a04fe6d25508fd35bb5637aa48353d837a7b2f9c5cb4abd833ca880d4f40715f71024348fb24cd1b05bd3f6240bc01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854749, "uuid": "ab5fed5d-9bc5-45dc-be5b-23289eabf2ce", "value": "T12EB5FF516A42C2A1C92F1EF8E56178F84DBA3D62E86E823BF3927C0DFE7D7539409501", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854749, "uuid": "9298eed6-7e58-405e-a804-daebf2730f9a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854749, "uuid": "b3697cbd-8ca6-4ff9-b57e-301e2c2cb625", "value": "49152:q2wpa3dAyNi5g1xadY3v+BQGbme2w9sT6QoWglvytGrzyrmUxVkBaFwnm:rw+g5g/WB0gs2lWgTvySUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668854749, "uuid": "3cfc7d3c-fc71-49bc-b936-fe41c95cc5ec", "value": 2487464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668854749, "uuid": "fec9daf8-0bb9-4131-88c2-44f6bb32c4f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854749, "uuid": "e444af42-360d-404b-b294-da8dae7e2a78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bbf42b-6832-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668880205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880205, "uuid": "48a3da32-9770-469d-b0f0-0b13589ec5b2", "comment": "Malware payload", "value": "e03daa863f32b649313140d7356f79ab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880205, "uuid": "d1d11461-fc36-45b4-a9ea-bfead2cc9fa3", "comment": "Malware payload", "value": "4e65728a69215ed165852d5202e7d21b27ddf95402a7523bbd7596f0d6291b25", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880205, "uuid": "af1a2be7-4207-45dd-8b62-749bcd661770", "comment": "Malware payload", "value": "511829b378d44575e4c9ad40f055abfa8f52beb1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880205, "uuid": "f0994f27-e68e-47ed-a1bd-2fd24867282c", "comment": "Malware payload", "value": "01d78af035bafaecfd6ac0d1a18c5b73ac378ece7c025b9baa43ada0ee4ca6bea84c8907bcf9cf61b81cb8051010125c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880205, "uuid": "73b7e3bd-8cfa-42af-a63e-73509e4c1474", "value": "T1E2E24AC6A412EDB2F92A51F1952FEB60BA77F0373019D40BF34A0A38E861994D78735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880205, "uuid": "356ab3f4-4dfb-45b7-99ed-f0a9570dd19a", "value": "768:W07Vd+YlUDE/6juhsDGfowA4CV6y+RtVA+8+kf7raf42vY04911iUxRBb:W07Gv26gZhA3shA+a7rafe04911PxRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668880205, "uuid": "f053a5a9-5b54-4761-943f-cdc098bd967e", "value": 34004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668880205, "uuid": "6c7f9d0c-8699-44e9-a24c-10dff53ab984", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880205, "uuid": "6852d35c-805e-4c6b-bd41-e3fef8b58ef7", "value": "fbot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15282202-67f3-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668852924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668852924, "uuid": "d06aa37a-0a83-4135-b9ed-999e9087c4d5", "comment": "Malware payload (Amadey)", "value": "57d2138aa70427c9e0e31451e588b8e6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668852924, "uuid": "e1fe5ea7-17b8-420c-bbf5-99b33853c0d0", "comment": "Malware payload (Amadey)", "value": "4f253a83f616f88f5c21831563e6f74f933c29fafa81e109c71ef685977e576d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668852924, "uuid": "14746385-e139-46ec-b498-381f39caaf14", "comment": "Malware payload (Amadey)", "value": "c84ae17e9a4782be6854dbd774a896b54aca76d1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668852924, "uuid": "4bdabc3b-56b9-4b8e-8d04-8f579dacf2f0", "comment": "Malware payload (Amadey)", "value": "19eb70cc27de8ec8491087922515145a8ca2cdcd5dca15a851d3a46a06a8b528ef6d3be357d2259947a690b886997200", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668852924, "uuid": "d756b834-a4c5-428a-984a-2bddee1d0e2f", "value": "T1D384D0F476B0D4B2E2610670C425CBE056B9F8187A14D6233315FB7F6E30A9C6A6E277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668852924, "uuid": "770a63a4-68b9-44a1-a685-fad0cdb57fc2", "value": "045163335c785d665aeb43938f4d94be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668852924, "uuid": "b02a68ec-831d-4f56-9fdb-6fbd5838f906", "value": "6144:lHWRuW3grky3NAQAFL7ZlnOFjpPnFwCLLObfwB:0R5s6Rd7rnOFxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668852924, "uuid": "acda31fd-a638-4a14-bd49-72bba20f047d", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668852924, "uuid": "9fd4179c-0f87-46f8-a082-7db59600447d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668852924, "uuid": "aa760d0d-3b33-4322-87fb-1dec30dc3878", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdbe5fcd-67d3-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668839490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668839490, "uuid": "b1db3d91-e2b8-4a51-bbc9-6968028cacd2", "comment": "Malware payload (GCleaner)", "value": "0768dc4ca94ff53c207650ef2c0a38e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668839490, "uuid": "53a5f789-5600-4d34-b510-fd7397f23a11", "comment": "Malware payload (GCleaner)", "value": "4f5621dc9f166d59843cbf2e0922ba018d49bccb9a702f2f634a62267441b0cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668839490, "uuid": "63a4770a-b7ee-4d83-be35-a5418eb1f8f3", "comment": "Malware payload (GCleaner)", "value": "7da40b5e408c9919de5f1a1c774a5237b223ead6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668839490, "uuid": "945f2115-7ce7-43c1-a92d-d2dd76c1a562", "comment": "Malware payload (GCleaner)", "value": "0d721850d0f8833c94876a320a1285703fb343c3ca6ba0e235e6bb229db9580bdb137b3ee1d46b147ea6fdecf2f16ab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668839490, "uuid": "92c9bfd5-031e-4903-9665-18efe35c8968", "value": "T154C5F0516A86D292C82F2DF4EA5434F84DB63E62E86EC27BB3967C1DFE7C3579019400", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668839490, "uuid": "c0bff2eb-52be-4c92-91e0-647266f38641", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668839490, "uuid": "9a5c51bf-0b3f-4ed4-a2cf-9c83491422e8", "value": "49152:q2UDlGru1VFUBdc81AYkEPgJUvqZL5wgSoTuJmr4yQccxUxVkBaFwnm:rUDc61VFUBkyYJ75SgLKJmtYxUxVkB0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668839490, "uuid": "c7260a7d-5408-4ea5-b468-da2c12d8e4c8", "value": 2530219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668839490, "uuid": "980c3ac7-c4e5-4194-a994-7f7ea2c6fdb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668839490, "uuid": "712e5d3e-ba09-4fed-b0d3-db2893b7b96e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d70dcc9-6806-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668861287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861287, "uuid": "c8fe521a-5a1e-44e5-b065-e5a1b67a11d1", "comment": "Malware payload (Mirai)", "value": "23691cefad49126640b271d0e9f3f9d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861287, "uuid": "013232a1-4e0c-4f16-b42b-240d8088529e", "comment": "Malware payload (Mirai)", "value": "4fdadf068208762158b1485b1c7a2aba2a35b8789ca9c8b85fcdc1014ec1ae46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861287, "uuid": "b232449b-1d62-480d-8005-29b91d64b823", "comment": "Malware payload (Mirai)", "value": "44b7b4415b365fb601d254fae0a35d881c45e6e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861287, "uuid": "d3434a04-5817-4b48-9e9f-332249a435cf", "comment": "Malware payload (Mirai)", "value": "75acb111521ada1463ef260091cd2085a53dbd8fb0634e9f83f1b6cceee787d6524d1b83f7eac4739d75b00e4ab5664e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861287, "uuid": "d1735905-3071-4c78-b092-679387896bd3", "value": "T1D1D2E12CD95D7905CA9D3DF951DE96B6394C70C0A36DE68E17228444BB27B8BFC070B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861287, "uuid": "5e7b7b7d-fe5e-4110-a86c-f81055c75f26", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNYFJbiWUq:1bDs06t4BEub4sU/MbUYFmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668861287, "uuid": "9a209987-2d39-4232-b35a-88fbff03a9f9", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668861287, "uuid": "4a453e22-0b21-426e-bd02-6627e2bdb77f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861287, "uuid": "79c33636-cb75-4e50-a163-e23aa45ec620", "value": "23691cefad49126640b271d0e9f3f9d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db04b8b3-6857-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668896206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896206, "uuid": "404854de-ce8e-407f-aafe-60dc4a5d80dc", "comment": "Malware payload", "value": "7f57fcf6e71476de767cffe78083cf5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896206, "uuid": "478f3ba1-936e-48e2-a796-b8ecfb877cdd", "comment": "Malware payload", "value": "500fa34575f679e602c07afd644635d714c80a298f9b976f99023b5ad67bc830", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896206, "uuid": "cc9deedf-7cae-4130-a07b-8f0c691c18f9", "comment": "Malware payload", "value": "8f9a9a4843f4f4b8bf6bb8f3364c7db988a1f769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896206, "uuid": "8cf2540c-7c7c-401d-8066-11daf1784cd0", "comment": "Malware payload", "value": "74b1031cc034cc6ad57ae889e01173d3c7fc3d6d10eef49f2a0ca05be84fba9321ab8ebc21c7834702fa837332656aab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896206, "uuid": "e614a576-08e6-4938-98c2-abbaf60636c2", "value": "T1ED7633713BE1E97CDF73A4B2AEE92AE669C4D2610A27418327A98D3C0C37545D527F0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896206, "uuid": "c13c3c8f-2ab6-4963-9145-17f67e2b733e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896206, "uuid": "a46b0030-c9b8-408a-8bf1-46c829ec0793", "value": "196608:91ODPRsHeyA5OvsoJ/Vvc2JOst869TVBzcXhfhtwgM3HN0b:3ODZyenkvJcr69HcMCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668896206, "uuid": "45203630-b2ec-4e67-a0c5-391123ee38f5", "value": 7625265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668896206, "uuid": "27c86ef3-547f-401f-b309-39f20b4b1146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896206, "uuid": "bc02cf68-1ab6-47d3-a62b-e4d9c85df9df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2accc924-67f3-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668852961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668852961, "uuid": "263a10ad-86ec-4ed5-b4ad-44d295aa6919", "comment": "Malware payload (GCleaner)", "value": "90c6b74394305d262ac4d619266e7cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668852961, "uuid": "c6fdaa12-c402-445b-b9d2-23cc93b5d994", "comment": "Malware payload (GCleaner)", "value": "5090b40979e2f9ba91a285084a0cdb3636bf1b330bbc85a66829792d99c48480", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668852961, "uuid": "3b396c35-5408-4291-9ff7-0aac9e5e89a6", "comment": "Malware payload (GCleaner)", "value": "07b289c02ec9ca14f2f78f698027b9dbb8252396", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668852961, "uuid": "96ec0b3c-4566-4752-aa78-a4fcdbad8e15", "comment": "Malware payload (GCleaner)", "value": "8f100002cbb597a6c89697c67d2938cb07dfa914fd01d9e7d6b50218784a28b9f5a9eaee58fa079d563d35f28f45eab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668852961, "uuid": "bff70486-a4ca-48b5-b2b7-7c10a61273bc", "value": "T109C5F0516A56D295C82F6DF1E22135F849BA3DA2E82EC23BF7827C4EFE7D3538019501", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668852961, "uuid": "2c5431b2-dc65-4b42-855e-96027504eb4a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668852961, "uuid": "1e721953-6c2d-4181-baf5-1ef76b2eb236", "value": "49152:q2aiYCPDX2FNXTk6mEU65DrS4vS1uU9UxVkBaFwnm:raoX6wc1oHUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668852961, "uuid": "42afb3df-d1b9-4afb-944f-47a7e05522f5", "value": 2534463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668852961, "uuid": "fcc8ecad-f0dd-449d-b2fb-c314d0eac235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668852961, "uuid": "a7a5dbfd-21f1-41bf-bbcc-b0b429474456", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1674e3ca-685c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668898024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898024, "uuid": "c0bbfcd1-e894-4871-bf48-c07caf44eaeb", "comment": "Malware payload", "value": "5808658f866187199bff339307f5a012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898024, "uuid": "a5cb3cd5-89c7-4f5f-acc8-d6ae8a7d57c4", "comment": "Malware payload", "value": "51b286a20419bfa9d0a3ecec2557987d937600326536b5d9321f93d4f79e5919", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898024, "uuid": "6e937c15-6cac-48ca-a223-a2803c08066e", "comment": "Malware payload", "value": "6cc5e074af035f5aadad1296d249c060ff228d82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898024, "uuid": "464957ff-1d28-4d49-a23d-1df2c82ddf56", "comment": "Malware payload", "value": "064a08568329dc61efd96d59753c15d5f6063d186febc3b44a0f5c7a61e74c7760885f8e34f118ed9fa57e879e33e6a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898024, "uuid": "b146bb20-0cc1-4fa3-ad9b-a40fab8f601c", "value": "T175C5F0252A56C291C82F2DF0EA5175F84CB63DA2E82E827BF7867C1DFE3C3579009950", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898024, "uuid": "a080e3c6-dae6-4f11-baef-e79d7ea1ac80", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898024, "uuid": "9d607466-ccb1-4609-bba1-08b5ef647265", "value": "49152:q25sV6BCD+DtOsiIkaeY6vqYamOkdIl3tRSgUxVkBaFwnm:r5+6BC6Dtjtpep6kdw9RSgUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668898024, "uuid": "7dafbb9b-439b-4067-9f9f-ff1a69b34ce2", "value": 2523460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668898024, "uuid": "a26ca568-dbec-4490-b1eb-5d875ce794b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898024, "uuid": "41c0a16a-ff1c-4b94-973b-c12557bdcecf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481dbf60-6829-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668876203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876203, "uuid": "fa9236a7-d983-4366-a8ca-a2c819ff7bab", "comment": "Malware payload (Mirai)", "value": "b8352a2d9897e874900c0a4060d114f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876203, "uuid": "32bef8a0-2ec2-456f-9b71-c12975d14933", "comment": "Malware payload (Mirai)", "value": "51bffecd601e47d7f4b0387c48b6a15ed57b98d1da4813a02bccea04477caa0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876203, "uuid": "0f1bc3a4-35d6-42b4-9794-25d595fd3119", "comment": "Malware payload (Mirai)", "value": "dcd24b761ef83ef01a8ef13984ccadf418b0cb01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876203, "uuid": "46f26dff-77ab-40a4-9724-1a6cf68ba6aa", "comment": "Malware payload (Mirai)", "value": "fdf99d04de6c0036fae0132175e01c3ca0afc068b9c82cf175dd4721f0df261ea385e4ee57b13b3816a088e383d3af68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876203, "uuid": "9dc22edc-057b-4d62-a5dd-1e1997de8053", "value": "T1DBE2E1E088C1A8EBC571EC75732AC0526E3A56EC85AC941F66E218101EB784F7DBE1C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876203, "uuid": "6ec82791-65ce-43a8-b434-77437d9477b3", "value": "768:cVbRw4vh1uDACuEuzQhqXHXxkvHIt7o3/9V1Ze+gv9q3UELEG:aLv8EE8XHXmso3JZeVeL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668876203, "uuid": "5b9d7d72-f81c-46b5-b767-308aa9b52b4d", "value": 33012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668876203, "uuid": "d85da6a8-7abb-4036-9cbd-12c9ea990d20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876203, "uuid": "1473ee2b-5dd6-438d-8ecb-7b90b05bb922", "value": "b8352a2d9897e874900c0a4060d114f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9026899c-67a3-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668818771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818771, "uuid": "fa15b8c0-59fe-40aa-8328-707b1e398436", "comment": "Malware payload (Smoke Loader)", "value": "7a91ce62f0700e44607ec45c06998693", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818771, "uuid": "3760aef7-2c63-4ee3-a4fa-ccefe7ed91a6", "comment": "Malware payload (Smoke Loader)", "value": "52c4c6bf00624fb6fe82652a600429833c0c4d434c9f6d36e84d7aa1b0df22a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818771, "uuid": "95f7c684-b434-435e-9c10-29da9d4f8cfe", "comment": "Malware payload (Smoke Loader)", "value": "99c5a1df1ca9cb2cb13d4de823e7d407b6337c6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818771, "uuid": "9e3bf72e-b823-485d-877f-57e0d2dc03f0", "comment": "Malware payload (Smoke Loader)", "value": "13032d2b3a539ce1fd8bc7aa7b18127a94d91d6601e1e7e86942b48f038302f899754e147a13401cc76d7ff27df71a76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818771, "uuid": "427fcbb5-5ae4-428b-a091-94df7cdc3685", "value": "T1AD74BE107680FE72D5C38531883DABF6AD79AC505F2585CF72B8EE5F2E302D0A6B2255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818771, "uuid": "7cd08b26-3141-4427-9974-863370a36bd0", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818771, "uuid": "3729fd27-6fb1-4df4-89db-53dec7aec858", "value": "6144:0eAU3zKzNooGUBwddZLaA90M99h+3oQ9gOU+fzYBb6:L3zqwUBw9LJ9Pk9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668818771, "uuid": "a63d339c-4180-4585-8e74-71de2933d53d", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668818771, "uuid": "c6adf983-6c7b-47a5-a0a1-7533c37c0089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818771, "uuid": "f23f4407-ea62-4b00-a646-eb30247834a5", "value": "7a91ce62f0700e44607ec45c06998693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11321c3e-681b-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668870098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668870098, "uuid": "26402696-de1b-46b3-9942-a40f2f8d4644", "comment": "Malware payload (GCleaner)", "value": "037574e833fab38c9c897045d86cb09c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668870098, "uuid": "6e5dd91d-6e6c-4fc9-b068-65abeb4cc686", "comment": "Malware payload (GCleaner)", "value": "52dff6758f3077ebc0c7f0e311fedaad23709fbd25c6197a2e862ba517be614d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668870098, "uuid": "1f1e4b27-0760-483a-a6d3-d44e5107816c", "comment": "Malware payload (GCleaner)", "value": "ad38787cf167da6f40f6a114d2f502273bce7d07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668870098, "uuid": "7b83bacf-b7ca-43d3-9db9-fb8b6ac05e8e", "comment": "Malware payload (GCleaner)", "value": "922257a7039c0d7958ff7f584173598b42225244f023c647f232345ab435df5a89da92b58e55a0b6b591a49b05ad2e57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668870098, "uuid": "62dab0ac-194d-40a9-8d1c-bd9bc9a8ab32", "value": "T135B5E0516A56D295C82F5DF4E65430F84DB63DA2E82E823BF3963C0EFE7D3A7801A411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668870098, "uuid": "6203f00e-86d4-406d-bc63-255fe2d11f4b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668870098, "uuid": "2b9167fa-2406-4dc3-9906-b3eadcd48fdb", "value": "49152:q2mQOQlGBy6bNTRX4bl4LLzdlv6ZEfZhaGU9tDiOUxVkBaFwnm:rmQzG46bv4sddKEfaXRiOUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668870098, "uuid": "0326d07c-d32d-4b71-9991-d39fa112677d", "value": 2369257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668870098, "uuid": "894ab0fa-9b61-4beb-aba3-544d19e5977d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668870098, "uuid": "ad20b7e6-270c-4131-8f62-8e596721b2d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b86743-6851-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668893647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668893647, "uuid": "2ee47dbf-1560-4390-a9c7-c5e5aea7441b", "comment": "Malware payload", "value": "fc7ab1260b0dd10050dc63d090657f7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668893647, "uuid": "ba1fdf1d-3093-46ec-b7e4-4189713a3bcc", "comment": "Malware payload", "value": "53ea41445cbc8313d4fc5ea63c7bfe101c48e669bdce4c4cfada8c6023c741bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668893647, "uuid": "a8e7aea4-8032-4be6-8917-b63d2a5c13c5", "comment": "Malware payload", "value": "af4f0d5bd35619eb0c7e5dacf23d863f920c34df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668893647, "uuid": "50ab6dcf-fdf7-4de8-9828-cd3afd098d14", "comment": "Malware payload", "value": "26dbd314673e687f6e7f1f593f8230c067939ffcdae06cd8f4a4bc982698aad26593b0d2b3e246e85fdfcaad12b0e348", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668893647, "uuid": "d759e815-a623-4420-8a96-228c5db036be", "value": "T181F33ABA4B1DDF6FE83E2B3E089E720C9D499BAC250FDE4D09C4C454674FA565D0382A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668893647, "uuid": "252b56b6-e287-4004-922b-31d5659fe5a9", "value": "3072:UF6CNf2s6Q3bKmiXAZ2BiJ+EjkbBIkMeT6ots:UIa2XEjObMefa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668893647, "uuid": "e0e61942-c948-4bc7-b9c0-805c754f76dc", "value": 160976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668893647, "uuid": "59ca7b5e-5c13-4d89-b893-ffa297c33f4d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668893647, "uuid": "e12385f0-ae13-47b1-8522-dcdf49fe5064", "value": "SecuriteInfo.com.Andr.HiddAd-ZA.9129.20426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9789ba4-6816-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668868286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868286, "uuid": "6c67840e-1eac-4715-a155-06e23c2298d6", "comment": "Malware payload (Mirai)", "value": "f732ab2994218d3b4488bb48d942daef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868286, "uuid": "dc3854d6-54a5-4bb9-8fa4-2370a470d1f8", "comment": "Malware payload (Mirai)", "value": "53ec223c75ce8950b41436693ccea3edb1cd206593fc3f1de3c0bd5fb18ab9a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868286, "uuid": "3ec8dcb8-3b26-48c6-836f-49e66b15a7ef", "comment": "Malware payload (Mirai)", "value": "7a9378b13a87aa501d240f6adff656802b6df2c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868286, "uuid": "10460b77-83e1-4ac1-b3f3-3694ebb60550", "comment": "Malware payload (Mirai)", "value": "a3098952e7bb61bf34d14ea656a39af9d4bbebbc92c24cc52cc66feb3055a426480ec35688625eaf26c92a4c65acfaf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868286, "uuid": "5dd3bb39-5149-4972-b182-fff5319c5d13", "value": "T1FBE2D0DC9CE865ADCD8F4DFAA3CD11B0EC16A8D061698AC99318CCCDB61429FDD4D8B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868286, "uuid": "586434fd-e7ca-430a-bd90-e53e41c03651", "value": "768:ckj0KEER1vjEq+RTb6NjI3KKwgKkU1oZ3sVMkWy:7j0c1rExRX6EKdkpZ3aMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668868286, "uuid": "32e4e145-3c53-46bb-aff2-3cc475fa3374", "value": 32824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668868286, "uuid": "67b44cb6-6d64-40a1-b050-5d95d1876fc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868286, "uuid": "f5031225-ac3d-4f8a-bd31-92cd663669d5", "value": "SecuriteInfo.com.Linux.Siggen.9999.25037.18823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e357ff9-67bf-11ed-9266-42010a9c0072", "comment": "Malware payload (RustyStealer)", "timestamp": 1668830820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830820, "uuid": "781af31a-3ab5-431a-a4ad-0608e89a7bf1", "comment": "Malware payload (RustyStealer)", "value": "6c80da0486ff66d6ae23739c44252dff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830820, "uuid": "51aaaa3f-dca0-4eb0-b4ff-dad7deb4c633", "comment": "Malware payload (RustyStealer)", "value": "5428cca9ddb62b62c941386fb9eaf9508222b1acf561754483cdd8cf0fbd41e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830820, "uuid": "12cbcfb7-82e1-4e26-9b8a-26da2591a1f8", "comment": "Malware payload (RustyStealer)", "value": "965c9e526c633661b484e04c0ebb3368e1e526a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830820, "uuid": "0509d1bf-346f-455e-b85a-a85bf655245f", "comment": "Malware payload (RustyStealer)", "value": "213a62fae2098a9ad4b42ce692853807333a17fc3a85d0d13c65e5d69d1213c4ef95dca3f896a3edc7981db4a1223b55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830820, "uuid": "8a105bcc-8764-4b6f-be34-ee51192f07c5", "value": "T1E0767D02F39541E9C06EC6748266A233B7B0BC4D4325F7EF9B846A712D62FD09E39356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830820, "uuid": "08da1906-333c-4c1a-a705-8bdebc27589d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830820, "uuid": "d7587646-91b1-4240-a530-0e44efba2c4a", "value": "98304:LF90VGReWW73VnOzBrMZExuAWWTb/HirLcXthOjmH:LFmVfIBrMHAWW/RKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668830820, "uuid": "040db468-12a6-489b-9963-c8c50c886ab8", "value": 7436800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668830820, "uuid": "d3c8b807-cafe-4ca8-b9e6-16058b8f0c23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830820, "uuid": "5c09769b-9db0-4c3f-a21f-8572377d550d", "value": "6c80da0486ff66d6ae23739c44252dff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c696c39a-67c2-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1668832177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668832177, "uuid": "494e44b3-e4db-4342-95e2-5c3bf52e0c75", "comment": "Malware payload (AgentTesla)", "value": "9086933fb695c36c4894adf26d03adbe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668832177, "uuid": "85389f14-e857-49a5-b7e2-d55e6a5ec75e", "comment": "Malware payload (AgentTesla)", "value": "544ccf26cf0038cc8d76b952e349f3e49db27e4d2cdc89ea72fa2fb8e8996038", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668832177, "uuid": "2a755183-4543-4024-8d44-5729d06229a4", "comment": "Malware payload (AgentTesla)", "value": "f3c692ac88342c6439c6391a880216b014d15ed4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668832177, "uuid": "b052551e-fc2b-4564-ab30-a4c91501853c", "comment": "Malware payload (AgentTesla)", "value": "be5579402ca01c05cecd11c262b81454fa286786979616da5850fbc021d830e6ba437a41c943a811744abab70bc323b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668832177, "uuid": "a5cb987c-d5f4-4a76-a0c4-d1be1e27ecea", "value": "T17EB401E2456F5454C7D2AC70FD00C674EEA2FB849EA5BC969561CE078F20EFBA244393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668832177, "uuid": "9b6498c3-a5ef-4e37-ad6f-570dd4f3425d", "value": "12288:vLwnhIuK0sP0xxKhRhN7XdpfbUiVjRk+Ms+LaAtjSJ20Jdi:vLsIkXKfhZXvz1++Ms+mhc0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668832177, "uuid": "d24d43d5-697e-4300-879b-d05481f32f8d", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668832177, "uuid": "df56026c-be5a-494e-b2dc-b2ccdd94c7f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668832177, "uuid": "2b46c508-17cb-4467-b630-de4c22d06265", "value": "Amended Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24dc221-6803-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668860114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668860114, "uuid": "bd50f1ec-f064-44d2-abfe-ed74e41efb62", "comment": "Malware payload (Amadey)", "value": "9e9d23998f4f0bf0040e85a96c64f3b7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668860114, "uuid": "a99031a0-d5d7-4366-ad2a-5f27b6092e9e", "comment": "Malware payload (Amadey)", "value": "54f2ac1550e435c7ec48557765d6153f1d7e8e5772a390b2d760994b30f9a47e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668860114, "uuid": "907e3527-d4da-4efb-a794-9d1d870821b4", "comment": "Malware payload (Amadey)", "value": "baf530c7f036d17949ffa7836931004f9fe17dd1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668860114, "uuid": "c032f157-95d7-4a64-b3dc-086aff41ac85", "comment": "Malware payload (Amadey)", "value": "6f2a325bf808338b1989818354074326ced4998f9e304050694df8c705034daef85c0a09fd8da082e0f4764ff412858f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668860114, "uuid": "8d548455-0311-47c6-8978-51f103f0cf4a", "value": "T19184DF3072B0D4FEE1610670C925CAA669B8FC217910D9037715FB7F7E30A8C66AE679", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668860114, "uuid": "8de5daa7-532a-4d8a-a8f4-383006341308", "value": "063e5449636b8762744e9ce9f5564a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668860114, "uuid": "9af373c7-1266-41f2-bb14-c7ee107a2ca2", "value": "6144:CafvFuAPupc870hFvG6WMZ9iBjpPnFwCLLObfwB:bFuAGpN70q6WioxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668860114, "uuid": "975545d6-efce-4a00-91d8-4cfa25c28662", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668860114, "uuid": "ce5b19ab-a58d-4275-8ddc-65482b87868e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668860114, "uuid": "96143006-d766-4960-8172-85075b0e3807", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32db273-681d-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1668871336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668871336, "uuid": "222a5047-4bc3-42d7-8bd7-fd60ecb8f8b5", "comment": "Malware payload (ArkeiStealer)", "value": "ba8f7dbb137ea980ff835ed2f9b4c1ab", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668871336, "uuid": "98309198-3eac-46d5-a3ac-492b9fbec259", "comment": "Malware payload (ArkeiStealer)", "value": "5554f64389cfe61a4be7367444b2837d216d921235458c658b1be6936d0d78a9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668871336, "uuid": "0027fada-bc40-40f1-9bc7-405336683e78", "comment": "Malware payload (ArkeiStealer)", "value": "18548f5ed8ea60d176cdbee2902e777c3f68c0fb", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668871336, "uuid": "6c95027a-37fc-4b5f-a22f-90aca8adffb5", "comment": "Malware payload (ArkeiStealer)", "value": "78599f45327949969e79aaf1ce212f7415a0c1bdd641db315c2a0d067622d4a6c1d98b76a492e7fe7d6dba792db0cd4c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668871336, "uuid": "d39ab0de-79a5-49b6-9aa7-547adfcf6825", "value": "T1B694DF34B2B0D4B2E5714670C429CBAC5AB8EC217915E9033714FB7F6E30A9D666E239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668871336, "uuid": "ebe6b50f-93d5-44db-93fb-54fb941031d5", "value": "063e5449636b8762744e9ce9f5564a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668871336, "uuid": "e49113e0-2ce2-4aed-b09a-1789b6488ec4", "value": "6144:j71UzWPLjfAXL72qjjD3wLvgmLc9CujpPnFwCLLObfwB:VUzjXvjjjDgkS+xqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668871336, "uuid": "7cc99595-93c1-46ec-a3ce-277895003aec", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668871336, "uuid": "8feefe32-2bba-4b50-ba5d-063239425652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668871336, "uuid": "2e2624d9-3b77-4d13-af52-cb2594726d36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044c1599-67ff-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668858050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858050, "uuid": "1ae949e4-2042-409f-a9a3-1549272d52e0", "comment": "Malware payload (Smoke Loader)", "value": "992878a87850b2b07439c8943a06c37f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858050, "uuid": "fabdfe77-e985-47cd-9e91-83c4fd1b5896", "comment": "Malware payload (Smoke Loader)", "value": "559059f7b32d26a0afbc271a57a78133ba270dfc954536a9ff11661b1b0dd921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858050, "uuid": "2e217292-847b-4971-bc91-f0ce39104ecf", "comment": "Malware payload (Smoke Loader)", "value": "2cf57bc6acd75cdfaf097acf2fe25914a20838c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858050, "uuid": "9949e2e7-e7a0-4148-bbfc-3e0284ba5c7b", "comment": "Malware payload (Smoke Loader)", "value": "3e3e08040aff3434e31507d5925748b1367fcb3d6c77ec367557dcc7ba7b634da358747660e8257994a5409fb5ae4110", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858050, "uuid": "fb278103-834c-4924-ba89-f8ae72e2c74d", "value": "T1F474BE7472B0D4FAE5364674C429CAA455B8FC117824DA133318FB7F6E30A8C96EE279", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858050, "uuid": "55e2cc98-b3c4-4276-9434-1247e9827400", "value": "045163335c785d665aeb43938f4d94be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858050, "uuid": "9b02993f-afd8-4321-a2b3-d1d91787b2ce", "value": "3072:a7l59/Zaz4eUec2LamHtpRZqmC3DHeNvWu+RO1wu+Vj35PKeBHFw0tZG2QMisvOm:u5acexLvGDH6+ROS7jpPnFwCLLObfwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858050, "uuid": "dd063946-a80e-4207-9671-2cef8365eee4", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858050, "uuid": "39404462-84a1-4ff2-be8e-c8ba14db653a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858050, "uuid": "ecd70598-6db5-4cd2-b0d0-836d2515be12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d03a66-67cb-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668835725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835725, "uuid": "9237186f-b4e1-4091-bd36-b23651b67f0f", "comment": "Malware payload (Mirai)", "value": "cef4ed98e775c63eb561f05b237c9d5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835725, "uuid": "caa247a4-48f2-445e-8f38-f7cee76d6cad", "comment": "Malware payload (Mirai)", "value": "55fc5f3be218b7514fa1b5d7fd2e266367a55b1c3782ad317f8050ef5e58d15c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835725, "uuid": "7333d190-d708-4584-9976-06cb92081cc3", "comment": "Malware payload (Mirai)", "value": "1da11aeed802fd960ddc6d4ed9a3163599e607e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835725, "uuid": "fa6dc1bd-45d8-41c6-b711-33f90a38ce8f", "comment": "Malware payload (Mirai)", "value": "fc2e70f421dc32f55eed45a3b7e052907d0ba181bee15dfb864cdd611e5782c4c5fd52727d93e5772f94d66a4daccb19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835725, "uuid": "2694e835-ea15-4ba5-a6dd-d1814b4a8ca1", "value": "T1CEA2D01472A32D66E3AD1C3DC96E8357F9A61BFC80F5327679415620C90D24A3E38B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835725, "uuid": "d986e736-186d-4fa1-8e78-6d4872489d61", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjFVwhymdGUop5hd:TvQn4j+ZO5fKAlxbws3Uozf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668835725, "uuid": "be7a60a5-2295-4704-a197-60ac80a3fb49", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668835725, "uuid": "9ad99636-343e-4a64-8dc3-e9a93d36970d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835725, "uuid": "0b925631-c24d-49ee-b801-f007dce76c47", "value": "cef4ed98e775c63eb561f05b237c9d5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c32973a-680c-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668863835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668863835, "uuid": "0ea712ee-eba8-4f8a-9d19-1f2d9700ac82", "comment": "Malware payload (GCleaner)", "value": "bd0ac1a90a6b9dbddbd59793849737f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668863835, "uuid": "a344c022-a862-4376-8fa7-f1c9033c22c2", "comment": "Malware payload (GCleaner)", "value": "562d17781d78e5b7eb98e80a425c0ed78f6d05cdacb9d3f20569a52e3a7e2f19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668863835, "uuid": "94616847-496a-4884-afc3-c75bf28b0fff", "comment": "Malware payload (GCleaner)", "value": "4e9c3af7faf056c8a4568f13ef6887bb85b316b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668863835, "uuid": "2bbfb00b-8e17-4cc9-b01f-072eec4b7f45", "comment": "Malware payload (GCleaner)", "value": "fb0d147e2a1a95f69ff208367748dff47c13111a56f56e0e28505b03554a521abd3d8d2be4fc2d46d1ccf454dae4ec13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668863835, "uuid": "83efc96c-3db0-414f-83e2-d50a86ad6259", "value": "T11EB5F0116A16D2A1C82F1DF4E91474F989B63DA2E82EC23BF7823C5EFEBC3579019550", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668863835, "uuid": "8e21a997-f0ef-4171-9c30-bae8eaba05c5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668863835, "uuid": "f7baaaf7-2711-4471-8751-45a9472eed39", "value": "49152:q2bgf70hWeOnOgebBToK6a0mlxNi/nZGBlSlDj+qneLkJUxVkBaFwnm:rba0hUstToK6Q0/ZYS1jZnykJUxVkB0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668863835, "uuid": "38f62e01-b877-4154-bf7e-d850418f438f", "value": 2326142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668863835, "uuid": "e08cb014-4859-4c7d-b28a-e3ce1a16aa29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668863835, "uuid": "0facac11-95f3-4756-ae43-f1d13762de82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6e3174-679f-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668817213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817213, "uuid": "129f1a53-1ee9-4c87-9fb2-b86cd256ddc8", "comment": "Malware payload (RedLineStealer)", "value": "d7812ba32d4c9d84169ee9703e0c13ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817213, "uuid": "e5f3e400-87f5-473a-a2ac-cbe0b0c46c69", "comment": "Malware payload (RedLineStealer)", "value": "57202ca65b8718fbed9ec980d45e94b2668e3ea40447fcca9125e2e4fa57e7ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817213, "uuid": "2b338446-26c5-4538-a865-93cd35b6a156", "comment": "Malware payload (RedLineStealer)", "value": "1f964c8797dc08fa46fe442acc371adc8b874d38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817213, "uuid": "5fa2e26f-3252-4221-8f0a-b1d80f817250", "comment": "Malware payload (RedLineStealer)", "value": "40fd04c85db37aab2fb3b6c6d2480cd938e9d625ead33ebe68141795833e226da928b739b9120aa6d9d01498df7551be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817213, "uuid": "1b4cb588-6643-4a34-9f1f-c10f28cfcd7b", "value": "T1A134BE03F05841ADE0FAE1FC1492A3D5823F5A7D9BDC008BEA7E4B799B404E1D2766D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817213, "uuid": "1811e25e-b406-4cc5-9bd1-e807508acde0", "value": "19e0e0a97efc31b1e39a2bb2ebdd6fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817213, "uuid": "d96f02d1-d1dc-4dad-94e4-385fe1123984", "value": "6144:f4vRMLazRHIoCkKSdt9zo2+Jx00SK2Wl:ARMOzRoof3dt9zOx00SK2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668817213, "uuid": "7f38e287-5419-44ed-8863-3cbbf19b12be", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668817213, "uuid": "2e339a5e-9ba8-49c4-a4a7-4a95913e0a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817213, "uuid": "97f9a09a-e5ba-496f-8d5a-f533b6314964", "value": "d7812ba32d4c9d84169ee9703e0c13ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f21b0ac-684f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668892508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668892508, "uuid": "cae1a1ab-a034-4003-a30b-7fdbaac9df3d", "comment": "Malware payload", "value": "0760becab754fbc5b1bf77cab4729854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668892508, "uuid": "eb832c6e-ed89-4f34-bfd3-d73239e39ad7", "comment": "Malware payload", "value": "576bc75af75cd9ec908c173a57232a12d745c5cb0e291bbbec447a1ff8e29b06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668892508, "uuid": "e6d36e6a-8acb-4d6f-a154-56da155efd3e", "comment": "Malware payload", "value": "42b15cc4aaead22480029eb1a76d9b323ca0fa41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668892508, "uuid": "5e806ac4-b3b3-4db4-acaf-65986d91d98c", "comment": "Malware payload", "value": "271bc9378acd96c666a4ca1c64720e3be8f9ffd6600db508d2a38425fd10b97ddf5596e296a23915ee127cdddec57c51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668892508, "uuid": "c0627203-dbcd-49ab-abc5-d6ad8e976475", "value": "T1A2C5F0816A86C296C82F2DF4E92575F94DB63D62E82E827BF3927C4DFE7D3578009500", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668892508, "uuid": "6f36e176-aba7-462c-85e7-0d52a3ec4937", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668892508, "uuid": "090ef9f1-c42e-49a1-b53b-2be3df233798", "value": "49152:q2i/jciGhPFEuINvpoXfrDTKexukHf8RW7SUxVkBaFwnm:rDiGpFEZRpobLr/8W2UxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668892508, "uuid": "b98f2440-ae0b-4cef-a72d-19227c1f163b", "value": 2538074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668892508, "uuid": "50b3ffdd-d2eb-4554-9589-bc67f3febd01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668892508, "uuid": "cbc3e042-ed9e-4bf7-9f00-9e61fd902dfc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3a6e3b-6806-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668861367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861367, "uuid": "7a71d63e-6b7b-43a1-a59c-0c6d667ff494", "comment": "Malware payload", "value": "08b177dd79bb35978f8739b4dd1aa9a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861367, "uuid": "ff452f9f-a2d3-499f-a693-522c869424b2", "comment": "Malware payload", "value": "58710df6bff2f4f3598ee52cb7a3ad3ff3113211c019bb5e5e4919576f6c524e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861367, "uuid": "39cd3fb7-3c61-4e26-90a9-92b81f4bcfac", "comment": "Malware payload", "value": "fa8037976862f86b1604799b5fe83be70a46a7d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861367, "uuid": "10774a92-3db2-4d01-819d-356b6f9eaf86", "comment": "Malware payload", "value": "df3e03fc3dde656ca88340b84107430ebf96a153acce70d9807a4ab568d2a5fbf3fe25f2978d891d40278cdff5b43794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861367, "uuid": "8c1a685f-3d22-4bbe-b404-6f3c512a0a9c", "value": "T13D76333979E648B5D54C08F5DCA03BAAA3DEDBAC8D300C6B33C612BC9E7E5199935407", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861367, "uuid": "366b6043-1750-4642-a6f1-c0203b2230a1", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861367, "uuid": "b90ab7ba-140e-4102-a083-56f8b2de2f7f", "value": "196608:91O1Dw+kL76I5Dwou2RYIgup94kvuSoiC9V1iMK51nLrWfn0d3:3O10DhwfQYjup94kGSoJ92MinLr20p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668861367, "uuid": "9abafe4b-9299-4079-8d34-7be6ab5a8bb4", "value": 7581806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668861367, "uuid": "94fc0b0c-1ca6-48ce-bf1c-e51114234022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861367, "uuid": "b4397325-6b18-4e2d-a878-8e8160aed66c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b241ab1a-6808-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668862207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862207, "uuid": "d26390e2-9db3-49a3-80d2-43c7a11407bb", "comment": "Malware payload (Mirai)", "value": "520967848bb4e12614dfee20ebf74a78", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862207, "uuid": "29fc0038-d1f7-4391-a901-32e123254e5f", "comment": "Malware payload (Mirai)", "value": "5896e6f9aa755f882cbca8a8a9294630e31247718c887e1c033a09f8e5e60c8c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862207, "uuid": "f5200587-2a61-46d4-b01b-66da2d986a48", "comment": "Malware payload (Mirai)", "value": "d5c260afd9d249f0a5a7bd7e6d35e0e5af72174e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862207, "uuid": "85feec4f-8f10-4f2e-aec4-b9fe78bd6400", "comment": "Malware payload (Mirai)", "value": "34c49ce4eee8b8c4324b6fe312095dcbd085d20b085fa1342ec33f6b8078d35e073b856db5c435bcae64bca1091afbf9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862207, "uuid": "2af31891-d9b3-403c-b806-78e198d5ac9f", "value": "T17D533A84BA83E8F5EC120479203AE7729F33F03A6139EA97D7DD5523AD52A41D60738D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862207, "uuid": "0281b109-2993-476d-8e94-a881c6dd93f3", "value": "1536:JyJix0VgpWrlWQ+SWFMDP7nMIV/wpFRVryamr02+SYs:JyJix0KpWrlN+1FMDP7VlwZVJy02Ys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668862207, "uuid": "950121c8-dcc9-4639-8c85-3bc5d6c07498", "value": 64308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668862207, "uuid": "513e3c7f-aaec-441d-bc90-e43df2ab2096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862207, "uuid": "56a7e3b2-c3d7-451f-9cef-40a021a1aca1", "value": "gx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28e6e72-67ca-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668835633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835633, "uuid": "051812db-6900-4116-bfc6-bb523b368860", "comment": "Malware payload (Mirai)", "value": "24987d67d8dfdab57776e33ca19d0bf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835633, "uuid": "746e986f-c0fc-49e5-bbe6-faba08db6ce4", "comment": "Malware payload (Mirai)", "value": "58dfd7bd18fed558c2251eb372af16e644ff3604a1857f8e62e6716f7c7d0753", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835633, "uuid": "7ef8438e-3331-4a57-a333-93c1635917f9", "comment": "Malware payload (Mirai)", "value": "a029084c649cc710442ebbadb10d3c47c8bceeef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835633, "uuid": "3517aed5-7903-4003-a1e7-87ddce13bbb9", "comment": "Malware payload (Mirai)", "value": "7a8e1e8de9a7e84d98764f1ea988d08f1d36782bc6e36ef9d3095cad46a36c7b1b1b8c788af1020a645c83adab8b95af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835633, "uuid": "698ef241-f39d-4a9d-bced-159dd9bf6ffe", "value": "T1EDC2D0E07726FE31C4206C3DE52B4D8A3A51167CD1FF393664258D358EC269A27E88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835633, "uuid": "46e7c36e-4e87-446e-9afc-fe1303a9181a", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwr19q3UELug:PKy4qfqoeJdXWgILx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668835633, "uuid": "41d215ea-74ed-41f6-81cb-c16cd7535a86", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668835633, "uuid": "57b5a926-2cbc-4aed-be07-4bcccc9585da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835633, "uuid": "b299400a-037b-42fd-a667-6ad97d10833a", "value": "24987d67d8dfdab57776e33ca19d0bf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a979341e-6817-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668868635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868635, "uuid": "f12b3949-f724-4671-812d-5e313d6ca59b", "comment": "Malware payload", "value": "f69a5ecf28b03b33e345ba9a376d4fe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868635, "uuid": "2f2ed961-c5aa-4e0a-956a-937b4a7e6a2e", "comment": "Malware payload", "value": "58f60fb261e1463883f1282bdf7384f54c20b0e8a0504d0ce907b1a79a9d97c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868635, "uuid": "1e08ad20-a9d8-43b7-ab3f-3b8bcc8271d2", "comment": "Malware payload", "value": "7273a4ae795c71534209b4875314f1fbd1ce8d54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868635, "uuid": "41f35faf-74ad-4fe4-96c0-3529c6a69a55", "comment": "Malware payload", "value": "1e7d7b8408cc7bba3de2adf7194c5d6cb60b6dcefea32145a11a2b0ffd48a48a3cc3f95e643dbb7ba70a65a06e26f263", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868635, "uuid": "4c5af7d2-48cd-4761-bf69-0fc8727db520", "value": "T13AF35A34F291B476E4F3053198ED93F5AA3C7A30279588EFA7454F2A0B356C2E631927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868635, "uuid": "02dba49c-0ce3-4173-9f7a-e93517420bc3", "value": "1ec4f3623d5a5e8b864ba72e03a016ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868635, "uuid": "fbbbe319-2b85-4591-9bb7-992717c2de22", "value": "3072:z0NWs7LGvYf6rKbuWf0cJWVl9/qrWXQk4SBxKiZSmfgW+AcScs6FvBDXk:zhmCqiD1jjS0gy6jD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668868635, "uuid": "7f1d4ad0-e093-4eff-8014-2d51dbbc6dfb", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668868635, "uuid": "1a006b5f-e153-4c68-b17d-7d8ef3dabb6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868635, "uuid": "bdda2268-4b0b-4e4d-bd0f-c7e1e55fd91e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fd4e72-67bb-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668829011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829011, "uuid": "1366fe2a-efe9-4e2f-9b25-4ecc5bbc88fc", "comment": "Malware payload (Amadey)", "value": "4ee4d5f7990d88e0a18df14eb00db848", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829011, "uuid": "55d541b1-1036-43f1-b764-0207c37327be", "comment": "Malware payload (Amadey)", "value": "5a6391caac6e6a392c4ba510e04a75f3f3a59f8a071d1ae494752300b5584d5c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829011, "uuid": "fa79e862-ca5b-4a02-81e3-1e4260c5ea62", "comment": "Malware payload (Amadey)", "value": "ec7aaa21564d595222387520fcddbbff09ab49ff", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829011, "uuid": "bb41bebb-9529-4272-bc10-61edab932b31", "comment": "Malware payload (Amadey)", "value": "36348202e63bb06be447967147fcb96371866f12b4ba771b4da0a23b3ed7a449dc7ad99929a5cdcc7d14a4154ef3e70e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829011, "uuid": "91ad20f5-76cb-48e0-972f-b1b750291396", "value": "T1B884CE1072B4FE72C4C90135882DABF56E29AC515F2589D772B7FF6F6E302D069B2209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829011, "uuid": "96fa13f5-6de4-4a55-b4cc-cfe879601db9", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829011, "uuid": "cdd1be18-6920-4149-8531-851608ccaba1", "value": "6144:DQIOUzlCXvYARHbNr/h+FbTU4B4jkw+Ph+3oQ9gOU+fzYBb6:pOQ7Ath/h2bQ6Ikg9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668829011, "uuid": "e85f1480-b666-4082-9294-00733a15ac5b", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668829011, "uuid": "9ff5ccce-2350-4a01-8e17-52475f7fccc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829011, "uuid": "bb017a81-6c3d-4622-be94-de056f2fc8f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50badd44-6800-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "e42f0397-184a-446e-a85f-d0e13da6695e", "comment": "Malware payload (Mirai)", "value": "f59db854ca1ab712c73583335df82b6f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "1603b961-3ad6-4723-a16d-041f6a44c687", "comment": "Malware payload (Mirai)", "value": "5b7df9147daaf481b04bd9dba6861529cbab67cf89bfbc21624c89d843929985", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "f21c8c64-6fae-48c8-a8b7-c635dc020afc", "comment": "Malware payload (Mirai)", "value": "695367163decfc842da88058feb35a85aaecff21", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "3b8cf25a-feb9-4a73-89a6-8f7afb6b8e87", "comment": "Malware payload (Mirai)", "value": "dc1bc32717cb4b4138e86a67a0c4b7146e3d1cbaeebc7e85faeeda59d2331e0bfc6e256337c1ed3e3b85746f765bdb1e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858608, "uuid": "b803f52d-32e2-4bc7-8bef-1292172acf44", "value": "T159A2E119BF18868FC832693551D9EAD21292FC72F2DCCC096940C16FF4A33E96474F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858608, "uuid": "78afa080-e0ad-4cb5-b9d3-4a57f334ebdc", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKq:O98o08kxofBE+ZkXaqGbp2F2TWul0c5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858608, "uuid": "1219fa3c-4163-40ea-91ff-3400d3ffea72", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858608, "uuid": "1d707898-a1b7-49cd-be65-6742218ab2ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858608, "uuid": "4a47ec4c-67c1-4677-805f-9d10a93086f6", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e1efc3-6801-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1668859230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859230, "uuid": "254f224b-0f55-4be6-9aaf-397d030ded36", "comment": "Malware payload (DCRat)", "value": "803ee83d52f73b3e836e74ede12027da", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859230, "uuid": "6d1a5d71-bdd1-4488-aefa-aaaf0181bb07", "comment": "Malware payload (DCRat)", "value": "5bd4680e3ed714cc7e8b0b16471d2323118061e7e3698cfbcca0bb4397180d0e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859230, "uuid": "3f188445-0111-4a70-a127-a2e980029a62", "comment": "Malware payload (DCRat)", "value": "6e477df6451c5daab9002bb49398a9bc93b5aaac", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859230, "uuid": "708d458f-d423-4465-a3e3-0e456a027f70", "comment": "Malware payload (DCRat)", "value": "8256c2ad0998cd052224223ab30365bd6a7a941f2a1c2b448947f2231f88d403ec0d4069d7e23ec986118256ce033dfc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859230, "uuid": "874e93f0-c2e2-4222-bb14-3ec25cb55bae", "value": "T1CDE59D017E54CE11F0196233D2FF494847B0AD556AA6E31B7DBA33AE55223A33D0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859230, "uuid": "96d34006-4128-4166-b5bd-f812a567954f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859230, "uuid": "c73726f4-6508-43ca-b500-f980172d0ebf", "value": "49152:+a9ojNUMmsl9giRa9ojNUMmsl9g/80NLRwYC:+a9oGK9lRa9oGK9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859230, "uuid": "5ab678d9-bc5a-4af6-b2c5-ce0cc6954410", "value": 3217176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859230, "uuid": "f3836403-9176-4b1a-85bc-b142ed00150e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859230, "uuid": "9d7f98e5-442d-4981-b008-4a008f539c71", "value": "803ee83d52f73b3e836e74ede12027da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcb86c7-67af-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668823975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823975, "uuid": "b45fd88a-1619-45f0-9226-75a8c1c8b747", "comment": "Malware payload (Smoke Loader)", "value": "ea5a07bf2171d78adb18353ead42b346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823975, "uuid": "bd0d4b34-842f-4c37-89a9-4b545f30587e", "comment": "Malware payload (Smoke Loader)", "value": "5cba401e851d9f4766ca9e9765ff0f4c0e5502c5a48524e7370cb984f6c203f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823975, "uuid": "53921d22-3d20-448d-84fe-739089d3315f", "comment": "Malware payload (Smoke Loader)", "value": "3bc3718324d60a8031ca29db827da14fcaa71f5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823975, "uuid": "31ebfd55-b94a-48a7-a0b5-6671e91a3174", "comment": "Malware payload (Smoke Loader)", "value": "dc0a258200080339736c001d64f8a6b2cd8ddcce1003b3c068efaf290d91e2980e8c06db28216c3eab64c71fdce697f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823975, "uuid": "4da4c795-a7c8-4a8f-a9bd-ca8e268c2dc4", "value": "T17B74BE10B684FE32C5C10531882EEBF56E79AC615F2689C776B4FF5F6E302D0A6B2241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823975, "uuid": "7e440e55-0ca5-47e3-bfcc-e72f88bc0c8b", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823975, "uuid": "53df4653-509e-49f4-b5f2-271055568ac7", "value": "6144:OJEWfzE7w7EEm8N17mQoi6SHzwIWahBZMh+3oQ9gOU+fzYBb6:HWAZ8N17maZwIWabZz9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668823975, "uuid": "290bb8b4-3ae5-49ae-a00e-a4e6e241ff59", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668823975, "uuid": "ccd86880-89ab-4c5d-9928-9013fbdb6eeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823975, "uuid": "94dcfa68-f7f6-4ae9-9be3-42ef39ed791d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b617c48-6831-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668879778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879778, "uuid": "1896c04d-0871-42d2-bf85-f90d36457fc7", "comment": "Malware payload", "value": "b53323fe8759b223cceb0c6e4181cb4e", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879778, "uuid": "50d17383-680c-45e2-aae1-df0d3854b4cb", "comment": "Malware payload", "value": "5cc1defb3561d0fd290639bc8efd9b4dbe608f1d761fb62d21f170ad0101c8ac", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879778, "uuid": "715c0f92-4c75-4137-a025-48a650b86cdc", "comment": "Malware payload", "value": "e3769715c0a29b88f06b4c565df7f436624454fc", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879778, "uuid": "e615306c-b5cf-427f-bc01-94cc1e5d6e00", "comment": "Malware payload", "value": "4d51ba85117daf5a37fe4bbc62289068deca977cf8dd08ba78ecc4168a78d5c3e6d9632ddfbb3dabeef6d547fe67a53c", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879778, "uuid": "f84ef1c2-b0c7-4b4e-8c1b-0677178e9ad8", "value": "T17AA4C01A7A698E01C3992E70D1E355356BA1E5873273F34E2F9972E21E133F48E493D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879778, "uuid": "32b4a83b-8584-432e-824e-cbafd3713413", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879778, "uuid": "fc9b9fe6-10df-4147-a93b-573263b5c1a8", "value": "12288:kWi7ytiQJ82akxIIgmItMUFgte3A6pHadZFy6UTu:kZ+tHJ8wIImHgtetQNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879778, "uuid": "62ceec51-9f06-405d-a23a-093edec74ffa", "value": 464896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879778, "uuid": "bf640836-711c-4255-a133-a69075a8e45e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879778, "uuid": "7d5cde20-134a-44b2-a332-72a87deb7244", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1f7d2b-67b7-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668827490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668827490, "uuid": "0576a13a-63fd-4f05-a31b-4e4ef756ac96", "comment": "Malware payload (Amadey)", "value": "15822a4c3b411df089a1fecf22c2e652", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668827490, "uuid": "4bcf2a5f-7f1b-4d5d-b328-34e9af89435f", "comment": "Malware payload (Amadey)", "value": "5eba275264d0414eb6a77b4528000f9a532506f9d6cf2ad01e3c08a867b37d7c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668827490, "uuid": "1300ecd9-daea-4e69-b89c-53fd5be939d3", "comment": "Malware payload (Amadey)", "value": "3d55f2948afbd331c53726e8287981729051360a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668827490, "uuid": "b1214249-cc10-4175-b7f1-9233c1dafdd9", "comment": "Malware payload (Amadey)", "value": "9b359237ef60b8b23b5717a2eeab2f1dad6103b15fa67ed3358b494a48a757335e24cba306642645e32e9faaa63fc4f0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668827490, "uuid": "6fdc5c64-f60f-4d0e-9bb7-ccf9d1c70d0f", "value": "T18B84BE107280FD72C59141719C2DF7B5AD29AC615F6699C37EB8FEAF2E301C06AB221D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668827490, "uuid": "20810387-adee-43fa-81e3-252758cc5ea1", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668827490, "uuid": "f54f2118-b52f-4b95-a593-53a1e21a6fbb", "value": "6144:55IYHzCFiWEvx0FAKO7qUEPXOuGCdcxcgTh+3oQ9gOU+fzYBb6:cY+MWEyFAKgfUjWLs9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668827490, "uuid": "68383674-000d-450c-8c7d-714051a14956", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668827490, "uuid": "fcb46fbb-3bb7-4d25-a576-3e3c29b4d4c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668827490, "uuid": "4be4cffc-4718-4558-a4be-f6ffeadf3c48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc065ac-6829-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668876237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876237, "uuid": "f0d05731-80c7-4cac-a8f3-14456d22637f", "comment": "Malware payload (Mirai)", "value": "1c0c578936f40c701d0f2fe731f5a6cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876237, "uuid": "7c1c14de-1001-49aa-8d55-873557863ba9", "comment": "Malware payload (Mirai)", "value": "5ef8504a3000137ba510e31802d1c34977130583f7ef2c6d60c0b014c3a8b4cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876237, "uuid": "ebe3bd85-06d7-482f-bc9a-bf60c1b91ff0", "comment": "Malware payload (Mirai)", "value": "13a30b656c8bf9c3a411e993213d23b06675f648", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876237, "uuid": "4f0482b2-6941-4e80-b566-481008093c7a", "comment": "Malware payload (Mirai)", "value": "a26851942591c5c3600386ee3288544fceb07df5bdd528a7a4828c55a8aabac394cf05f51117fafae53a8cf1ba688fe3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876237, "uuid": "0c0eee83-fb2b-475d-88bd-539470401bb1", "value": "T19B3302803ECA3E70B716357E9951F730619517BCCAD8B22247918AD57BE902646F0AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876237, "uuid": "859acea9-aff3-4824-8656-bf682464058f", "value": "768:Be1+QjYD52tbZsqr8iqdfpGgC6wMbvlgR9q3UELMQEkkBF+MauMBexo4Y339cacY:KBkFAqS8W6nzCEL3PqF1aBexo4stcaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668876237, "uuid": "9d3847cd-7acf-44a6-ad91-2bc6550cd791", "value": 52504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668876237, "uuid": "3afc6ce0-24dc-4bc2-8eed-a45553da7620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876237, "uuid": "996a3cc2-2d56-40b1-a0f1-94fbfcc0e170", "value": "1c0c578936f40c701d0f2fe731f5a6cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49154434-6815-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668867614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867614, "uuid": "d6cdd441-206c-4a78-a14e-a15786ddc9ef", "comment": "Malware payload (RedLineStealer)", "value": "1738af67c49999f2c95ee744b7e56008", "object_relation": "md5", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw Project2022", "colour": "#4B8B81", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867614, "uuid": "d1734418-01fc-411d-9683-def58a9762ea", "comment": "Malware payload (RedLineStealer)", "value": "5fb8916088ff581e68195f4d2ac5f062e456a65c4214958a18567a102bfd56a4", "object_relation": "sha256", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw Project2022", "colour": "#4B8B81", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867614, "uuid": "61d80a66-7f55-4a5b-b5fa-28fb0cdb2b4e", "comment": "Malware payload (RedLineStealer)", "value": "313dae56db25614961397dc807d3104277e8b20d", "object_relation": "sha1", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw Project2022", "colour": "#4B8B81", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867614, "uuid": "b7881cd3-7f84-4930-b30c-d695150f39dc", "comment": "Malware payload (RedLineStealer)", "value": "8adae78acd557749f0b608a508fef49f1285ad3eaceba03a0ad1912cb55e69544d64e46981d419be90c482b5181070eb", "object_relation": "sha3-384", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw Project2022", "colour": "#4B8B81", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867614, "uuid": "b4305592-b089-4b86-b6a3-a9a0fcf587ce", "value": "T104D4AF6261E9C1DDC1F9A17EEC0AB2F4402ADD29E62D8C1FBDBC3E993634651E13025D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867614, "uuid": "e90d410d-54cf-468c-bd14-917e0ba18c64", "value": "a776fb5ba9b9f795dae561995126082e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867614, "uuid": "35ebc31c-3215-4e90-ba8c-9d589891fa82", "value": "3072:nqvtHFZDOUypvH5AhwNasFqgbXUAwNG8f6W+AvPdRsfoxLna4a5QulV:n663vHuhLsF+56W+Av3PxWFyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668867614, "uuid": "7dca9364-9606-40f1-ad16-93fc3478e8b8", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668867614, "uuid": "70c8eeba-3e35-4dd0-bc91-feb9ed4c3ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867614, "uuid": "a96e8308-9dec-48f1-aced-e1d7a7fece52", "value": "Projects list 2022.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b617c85-67f6-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668854357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854357, "uuid": "7ef3bdb0-fea1-43c3-b654-9838d2c5058c", "comment": "Malware payload", "value": "2624622636c56970b2799496a54ee0ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854357, "uuid": "f5216a1e-c9f1-4337-99e9-da3f73e372f8", "comment": "Malware payload", "value": "602fa026600278f136a0e5ab995ef4763e9ae2174a48d4e05138d5db643c0fa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854357, "uuid": "6a34e434-284d-4c86-a2ec-f2375b08ac29", "comment": "Malware payload", "value": "7846d85b8d3cf9b8dd7e84736bc3b02b4dc47e5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854357, "uuid": "b0490c26-aeb3-4fe9-bae6-9c8170e474de", "comment": "Malware payload", "value": "2818f82d1f34cac958d79c62a05136333bd34fdd4a8b9190ddeeed7f109dc7097ee98b5ad2fb8507d2083860a2dcb8b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854357, "uuid": "7b695264-4877-487c-9469-5e25a018403d", "value": "T16576330132D4C838D58641319FED8F85B4E5CF6E0A791967B2F8837E09B92C7C39B999", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854357, "uuid": "5eac8822-f423-4f41-b8a6-825f3f0cfbcd", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854357, "uuid": "17a56d15-88ee-4067-9594-b3f1a87470fb", "value": "196608:91OjzIldbuS7hpOMIGoqsBhTjPbGVqT+uQDGvdJYVjTiR+EF:3OjzjS7hpraqsHPvyuQEYVHmNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668854357, "uuid": "3550f92e-2055-4148-8087-adee84a92865", "value": 7639491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668854357, "uuid": "351c7dbe-8c76-470b-82a4-f8a82255fb75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854357, "uuid": "015a938f-dbce-410e-b263-beb8881cce89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e79195f-67e5-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668847061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847061, "uuid": "3395abad-e2fd-449c-8b4a-56159d288f27", "comment": "Malware payload (Mirai)", "value": "79f27836d0272c0178b40586a542ec3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847061, "uuid": "030591e5-8722-4776-a037-0b0f05a73348", "comment": "Malware payload (Mirai)", "value": "615a37782e17ea9f2c072b47e1c743ad9d068b48ce53e8f23ef12341b61a0855", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847061, "uuid": "88f0df1f-9ad9-4399-afa9-ebd8a8cc9d2d", "comment": "Malware payload (Mirai)", "value": "35aeb7eebb29f2d689eb7410d8274c1ac36267bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847061, "uuid": "7e0cfa4e-23b8-4b5f-b42a-fb5f69646ee3", "comment": "Malware payload (Mirai)", "value": "c09027255c47862b1556b452dd428dbbfff0d4321c0cf456eff304e077a8072d76068bf5313685ef8229e404e22967bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847061, "uuid": "a979d5b2-6607-4859-a3f0-e771e11cb988", "value": "T193B2E1BC4BE36357C100E2F4A65E2E615CF152C27B152B77BE8960E782EE49D00D1D98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847061, "uuid": "3a55ab68-8fc3-4c4f-b1a9-aae2db414890", "value": "384:MiwuTpQY5dp2JZRllTm23gSI3Bue6R1R+kYi7Y6MABihbIzCGmZ2Z9v1RH:phaYvp2JZxx3v2ue6ZpnoAt2zZMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668847061, "uuid": "7535e449-22f5-4dad-9c42-0a205d55d27e", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668847061, "uuid": "28f20921-f913-4bfc-9cf2-453ac00c50f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847061, "uuid": "44ecdd11-d004-4788-ae37-e2310a5c2c70", "value": "79f27836d0272c0178b40586a542ec3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ca4547-67eb-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668849615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849615, "uuid": "3b250941-c6d5-4337-a919-e5b886e7f94d", "comment": "Malware payload (RedLineStealer)", "value": "722793e34f5039c8a58baf2756aca887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849615, "uuid": "769827ea-d441-4fe6-9330-27486bcd9f51", "comment": "Malware payload (RedLineStealer)", "value": "615c160f37235458f5623d76a8d5609244ab2731cfd3ccf76e69a9a0e39a3b4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849615, "uuid": "93822aa5-80ed-4e6e-a9d0-cf267427c6df", "comment": "Malware payload (RedLineStealer)", "value": "02e80382d74282f8dad3810d9e263f04a53784cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849615, "uuid": "bd0cd664-e801-4e17-bf12-66d405d3e9fd", "comment": "Malware payload (RedLineStealer)", "value": "10e16fdc40ee209c5bd9c9ab5a17844066bb403b593dd27e91ef63002c9478fdab93ecbaa2e73252d5e7ebf7e704a4ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849615, "uuid": "2af9a7a6-58f6-4687-b816-04901a771974", "value": "T119140A40A3DD8C19D5FD16394470B968B6B27D4F54C687AE1AC0F2FE5D32F489A02BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849615, "uuid": "efc05f92-79d5-406c-9949-62c69c437fc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849615, "uuid": "347b5302-89ef-4a21-8114-7010967a4cbb", "value": "1536:eYmtY4GwApr2Gzz54MOQeOvbXEes1yjkpzur9tsadOUw1y/pbYY3GY:80wPG54MJj0Tk4GskrhpPGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668849615, "uuid": "3abf1aa8-b315-40b0-8166-4bcbaa75e181", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668849615, "uuid": "7a41f828-cda5-4172-8253-042bd9afd0c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849615, "uuid": "bff386cd-e26e-478b-be5f-de93c964c334", "value": "722793e34f5039c8a58baf2756aca887.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c781712a-67f9-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668855801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855801, "uuid": "184efa99-8338-4784-b41d-ad34d83da88c", "comment": "Malware payload", "value": "af408662f207b2f1fe7708cf277ace52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855801, "uuid": "c62bbf39-03b9-4dad-8b77-937b571636f7", "comment": "Malware payload", "value": "61a7f8ea3c92801c91507a5afff36b04ed1f65fa31a86da49f671810e063b534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855801, "uuid": "f5c7bb3c-468c-406b-9d09-61fffb4f5161", "comment": "Malware payload", "value": "a2a134a2c553bd86d668e17ff133cdc3132be213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855801, "uuid": "f8ca4c02-de98-4d12-b8fd-b1a0b7dfcf5f", "comment": "Malware payload", "value": "8ee96bac5be686c844a2d75384b10b764fc94688c8028a1d8797419290dc23504bd631667b8afd3b313ffad7c2e9c6e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855801, "uuid": "18ad1b61-6333-4ecc-b6d0-2dd4c11fae36", "value": "T1DE7633913FD48CB9D3C38634BB597AD669FCEF694B12DE3327D0C0181C254829A54BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855801, "uuid": "cd1cd73c-b894-45ee-aa6f-90c77f287b6b", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855801, "uuid": "0edaad2d-3439-44a4-87a4-0ee22da21f55", "value": "196608:91OwetiQW8ld6P82Flj8cCCsifZd4jXZ6XM52re:3OwetiQWPP82FljjCC9xd01x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668855801, "uuid": "7bca825a-9f70-4c16-9f45-47bc34ee5375", "value": 7630267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668855801, "uuid": "2f5abd8b-b0fd-4aab-b9be-fa33ae05a1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855801, "uuid": "f579f5c1-6183-4eb1-b528-8f05f5e1070e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3bf426-67d8-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668841318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841318, "uuid": "cb52e5c2-1953-417b-baf5-2f7d1f69832e", "comment": "Malware payload (Amadey)", "value": "e0d60fb4b9ba641ecb98a92d1b0fde89", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841318, "uuid": "7712f8d8-8094-420d-99dd-7bc47c43c4ec", "comment": "Malware payload (Amadey)", "value": "61e06a61d9a4e83f019a9969da5431ee5b6562b80605ae9b341d87047deee406", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841318, "uuid": "4652a619-a4fd-41d5-ae8d-17e3a2e72455", "comment": "Malware payload (Amadey)", "value": "c308b97ffb680421a010d4e2691a2b09e3db8ebe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841318, "uuid": "f9dc354c-c977-4451-9cab-3ad440ef7008", "comment": "Malware payload (Amadey)", "value": "ea489bde8aa341087725f08eea14547b3b2af6c0286128b3baa047d8a53141c0ccee2f6b31e3dfe8cd24fcda7eae0abb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841318, "uuid": "d67cf335-5890-441e-ae69-d2074c19b271", "value": "T1CD84CF117681FE72C4C10231881DEBF9DE69AC615F658AF773B8EE6F2E302D065B2205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841318, "uuid": "00584ab0-c4dd-496e-8149-08f74a3ef08f", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841318, "uuid": "2c51dfed-81a3-406a-81db-6189b1b4fcb4", "value": "6144:rG9uezL0mu3pN1TWbkEA15pmVvz0s2DRkmS4Ph+3oQ9gOU+fzYBb6:OuQ2Z2biDDRkR9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668841318, "uuid": "be72038f-352c-4e95-8044-6c9c2282aab9", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668841318, "uuid": "b6983bad-c74e-4fcf-a377-17eb33b0ed39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841318, "uuid": "03067885-ca30-4f81-bc95-a1a57c376a66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8624e01-67c5-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668833468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833468, "uuid": "667d1d94-e8ed-4647-b735-2f5295248c69", "comment": "Malware payload (Smoke Loader)", "value": "9bfb72982a02973fc3c3a562a8042205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833468, "uuid": "35b389d0-f909-440b-8303-d537c341c05f", "comment": "Malware payload (Smoke Loader)", "value": "6207399c4ac3cd3decf161a47070caa910859b726601a9a99344e2941a88fc4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833468, "uuid": "5057d4b6-2f5f-4624-b453-c03158f57f98", "comment": "Malware payload (Smoke Loader)", "value": "34b01564bf753e80d19adbe167e6623f9f90c2ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833468, "uuid": "8d841641-1253-4905-bb1a-53eb5457714d", "comment": "Malware payload (Smoke Loader)", "value": "8038b6a96719fd58a2ae2437a914d752f95b27751b474004e0fdd4438f2716422e49b35511f0c64b070043da1e4fe32a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833468, "uuid": "0ada6e0f-c033-45a2-b261-e45eb96bdf0b", "value": "T17D74BE157284FE72C1C10131882EEBF56E69AC614F668AC777B4FF9F2E302C0A6B1255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833468, "uuid": "f5cebbce-982f-4a3e-83bd-1d03f18db849", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833468, "uuid": "b46901ab-df8f-4f26-8486-2ddf79b67375", "value": "6144:shC15TkeHbhzqtr/NprXVDcagwwkCBQBXRHh+3oQ9gOU+fzYBb6:IkkJVAdYKQBXRo9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668833468, "uuid": "ed168feb-08bb-449c-a709-8d3b4ad71224", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668833468, "uuid": "ecabc42b-6147-40c7-89f1-0d5211bbbcd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833468, "uuid": "2a18e544-367d-47d3-8dfa-292952c97d69", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586af3ca-6832-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668880095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880095, "uuid": "edac4506-8829-49fd-958e-1f17b8f9943b", "comment": "Malware payload (RedLineStealer)", "value": "f96144b1d5b53d93caadddade38db5e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880095, "uuid": "a176008d-0d59-4936-ac40-3c9d04d342d3", "comment": "Malware payload (RedLineStealer)", "value": "63018f38311387aa7f511f090fd154ea6ec3799c2f4762890082793912c68146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880095, "uuid": "1645ce26-4419-4c71-b277-24f120f5175e", "comment": "Malware payload (RedLineStealer)", "value": "1587e66f9a4d83060ee597f983a7323a556bc1c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880095, "uuid": "1587022a-1686-40c8-a346-18fd96419b7f", "comment": "Malware payload (RedLineStealer)", "value": "239c855e3fdfceb44dec0032e155d15632c3dc40b63bb5c2e88368523640f788918b7b9212c688b760330f5102e965de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880095, "uuid": "61236180-546e-4fc1-b1ce-127cf0463f68", "value": "T12345D012FF5AC429E84F74F8E163AA98529DBC8F4035C2D3F660AE192DB92CF6547017", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880095, "uuid": "5502240a-38f4-4f8d-9397-31e30fa2a8d9", "value": "c87c269684dd62d98968492b86dd710d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880095, "uuid": "90d7ef7b-3618-4596-9911-6d261532776b", "value": "24576:tpoG1/LlgEyH9QhH0slclslX6ptmEh4NqYJUo02O7RVUCshnSVjGMY0tZ8bMyqZs:tpocLlac0s5Ih4Ny/Ybb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668880095, "uuid": "114346f5-5009-4bf2-a47b-72a1ede0d667", "value": 1235912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668880095, "uuid": "dd4b0618-ba03-456a-9196-c62008d6a1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880095, "uuid": "a086c2cb-6780-4adb-97ef-baed0bb53663", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81af45d-6816-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668868284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868284, "uuid": "22feb6fb-eee0-4896-abcd-3751b9fb1c67", "comment": "Malware payload (Mirai)", "value": "273f3d21ad8890272d609147b8ba1e49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868284, "uuid": "976fa104-afb5-4f5e-99c9-c525aaaf1e42", "comment": "Malware payload (Mirai)", "value": "6301de5701bcca7509275e304f91225f1e6df5fd6aa24d5ff08995a2e05838fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868284, "uuid": "620e7119-0884-42b2-8fec-609d818cc144", "comment": "Malware payload (Mirai)", "value": "6f4b5537ea4f83224ffe900367cd34a2f3d0121b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868284, "uuid": "2500ba5c-29ff-47cd-b5e9-5ff91548bd1d", "comment": "Malware payload (Mirai)", "value": "f4c733415db43c399ee084a56371e57b31362b77dda047340cc3c9498e15d622d738784370a1a52961a48cfe3201f788", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868284, "uuid": "13f20b63-6907-48aa-a074-f05c347c1b93", "value": "T1A7F2F1F0F15FDD76C2F42472F988D5D134FA0378936A764210A45AAC8D9068BEFB09C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868284, "uuid": "a3bd4fa3-0ba3-4349-acef-80f49f98ad9f", "value": "768:egVuUXSG+IQpFJRI+upQ4BRgeTaTl851Tf69q3UELC+:fuUILphIxQ4BRgeGTi51jvLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668868284, "uuid": "635abea9-554c-4a76-8788-1803015abb00", "value": 35240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668868284, "uuid": "e5d4cd85-fc47-4a6e-85a7-eab9cf28bc05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868284, "uuid": "edc33f1a-9850-44c8-85d3-a9d52694de23", "value": "SecuriteInfo.com.Linux.Siggen.9999.3084.31988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ca8880-6800-11ed-9266-42010a9c0072", "comment": "Malware payload (Geodo)", "timestamp": 1668858702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858702, "uuid": "d135a2b4-ca9c-4dfb-98e3-6a6ffd594052", "comment": "Malware payload (Geodo)", "value": "8baa9b809b591a11af423824f4d9726a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Geodo", "colour": "#F6A7A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858702, "uuid": "2db2ff34-471f-4cc9-ae37-4a7d91f611d2", "comment": "Malware payload (Geodo)", "value": "6393fe8dd4721190f240e22feeb769675b6194a70cabd5a415c2364686a9089c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Geodo", "colour": "#F6A7A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858702, "uuid": "4371384a-c2d2-4b33-89a2-8dc604765e52", "comment": "Malware payload (Geodo)", "value": "29d6161522c7f7f21b35401907c702bddb05ed47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Geodo", "colour": "#F6A7A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858702, "uuid": "d702f1d7-a7f7-40b6-992c-f02eeebb3ed1", "comment": "Malware payload (Geodo)", "value": "b29194a87edb4b6cec6086a05984f982174ea62311b7e5b23eaca6cd5d9df8ebd584d69edda509e2b3b626cfc5e81d69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Geodo", "colour": "#F6A7A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858702, "uuid": "50ee592c-1e21-4d09-bde4-4740a59fc2d2", "value": "T10193BE12EB6DC825F6664732B66115EBF232B8221D158D3B0D47FA2D0A3135E782673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858702, "uuid": "f57b8a49-9643-4ce5-b8f8-85c370810af6", "value": "2577f052411e1fa2ad745743e50cc2fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858702, "uuid": "9da3b4ef-ac72-44f2-b287-50954e096af5", "value": "1536:8gVgsgm8VUWq8qt3jhOrpOlVPac2xK2uypKG4lvhGnyVUEom2OEKI:/avzbqTOrpOyc2xKZbcnyVUEof7KI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858702, "uuid": "505e121d-511d-4f01-a084-dcf1790344a5", "value": 96535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858702, "uuid": "21d86d86-258a-49cc-88ef-04d2fd04d880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858702, "uuid": "3a273e42-0f31-49d4-8da1-82a75dad4f0d", "value": "29D6161522C7F7F21B35401907C702BDDB05ED47.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea657f8-67f7-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668855007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855007, "uuid": "90c58f90-b735-4f4c-ae86-88641b7ea584", "comment": "Malware payload (Mirai)", "value": "2b8c2de7216be9f689c3d48b549d13a4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855007, "uuid": "01093e36-dd1d-4f67-afef-f20b905b448b", "comment": "Malware payload (Mirai)", "value": "64053cbd5827da61eb9bd6a01428332692a16c95ba280f4ca0085db417e3d368", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855007, "uuid": "8bdec9ec-62ac-4941-a9a0-8082ead8be9a", "comment": "Malware payload (Mirai)", "value": "b0fc7a0ede8f55933871ab69d4508f98e2254395", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855007, "uuid": "42fb4e8e-29a1-44f6-8b3a-971c50a60a98", "comment": "Malware payload (Mirai)", "value": "af87a0b0fed1803a2214ce6980a09a4c33d3a56fcec47c7f7a80d63c4844798cb548928e4eabc1cab23d3ceecc7940fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855007, "uuid": "ba6ec720-b2ec-4297-bac2-4ec9e5164bd7", "value": "T195D2E062D0E5C908D63BB738598DA1A950509C4E3D64DBF270C430BBBC95B3D19FDBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855007, "uuid": "4900876f-8b18-4cc9-b731-63cd3964ec87", "value": "768:OI2m5Wig1lgqM1Guj6RQsJJkXLOJmwhTzJanbcuyD7UHQRjk:OIN5WN1lgqJuYQsJJkXLOJmU/Janouy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668855007, "uuid": "e1102f01-eafb-45f9-bc4b-4b9ec619334d", "value": 30568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668855007, "uuid": "da67f4eb-9374-4db8-8ce3-9864b067b656", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855007, "uuid": "bfb72362-db3e-4000-9b72-b9d531cd5d8d", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19cd79d-6857-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668896244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896244, "uuid": "c7bb985e-6745-401a-8352-a2d59d614514", "comment": "Malware payload", "value": "14ee1ca3c2db93730c493df5b8765dc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896244, "uuid": "20e5a0f3-2f3a-46d2-af43-8c89a0677382", "comment": "Malware payload", "value": "64d3f7548cc05520bd5e88d4bfdae38a57886127b7be55b7e6d09636f123cb22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896244, "uuid": "34742704-5112-4609-9945-7d08ed7451c1", "comment": "Malware payload", "value": "fa93c63af1486722672e6be83d1b8142683052ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896244, "uuid": "1f7ff3d1-9e43-495b-8383-d4597f9d1c48", "comment": "Malware payload", "value": "bd466630cb07b103c196ababebbf1389dc022932f07c159ce0205e77ba86bc4219973d55a3a9020b2c65e0dde4cc7a00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896244, "uuid": "cf5f1d48-5456-4e1e-92fc-34a6c379a528", "value": "T1BD74BE10FFD0D4E5E47DC9307A26CBE81679ACB16925D90377786F5E2EF02918E62232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896244, "uuid": "5f2d2942-3dfc-4898-850b-ca4ad23c0c0e", "value": "c8c0db015ca53b9ef621505ac544aadd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896244, "uuid": "6398e16e-5385-433e-a3eb-98ed716daf99", "value": "6144:cOL0OBAxvqafZVrYjpCZhVV4E+O13oXc:B0DkQ50g0DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668896244, "uuid": "027dbc52-3956-4ec2-bd14-00cd0827a886", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668896244, "uuid": "2e6566b6-2008-4da9-bbdb-49f89d1484fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896244, "uuid": "b913d27b-802a-4717-b3bf-579b96fe6466", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29dd82a0-67b7-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668827189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668827189, "uuid": "f5f0d4a6-3708-4a74-85f2-c9fca2c774d0", "comment": "Malware payload", "value": "6b17f139ad94cc35a1388686bee46951", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668827189, "uuid": "061a0260-0adb-405b-bf93-b39f226d3999", "comment": "Malware payload", "value": "656f5c1e8367a0b6e34dbf8e5740be127b4ffaa74a22a2164fcd68eff45580ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668827189, "uuid": "bfea56a4-3b02-463e-8428-3292f747ef6a", "comment": "Malware payload", "value": "69358798c1afd2947440352ab183effb4c9a75d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668827189, "uuid": "7d0bc91e-14fe-4190-a381-64bd5d8101a8", "comment": "Malware payload", "value": "a64539e72c92bd46694961a2da06bb74126a9657fb9149515c2effcaee38760d0c1d1485f486987bf0a1fbcec997898b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668827189, "uuid": "17e8aef8-642b-44ee-b5b5-4463f4dda23a", "value": "T1EE763B47F85180E8C1EED230C62692A3BA717C854B3027D72B50FBB92F76BD46A79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668827189, "uuid": "8f524da4-f14a-4c1c-826a-da8c689469a6", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668827189, "uuid": "28434113-0509-4ced-8a0b-bf374c9e5b58", "value": "49152:foqz4syeYvg0l8rb/TxvO90d7HjmAFd4A64nsfJ13ZGuBj6PqVdJUELyGddDxLlg:f4N3EYTm1aSNwENAzy6gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668827189, "uuid": "18ae08d3-730a-4745-9b59-48d85c60a6f5", "value": 7797760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668827189, "uuid": "f12190dc-5a5c-41fc-912e-5f00e32d7a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668827189, "uuid": "5954f683-9728-4860-b0bb-3d6f13e6eb6c", "value": "6b17f139ad94cc35a1388686bee46951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685dcb0f-6857-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668896014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896014, "uuid": "2aed0baa-56b9-4beb-b815-df715ffd6a8c", "comment": "Malware payload (Mirai)", "value": "061d91ec240d012b8fa571af9d909413", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896014, "uuid": "7a6943e0-3f3d-449d-a502-15d9ae5701bc", "comment": "Malware payload (Mirai)", "value": "65813451bb38ad455292cab32ad09d83f3292e0c73773ed122ea6089950c6f87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896014, "uuid": "29305da7-221b-480e-ac47-dc50ad5752da", "comment": "Malware payload (Mirai)", "value": "0dd8cff42a07f13be23bfc5f24ee11332b289561", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896014, "uuid": "b4bc8dc8-f73e-4778-8b1a-e971338c68fb", "comment": "Malware payload (Mirai)", "value": "29549880a573438d30ff79aa12293421e67330549e937cf2e8e8b660b31c6bae15ddbef5b0926f3f015422c332bebea4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896014, "uuid": "f016f4b8-1132-429c-b8f5-5701b738c00f", "value": "T146A2D025D345AEF4DFAF9D9093C2C2C2B7E583C66686C8E340FEAF016506046BB89D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896014, "uuid": "3b8c9db0-c93c-4313-9246-84db8fd7b188", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5xYOM4uVcqgw05VxJ9:MRxsSVsMD6xiJJE5zRWNMN4uVcqgw09P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668896014, "uuid": "bb0a43a6-1398-4f36-9721-bd1671df08f0", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668896014, "uuid": "2e0d3dcd-31e0-4b1c-8be9-a3a08f4ce546", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896014, "uuid": "48f13158-5714-41d7-a9c4-499f40cd526b", "value": "061d91ec240d012b8fa571af9d909413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bdde22-67c0-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668831392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668831392, "uuid": "dab6d22f-1d91-4221-94c0-dc5a4f0683f5", "comment": "Malware payload (GCleaner)", "value": "8b0141aacd4e1797c0188d3abdaea1b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668831392, "uuid": "741e6788-7e84-4d32-bde7-3ae2c12d2815", "comment": "Malware payload (GCleaner)", "value": "65d782867b53c69259779f5b64e9ee1b7bfdc57f5ec7a00fb28dbb7bbd58f4f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668831392, "uuid": "d5fa7479-f185-4ef7-a9ef-097c998c1e39", "comment": "Malware payload (GCleaner)", "value": "b93ed5f8b5959243d87029064884b7a38e3acebc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668831392, "uuid": "3a95d5d7-e05d-48c9-ba5b-5da75e762a75", "comment": "Malware payload (GCleaner)", "value": "e3496ea24d94f311f6aff72df0f00263fc4a6f27a49cd6a1b396fcb70f171ae9fd42fbc648849f4dedf3b9a29f096a36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668831392, "uuid": "75a0ea33-0ac5-4eb0-9c69-fa6ae5178f5a", "value": "T1BEB5EF516A96D295C82F6DB4E62070F84DB63E62E82EC27BF7927C5DFE3D357810A400", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668831392, "uuid": "bee83eaf-2934-4c02-8e23-093fc90f81dd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668831392, "uuid": "c90358bb-a623-403d-b083-1eb7034dde5a", "value": "49152:q2FNyZZOLDkmhIMuoMJK3yFYNKZBR0uFO59IQFlkYbexUxVkBaFwnm:rFMZcLDzfMhKNcFOPllkYbaUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668831392, "uuid": "162952e6-b8e0-4b44-bb45-3ac8b8955200", "value": 2363228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668831392, "uuid": "b7f1012d-c3b0-4898-810d-09ba0fe0cd28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668831392, "uuid": "4a649fe0-4c8e-45d4-ae3a-1d33a802fb2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598e3741-67d9-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668841872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841872, "uuid": "7a5ba733-11b5-4e60-ace7-2d404b083a8d", "comment": "Malware payload (Smoke Loader)", "value": "96756963b94f8e80379e407914db3530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841872, "uuid": "0f070c24-572b-4fb0-b290-ec2bd45e120f", "comment": "Malware payload (Smoke Loader)", "value": "66163b1ede6834eea20890d9d5cbada30494f6be854d1605fd37debfaa382d41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841872, "uuid": "42ff4f75-f70c-48bf-8241-f0f877d9f9f5", "comment": "Malware payload (Smoke Loader)", "value": "401cb8baced83fdfa6d138ce152f60189c791b1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841872, "uuid": "9c2976cb-557a-42a6-b024-f20722e4c645", "comment": "Malware payload (Smoke Loader)", "value": "7fa429faf3a37b14ac728bd2422689c901528e269d1a632fb94820c0eee45995c2ea0b28840f58ae9af1a55599ba9c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841872, "uuid": "90bdefb1-a199-4488-88af-7638aced5278", "value": "T10D74BE10B280FD7AC4C10171892EE7F5AE29AC515F2599E373B8EF9F2D302D1A5B2635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841872, "uuid": "a4e8fafb-58aa-40e0-ab57-b9505620c4a4", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841872, "uuid": "3b85cc2c-39ea-4af7-8143-5bce05de714b", "value": "6144:5NVAxSzL0p3Tfuf0XOaqOMYyh+3oQ9gOU+fzYBb6:6xMW3CsX/p9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668841872, "uuid": "b7e47c49-56ac-477e-8fd5-7df073929b77", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668841872, "uuid": "1a9429a8-4a79-409f-8255-f6fbc1d52a55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841872, "uuid": "95b28a5c-4f7f-40f7-ac8e-a7702400ebb3", "value": "96756963b94f8e80379e407914db3530.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9338074c-680c-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1668863873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668863873, "uuid": "5ed8041d-32ef-4f0d-8e8f-8e4bac37b38c", "comment": "Malware payload (AgentTesla)", "value": "9a45a210cd7713382cb3b16d2ef0ab87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668863873, "uuid": "a52c071b-f3bf-43c3-b5b0-e99ef373d8a6", "comment": "Malware payload (AgentTesla)", "value": "663796a5ce4127446f60d77bca21aee44037d4c0eaf3b14449f4a54ecb359428", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668863873, "uuid": "96a78364-572b-4d65-a5ec-e614ab5045f9", "comment": "Malware payload (AgentTesla)", "value": "2b6074e7b2c27eba3afa1da95b6283b84d7c9f00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668863873, "uuid": "d730ae2f-cc2e-4da0-856c-67e5b3e25823", "comment": "Malware payload (AgentTesla)", "value": "a1cd471058a20162d137a0d114ba87410b7f91de1c1e2e3ee55aaeb6d5434df034534a51081d0d31b884836d97ee03c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668863873, "uuid": "f62f5bdc-8361-4f8c-85b6-12901f8f6fef", "value": "T17F055AE968936D2EE4B8B27D54F1E890CBB34C724EC1AE2451A83DC26D335D3B0519F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668863873, "uuid": "becdd94e-ce73-4c7b-9a03-2b92fa857e8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668863873, "uuid": "973650d4-a61a-489b-a37e-8db69132634b", "value": "12288:ZwcjZnbCkI2nM333MFJN0K2Ilg3foOo1i7D3wvcTi3EikRAnwz:/jZnbCkI2nG3ch9YoOomD00XZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668863873, "uuid": "7600dfe0-f5be-4bdd-9ef4-d1488c58afda", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668863873, "uuid": "87e73d62-e918-4f2c-95bb-54a12f0bbdca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668863873, "uuid": "a6286667-066f-4a4f-a68c-2aea14d073fc", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdb0aef-6800-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "4b9acef5-af9f-4cae-959e-edf8002c28ea", "comment": "Malware payload (Mirai)", "value": "52f933c66147bcb8b1ef1ee1f77b59c7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "d78b78f8-68c3-4f99-8839-882a02313a2e", "comment": "Malware payload (Mirai)", "value": "669bd939ebb8c660806687cc3cdf0b7d08bc7d35513787118ca9d855efb92e6c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "190b42c4-7430-4454-8bd0-cbaf59ec6700", "comment": "Malware payload (Mirai)", "value": "ceabf7a89ed7d1b0fa07670225e79a9f2bdc115a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "11160ad8-3059-4f47-a1a8-abe7516e9b58", "comment": "Malware payload (Mirai)", "value": "5971fb02cd5958ffaa1292e2b5efc60a1fdc9406e11c5a166e8f3f0fc92ab31c6b1d9d6adb6a31ee9f4d6a41216e1465", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858606, "uuid": "1c910085-186e-4116-8d33-9308a2c14bc3", "value": "T1F9230271480E8EB125303C76EAD9D793B6E12AB1C5673023D6290A3C6F79B131D5BE49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858606, "uuid": "ab696423-8c54-47a0-a6af-1f5f5b9eac31", "value": "768:S/TYCoIxdEk+AxoTZAZHFeq8b305KO9q3UELbUXfi6nVMQHI4vcGpv6:SECFd+A6YHAxLLRQZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858606, "uuid": "c6616c8a-6ec1-4de9-b0a1-158856a3d0f4", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858606, "uuid": "c75a6cdd-aaee-4e88-aa77-467e581746f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858606, "uuid": "4642ca5e-ba12-4275-92ec-4481e86eba3c", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c35534-67c9-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668834987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668834987, "uuid": "f3f32b1c-beca-4d90-b2b1-f21eb3769e53", "comment": "Malware payload (GCleaner)", "value": "661b2e0eaaa5bd1896b6f55998597cf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668834987, "uuid": "b8cf521f-25a8-4c3d-b1ff-cf19539afe43", "comment": "Malware payload (GCleaner)", "value": "67a6d1b703a63b29450d0bac42198e05c91e85d05d849b2d21cdc89f2e917a08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668834987, "uuid": "1634b7fa-d645-41b8-b743-5910693f2020", "comment": "Malware payload (GCleaner)", "value": "f1a8c9b44460a2f37068fbf6686d007e26aa65c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668834987, "uuid": "2bc1939e-76ae-493e-b484-0f4aaf54474f", "comment": "Malware payload (GCleaner)", "value": "47dbd47895af777523b83667abc365ec7459f29c0cc17e867211b4a5aadeb882a0dccff2f587b880bc4ef7ac22817dc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668834987, "uuid": "8700d18c-9b4b-4ccd-ad7c-62039197b0c8", "value": "T1B3B5EF516A86C2A1C82F1EF4E62134F94DB63D62E82EC27BB7927C0DFE7D7978019441", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668834987, "uuid": "8d1cc67d-8220-496e-b400-4074209363a8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668834987, "uuid": "83969b67-60e6-4cb4-aba5-7e54ef8d7ea0", "value": "49152:q2G6QCDuSQNtEX4E5jSvbZjtAVqkNJFDUxVkBaFwnm:rG6RjQgpZSvMXUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668834987, "uuid": "933e5990-c6a1-4180-a9f4-751f1502aa73", "value": 2365781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668834987, "uuid": "3988f826-4a1d-4a47-b7eb-8613baee0cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668834987, "uuid": "4f2a2911-d83b-4ded-92d3-a52becf1a808", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8deb9d31-67ff-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858281, "uuid": "9ac93774-bfe2-4cd4-94cc-fce6569079dd", "comment": "Malware payload (Mirai)", "value": "97a58356685d574c276c19f01083cef6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858281, "uuid": "0b0b7de7-4ae7-4076-a7fe-b9b708079d96", "comment": "Malware payload (Mirai)", "value": "6a0cb93a28623d6cbdd61d8cd102550d7b9ca2a74c0e0ce990848ee1398a4cb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858281, "uuid": "d3abf588-fc4a-4d2e-a81d-b196f5dc7ca1", "comment": "Malware payload (Mirai)", "value": "e26097238dcecfeb6c524073668565f8cca6ad30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858281, "uuid": "2b3cbfdd-03d6-40be-a1b4-4bf84ebc791f", "comment": "Malware payload (Mirai)", "value": "3769274b331da81c77dc11c00c314153b2b1b91ce3555d1b696e9c091bdca2a9b40e0b8a9809575f77d7baa9e9037adf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858281, "uuid": "7b0e7bc9-cb02-4a54-918e-71d0488a2bbc", "value": "T1C7330851BCC28A17C5D422BBFA2E41CC372663A8D2DF7203DD212F11778A82F0EA7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858281, "uuid": "7715ce18-eb7f-4d0d-af19-3f51a27734d8", "value": "768:qzZ6O+Qi+LPeaz+C3zDzap5buJ/0JnAoPQ4NtCGeirPnt56A86N8aeKjtmRq:jO+QzL5zaLyJclc4N5eirnt5Pfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858281, "uuid": "abf90b00-d31c-4406-9208-f07082313a0e", "value": 51920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858281, "uuid": "ae4f1f5f-96ce-46eb-8513-a6c1f53b3900", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858281, "uuid": "8a375328-c6ae-485b-88c3-0df5b9e0a824", "value": "97a58356685d574c276c19f01083cef6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b417f3e-6832-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668880208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880208, "uuid": "e6c8227d-5547-4b3c-98b1-2870e571c554", "comment": "Malware payload (Mirai)", "value": "3a09957589679497b615d70463ec55f9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880208, "uuid": "c929dd0f-0c63-4c5c-a72b-abc47d575c6c", "comment": "Malware payload (Mirai)", "value": "6a448ee9206f49324cea698f04398a40fb39fc0ccc857d4ece83a35d8cd9085a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880208, "uuid": "74d19984-4624-4fff-8ce7-e10d206c62aa", "comment": "Malware payload (Mirai)", "value": "90aaab9f4513453423369b0c42bc49220a165600", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880208, "uuid": "40cd1329-513e-45e7-832d-aebffaf8be30", "comment": "Malware payload (Mirai)", "value": "7ca01b25364d41ace1d55c54368c7a74527cc72fb8b7533f6e5a2d706d8d5c869febfa227dc17b8c65ab55eba7702e75", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880208, "uuid": "c3fb6667-eaea-4e29-b325-345c9f5b5dd2", "value": "T1B4A2E11576A32D66E3ED1C3CC9AE8357B9661BFCD0B532B639006520C94D24A3E38A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880208, "uuid": "df3e69eb-e4fe-40ec-8bb7-0e0840c6fb30", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjacKhymdGUop5h8:UvQn4j+ZO5fKAlxmcKs3Uoz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668880208, "uuid": "f76b1bb7-6f32-419b-af4c-37285a5e9a6d", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668880208, "uuid": "bdd523e5-1f53-46f6-a179-fd8cd575dc25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880208, "uuid": "dcb3289a-9595-4278-8b9d-9f85ff8eba05", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c6885f-6846-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668888951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888951, "uuid": "65df0b66-3a13-4195-8103-17a8933491bc", "comment": "Malware payload (Smoke Loader)", "value": "b726d93dba1f35fb315e73415235ccca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888951, "uuid": "5bb161df-f778-458c-bea0-568595f266d2", "comment": "Malware payload (Smoke Loader)", "value": "6c4e3e360f4cb7baf8b9585289148521fbd4f05e7b7439e23700fed5edd7cbbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888951, "uuid": "04975790-c660-4b51-a0ab-ee093b60f98c", "comment": "Malware payload (Smoke Loader)", "value": "c92b91407ecd0c483645424a1e6be9e551f9aca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888951, "uuid": "2e916cc8-86de-414f-a823-61a5826ebec1", "comment": "Malware payload (Smoke Loader)", "value": "f9b5cdd9f05217eda3f0ac5e9a948c99f3d47993c27a3154bb947a906ded0641d9159f7c675bab5a841034e6df759fab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888951, "uuid": "106595ec-825b-494f-ba71-4ec67e401a73", "value": "T18864AD10FFD0D0A5C77DC5707A16CFE8567AACA17A24D913B3382B9E5EF02918E62235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888951, "uuid": "1828284b-35d7-449c-9f1c-afe221731dd1", "value": "3a28fc6cbd66b78dccc28e56534d2c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888951, "uuid": "7678eb3b-a5ef-49b6-af17-68b6a455fc41", "value": "6144:ScJHxPozJDbVpKz6cehDb/q1bnyhVVPE+O1voXc:ScHgzJNnNDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668888951, "uuid": "c2f8c4c0-5ca9-4456-86f6-6a003c013411", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668888951, "uuid": "32bebcc2-c6a5-40c3-babc-4d2eae62ee57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888951, "uuid": "34af5eaf-7b5a-4ed0-a9c0-fcaadf55572e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9202561-6801-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668859186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859186, "uuid": "b09a4da3-d8a5-43a7-a95f-d8bcbb39f0b5", "comment": "Malware payload (Mirai)", "value": "b70edbaf6de639fc3b4558ba6593fcd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859186, "uuid": "ebac9ff8-5870-4885-b02c-119ce13bb47e", "comment": "Malware payload (Mirai)", "value": "6d3848287b1a74b46e42e212fd05b09701bfb45f0f1783c59dda942db3a0fdeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859186, "uuid": "ffa309d5-b1e3-4dbe-8840-c8795b68b38e", "comment": "Malware payload (Mirai)", "value": "10e204fcc9a2b7421149b711afa49f9028d761c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859186, "uuid": "a1523f56-ae46-485f-a054-3bc49e22f7a2", "comment": "Malware payload (Mirai)", "value": "99d665ddef58a89010d048a0557b22591d9559e4f866ec334e7be4563a69247ec3977543f91b5b896316acc901b5de74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859186, "uuid": "f4fbb559-3b74-4571-bdeb-f93fd07b9962", "value": "T129E2D0A0EA159497FB7E1DF42DD4C2D337D13D0E3B1E09BA314CA94228276259B146F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859186, "uuid": "0f5da8f3-8780-4acf-aa24-666677478156", "value": "768:Ry8IveM7NVQ5wSDzAs42M+dh2acRniS5UdfIEUI+7f5u4uVcqgw09y:RN8eM7NK5wSDz8+LzcRNIfIrhM4u+qgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859186, "uuid": "7cf4f3fe-1deb-4516-908b-b8ddc374d1a3", "value": 32460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859186, "uuid": "07d160b8-42bc-437d-850e-747b30e96d19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859186, "uuid": "a6b38942-9b98-4e54-92b7-756a0f81eb12", "value": "b70edbaf6de639fc3b4558ba6593fcd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe5b4e6-67bf-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668830870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830870, "uuid": "28d3b264-12a3-43cb-b0a2-61cff9cd8fc9", "comment": "Malware payload (Amadey)", "value": "d162fc0c82665c30829ebe8bc9b6155d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830870, "uuid": "0adc90ff-e10c-45c2-9b2d-5fd1575249ae", "comment": "Malware payload (Amadey)", "value": "6d5eb6f2b3623f10894e49e765564314797782684464bdb9f3599d8140bd7da6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830870, "uuid": "b0505b6f-4b23-497a-b7ef-19bc214ef741", "comment": "Malware payload (Amadey)", "value": "df0896eb352c9ce886dd1da00800a35dd35cb293", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830870, "uuid": "b2ec3e76-d99f-4659-86dd-981cf5f85421", "comment": "Malware payload (Amadey)", "value": "e5f997c84ec0d687d2dff27db7164280eed29cf456165cf196776c233ac658e045319f559178d2882a262faf529c01d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830870, "uuid": "a9909c7b-3a06-4c64-aa0f-c106db97554b", "value": "T16184CF107680F972C5C90571882DFBF56E29BC655F25CAC772B8EF6F2E301D1A5B2282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830870, "uuid": "1e288ece-c43d-464a-b842-5147eb05ef78", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830870, "uuid": "d444532d-0534-4ec8-9fcc-e4c4a6df3265", "value": "6144:+FcBRz0Lmwcmuzuu9WX2Z2XKRXn/sEA/d3h+3oQ9gOU+fzYBb6:7B+lJqkXS2XK9sEh9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668830870, "uuid": "d2483fe8-e34d-49a2-bb61-fd677c3792ab", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668830870, "uuid": "381ed27b-c207-4ad0-a7ce-19a10853404b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830870, "uuid": "6b88a003-140f-4e79-993f-5cd5913f6db0", "value": "d162fc0c82665c30829ebe8bc9b6155d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38b66c9-67cc-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668836520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836520, "uuid": "2f0aeb11-ab1d-4b23-a03f-52359a8ad266", "comment": "Malware payload (Mirai)", "value": "88ceff34018fd4bebbec3722ba83b69a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836520, "uuid": "256ce790-71ad-481b-bacf-f118c09e0867", "comment": "Malware payload (Mirai)", "value": "6d75663ba5620398343348785f1106e8e21a96a3a7f5e7654d5220de70842534", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836520, "uuid": "4317da6e-e49a-45b4-8f78-ab3a5d4ed6b0", "comment": "Malware payload (Mirai)", "value": "c23cc8779ad3c58a647001267139ca63e939d15f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836520, "uuid": "acb183a2-b537-4830-8fa7-8d39f0bbd465", "comment": "Malware payload (Mirai)", "value": "ca2427f0adb5a466a24088c4a72ef56b8faf923d8b5f1d94b341cb826f1dfcd2a7fcdb41392a88c8aca9c35426accbb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836520, "uuid": "7d82048d-fc7a-4282-a2ed-93fb02d3d0f8", "value": "T1C5230271890A8EF124303C76DAD9D79376E126B1C5273013D6180A3C6FA57131E57E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836520, "uuid": "b2ee124f-6f9c-4837-8edb-1cb62a57f958", "value": "768:S/TYCoIxdEk+AxoTZAZHFeq8b3bDB9q3UELbUXfi6nVMQHI4vcGpv6:SECFd+A6YHAxbD0LRQZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668836520, "uuid": "32a220aa-462d-4f1e-b2a8-9c543004bedf", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668836520, "uuid": "db406c14-8a56-406f-9a20-dac0ae1ba1f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836520, "uuid": "5d8490aa-99e0-414c-809b-d5832ce05cb8", "value": "88ceff34018fd4bebbec3722ba83b69a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19655cb-6847-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668889345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889345, "uuid": "549baed2-ccf8-40b0-8acc-49b48750d14f", "comment": "Malware payload", "value": "a26bb2d5b99a73769caed28b418ac220", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889345, "uuid": "fea38901-258c-4741-9586-7c2eac112f64", "comment": "Malware payload", "value": "6e6facc7f1054d6369228713877e4bd7dbd4daa2c153370a1abc3b7c1b548ab2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889345, "uuid": "55837470-8d20-41b5-9431-c32237006b95", "comment": "Malware payload", "value": "4fb2d144a4941828df72cdc76617ce5b38d3229c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889345, "uuid": "c5f13928-de84-4080-9d9d-61d4cb8a82a3", "comment": "Malware payload", "value": "d0901799933294ad594b04a33902bba2d3be9c01c32582db450a9a4d9db42b2d124e61f178265460ab77700f638e3979", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889345, "uuid": "4b33743c-dd34-445e-817f-6abffde7580b", "value": "T15DE401FC36D64E22C998A7F9D4A7272003F6B98765B2E7541ED501C64E40BE18B06BCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889345, "uuid": "96b5a004-e511-45d5-8ac1-2528347807c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889345, "uuid": "897acbaa-e5c3-4f7b-8748-c2cf371518ab", "value": "12288:ljcWLUGAUq0mIyqCWjzUNHqnr98Xitcw9azEmBdFsM5xHKjM3kK8lxAM0OKoR2Ah:j7AU7m9qIcr98SyYaZBdiM5YMy6O8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668889345, "uuid": "5dab3b75-5d86-4681-89aa-41665a41ba99", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668889345, "uuid": "95e6c3f9-b2cf-414f-925c-9bf27a789f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889345, "uuid": "d49eac53-dcf0-4d05-97a2-e4862587479d", "value": "LPG SEMI TRAILER 7 NOS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb03fd40-67f8-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668855377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855377, "uuid": "c21cfb41-d1dd-4e34-bbc4-655fe2686b63", "comment": "Malware payload (Amadey)", "value": "bdfe1f776deae8585a4ac3205393c5bf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855377, "uuid": "0ed80ea3-ade3-4603-96ec-9a8011d12fe1", "comment": "Malware payload (Amadey)", "value": "6e794c4f1fd6fcaa3dee2941d4ea24d217dfeb80181e911a3420b641862ccc45", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855377, "uuid": "07b62cad-9865-44d5-9aa4-9aa9ff58eb0f", "comment": "Malware payload (Amadey)", "value": "3b9b6eaceda2c6638502dcf979ab70ce76418780", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855377, "uuid": "c184c154-b2df-469b-9009-955deddd4453", "comment": "Malware payload (Amadey)", "value": "77aa641b2eb3664639e8242111fa3d08ebd24d5be1337f9e93c6d3035e0ad72910b46e29d5f12b1fc842f0db74971d2f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855377, "uuid": "6e32ab64-e366-4729-958c-f2e468c5d108", "value": "T19184CF3072B1D4B1E1654675C425CAA46AB9E8317E24D9137319FB3F2E30E8C66EE23D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855377, "uuid": "9947ac5f-9a64-4cb2-81bf-e744158de824", "value": "045163335c785d665aeb43938f4d94be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855377, "uuid": "9e825d1d-ee0d-4892-b843-732b781c57d6", "value": "6144:tC6lTvKAMqUjo3+jB1z6zaGD5KI2J5jpPnFwCLLObfwB:XTv5EWgBhI9SxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668855377, "uuid": "403e8fa3-a5b7-4178-9533-c19adff24f37", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668855377, "uuid": "14b1f460-5f35-4019-9ca0-abf6134a5ba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855377, "uuid": "e81102a4-fe82-4f23-93c5-13b4cc69a6c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736fd195-67e5-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668847070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847070, "uuid": "ee77d116-25a5-479d-a6be-61b1e0b1b155", "comment": "Malware payload (Mirai)", "value": "5bb47968d9347006aa410a6dec836770", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847070, "uuid": "ed371283-0467-4510-8334-24e57df44aaa", "comment": "Malware payload (Mirai)", "value": "70a5e7bc7c5d449cb4e7808755e068569ab9f575e888370df6c889b223845cce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847070, "uuid": "8845c42c-22b6-46dd-98e4-69c165241ac7", "comment": "Malware payload (Mirai)", "value": "bfaf18a210834aa4cc4821cf8942cd9a48f402c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847070, "uuid": "735de479-1372-4870-85f9-14d755a03157", "comment": "Malware payload (Mirai)", "value": "33ef6fe742c2b1c232df3f5144ce9a4765e2c77e2985b63b3bbd398419dae690f86133e5185b4d04e4b3f2f1951a035c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847070, "uuid": "d332db8b-85a7-4324-9721-976e3f71ef8a", "value": "T1A0333ADAA802AD7CF98BE6BE80270E09F13123555053073777ABFD937D32164DA16E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847070, "uuid": "a3b1b773-3cd4-4b47-bb01-2b7285072c50", "value": "1536:8M9PgSshZArLXBj4XmFRAEFpolsGJn5S78Z:9PgRhZ01XBX4nwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668847070, "uuid": "3a13d065-3fcb-4c8f-8f5f-460af3b0c97b", "value": 53520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668847070, "uuid": "3c417042-1351-4b83-9abb-c4f2789c97e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847070, "uuid": "24bb4e5e-0746-4a9a-8ce8-a0f6e8d558f7", "value": "5bb47968d9347006aa410a6dec836770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858b23ac-67a1-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668817894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817894, "uuid": "35410dea-d73c-47c5-a123-1082067063ed", "comment": "Malware payload (GCleaner)", "value": "0ff7f9813be914c884445e869ab88d1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817894, "uuid": "5067f5a9-3cf5-4cda-9996-0764ac7232e0", "comment": "Malware payload (GCleaner)", "value": "70b1ac441b927d1d19ec61a59b71ff9c4f8f8a7b43bc32cfc70a19fae9b4689d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817894, "uuid": "097575c5-b77a-46c6-9207-598cab2c6da2", "comment": "Malware payload (GCleaner)", "value": "53af1dad11f94b3192ba035911df23f4e2c57d11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817894, "uuid": "7443f412-a6ad-4ae1-a55b-25b47b08b3e1", "comment": "Malware payload (GCleaner)", "value": "2cd626ba1eef37ed3811205fb4b3540c3366739108e35bf91cc59853fcc62554719da9e647dbd6024faec4067f76901d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817894, "uuid": "1973f2f2-aebf-4904-8ccc-355e5c5f698d", "value": "T18195334BFA68407FC891CE707828849052B5FD272A7D5199979E9CDB6DBFA808F0DF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817894, "uuid": "01c105dd-b89a-4ed8-a239-75869a11748d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817894, "uuid": "0e49f6e6-41a3-4687-a315-d117a2679b3a", "value": "49152:q2G3+NOfJm/tRbV4lQKC5GA6XRaqN2dDg4pLd4yHfRx7Pq2:rmXfJmlRqlQKC5G9XRd+DgKpPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668817894, "uuid": "bf5722fa-12df-44b2-bd74-010e265b32a0", "value": 2052605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668817894, "uuid": "e0ec8e00-ce57-482f-a8ae-b315a38badfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817894, "uuid": "1866cea8-fdc7-4aee-a92e-8d2400eb5239", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91809909-685e-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668899089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899089, "uuid": "1025c5c9-98da-49d5-adec-205ac2575a9e", "comment": "Malware payload (Mirai)", "value": "9b5c434a2467bed52a1141d45b748502", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899089, "uuid": "c878b5f8-06e9-4039-80ca-f0d5727e3e50", "comment": "Malware payload (Mirai)", "value": "714bd82769474bfe05204499528aed1f7f2fb77b435313264b053eb328dd91cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899089, "uuid": "5f57407c-a0ef-4e88-9895-90e5a38ac50d", "comment": "Malware payload (Mirai)", "value": "62b370c86ded55f63abf80c637a80c9e5ec6cdc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899089, "uuid": "ac8c2bf2-8347-4de4-9661-be60aecaa2a8", "comment": "Malware payload (Mirai)", "value": "82729db270980dde821d8d58e7323f476dce818bcf33c2fcc4cf5ad0e76ffc60a88dad74613116de22fd32b0a8541250", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899089, "uuid": "2b5c0f18-982a-47f6-93da-57a23ed8f625", "value": "T1D9230238DB8982A1EAB05072EEB6D1C7672A43BD089736578840BF5C49FBC847375CD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899089, "uuid": "5902aab5-afa2-477a-94d6-40ea5bfa9f83", "value": "768:DJUbVw54dAvOzBSMYt1oYoC++2TFXRK+2AtdAsKoxQjhFXeuQlw9q3UELPY:DQw5+6tHorBK+dtSHeuQl5Lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668899089, "uuid": "04705176-e859-4690-94de-cffb32ea5552", "value": 48260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668899089, "uuid": "88927bc5-1428-486c-899c-0316501af36d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899089, "uuid": "6d952b1a-ea6d-4447-a8a5-3bfd7eeeb917", "value": "9b5c434a2467bed52a1141d45b748502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b9492d-6832-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668880205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880205, "uuid": "4e0b8fe0-e623-4424-892f-7c57b7fb99c2", "comment": "Malware payload (Mirai)", "value": "6cd6f5ebf80367e25d58a8a4124a97ca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880205, "uuid": "feba4341-9f64-43b0-b60d-8e3d565c63a7", "comment": "Malware payload (Mirai)", "value": "7283d557285e6d40c90ca02a4727ebb7c768b60ad646e885e27772eae10e041f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880205, "uuid": "17f78678-a2b8-4c48-940b-6d4926b75cfc", "comment": "Malware payload (Mirai)", "value": "e15bcb9d0febe67c96dea76003a15251b750af26", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880205, "uuid": "5aefe075-cc8e-4da0-ab3e-74f3454fbda5", "comment": "Malware payload (Mirai)", "value": "4c5b0047988e4ca7532b52743ea33a0e613991bcba0f22a3ef2a708b1a2709b505be27d2e5b3fb51b2aab44d5c9fea70", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880205, "uuid": "cb352267-87bf-49f9-969c-9fb5bc7036b8", "value": "T169230271880E9EF125703C72DA95939376E12AB5C5673123C6290A3C2FB57131E57F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880205, "uuid": "906ea4fc-6d82-4a8c-8033-bc2f004193df", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3x9q3UELbUXfi6nVMQHI4vcGpv5:gECFd+A6YHAxkLRQZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668880205, "uuid": "e45971c9-0911-462a-bed5-831fd111e43b", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668880205, "uuid": "e5ad564c-ee7b-4086-9372-37dc26b8b9c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880205, "uuid": "9e49c537-acec-496d-9d3e-2aa7ddf09910", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3f55dd-67d7-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668841073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841073, "uuid": "01acb6c8-3c48-44f7-87c1-a727f7bbfa17", "comment": "Malware payload (Smoke Loader)", "value": "e6e48bb0aebae24e01df78e870e1e35d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841073, "uuid": "da114c60-e2c1-4c3b-bc24-32fb2abadfd5", "comment": "Malware payload (Smoke Loader)", "value": "72b20519bab5379b53af3218c4a6031ae70ae62ae9e4a0fa733d6cebd3f46d83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841073, "uuid": "f7658276-6a2a-4f69-aa25-7820b2c87266", "comment": "Malware payload (Smoke Loader)", "value": "db0dacecbb135db6e3315ee5a26e73a5302c6a14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841073, "uuid": "e12718d2-1754-4cd6-8c95-3880b6f91cd6", "comment": "Malware payload (Smoke Loader)", "value": "246dfa50319dba3b5393f2e97b7aae94907f82d768f663063365e8a0f0ae1bbcfe5aa62c5f62709b0342eced1d60c989", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841073, "uuid": "fea87f43-e968-477c-9ffa-416eefefc10e", "value": "T1FD74BE10B280FE72C5D10571882EEBF5AE69BC519F2596C773B8FE5F2E302D065B2246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841073, "uuid": "8d4d1dd1-2459-4d42-8f40-3b5982e31687", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841073, "uuid": "3d84da72-6593-43a1-a89a-fc01c014d34c", "value": "6144:SPochzqt8hhGstahR8EetAr94+gXh+3oQ9gOU+fzYBb6:5ckWRts9/V9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668841073, "uuid": "3b63d39c-6b21-4f21-bc08-7bc6ff8c2089", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668841073, "uuid": "3ddbdfe3-d5be-449b-86cb-b3a1e3f58f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841073, "uuid": "9bbbdfc1-1c7a-4f64-b328-c86c592db616", "value": "e6e48bb0aebae24e01df78e870e1e35d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc669289-6839-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668883270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883270, "uuid": "44f2ab08-c8fa-4f39-bc64-741b8ad6345d", "comment": "Malware payload", "value": "d7a3c6c8bc99055e21956087cebb6509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883270, "uuid": "273ac9f7-1621-4f9e-9b61-e189ce602f39", "comment": "Malware payload", "value": "72d85576eff8d186fb130c36e684fba044fe07cdef80f007a071b88d563be330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883270, "uuid": "593ae447-ca79-44b5-8bd5-024bd535157f", "comment": "Malware payload", "value": "0656bc5c6f1354410aa0d057b9e13245ba30c8d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883270, "uuid": "8192fa4c-b939-4313-be27-4389ef31aa23", "comment": "Malware payload", "value": "af8281530ec30d8afce9378427988780cc4d763fde08f97cb3e848597299a66c04cb107cfa18624dae21b8eafadfe3f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883270, "uuid": "752b0644-9811-4e79-a353-22b90e933039", "value": "T1D3A33901B2D18472F0B35E3218B59AB15A2DFD318F649EEF2798125E0F641E19E35EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883270, "uuid": "d27eb3b0-9873-4d59-aaff-343afa5f659b", "value": "61d37f3a8b5a155487f5b8475e46e132", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883270, "uuid": "d257fc4b-21d3-41b6-b712-8d503449e70b", "value": "3072:KYXTE1eEZ7z58oZIGDO3Dy+jBUW+wJhT30:KYXo13N4T30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668883270, "uuid": "02fddd5e-2c2c-4eed-a83a-e2f8900f38af", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668883270, "uuid": "4245c32a-470e-4154-8d9b-53073b012544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883270, "uuid": "b9a10476-2ce6-4765-a57a-8ce7608f260e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e549819f-6864-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668901807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901807, "uuid": "10000319-c60f-4bbb-9725-54330a577fb4", "comment": "Malware payload (Mirai)", "value": "a91fdccfb978549c65a7300b80f66bc7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901807, "uuid": "d6d4d125-9ff4-4c6d-8991-e159fc80f016", "comment": "Malware payload (Mirai)", "value": "72ed80399df06dc0e6f9232c9423f7d82a0b02d21fc9724cce175d66fcfdde13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901807, "uuid": "c475a418-c315-4c96-a58e-c5d912dd27e4", "comment": "Malware payload (Mirai)", "value": "e0f1ef9aa06fc790026f57d95b472f46b269d888", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901807, "uuid": "3874708f-eca5-467a-b4e2-bafda5f89adf", "comment": "Malware payload (Mirai)", "value": "b22770494abf4110c17b08c56980b853a2c1a7a8a693a3b07f051d446297d82781685cdddfe1d27329a65c58c7741391", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668901807, "uuid": "3e76332e-a6fe-407c-9840-4c0cee1ef81d", "value": "T1EEA2D019BF1C818BC836297955E9EAD22257FC62F2DCDC192540C15FF0A33A96874F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668901807, "uuid": "7b062c44-5ed4-4d0b-9aac-9eae544c08c4", "value": "384:Mg/Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTG:598o08kxofBE+ZkXaITbp2F2TWul0c56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668901807, "uuid": "0e2ce785-0da4-40e3-89cb-d6c41c47012e", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668901807, "uuid": "16a56c96-3811-40eb-895e-002fa549ed6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668901807, "uuid": "b885cfdf-fc91-442d-8c01-b40ac4e63f52", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da07dec-67da-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1668842282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842282, "uuid": "b7173fff-f213-4470-bb34-9acd0275fe3f", "comment": "Malware payload (Formbook)", "value": "56987c891e7d6900597cdf59ab780d68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842282, "uuid": "4762a24d-f188-4632-8cd7-2d2721515ba7", "comment": "Malware payload (Formbook)", "value": "7364133b920b40a6d5583a6ae12d8f510df7f2f65da5c026bd7c9ffbe3e54e57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842282, "uuid": "dcc21e6a-4781-4903-bd91-18b3a48eb76b", "comment": "Malware payload (Formbook)", "value": "d3f91c6bf901c7dcc8fd3778a1ddb07de172eaf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842282, "uuid": "c74f5fc6-7959-4b42-a0f5-a431e50bd023", "comment": "Malware payload (Formbook)", "value": "30d89c2bdd76d9d4879a1d31c0ef5b009a01a996cb0fc84657c0f8d703041c90bd4865c5b7eaee47522c7b38ce3527cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842282, "uuid": "9fc85b42-8c51-49aa-b977-951b410b56a4", "value": "T1D60559E97893696EE1B8B27D54F1E990CBB34C724EC1AE2441A83DC26D335D3B0519EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842282, "uuid": "cab81ed9-8ea7-459d-b40b-f042b2eb23fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842282, "uuid": "bb99985a-d8fc-4cd8-91eb-dcb87343aea8", "value": "24576:RejZnbCkI3nG3ch9YoSXTotH7E4umvXwxIn/:ojZnbCkI3nrr/SkluUwxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668842282, "uuid": "866a8854-c3c0-46a2-955e-acb19dc6cf28", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668842282, "uuid": "929d8d25-8e7a-4b13-863e-db2376e55136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842282, "uuid": "c82b2444-280b-4648-9158-d223948c8311", "value": "56987c891e7d6900597cdf59ab780d68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1041a960-67cb-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668835736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835736, "uuid": "25e94f42-7070-448c-a725-fd9a756b0ad9", "comment": "Malware payload", "value": "e64e6388511d06f8885610ba490ce5f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835736, "uuid": "263d3c11-ecb2-4f75-b471-be837154e1bc", "comment": "Malware payload", "value": "739a3e0733b75f4d7fcd2bc746422ea269ee8cb04e30fcad6d3b1e1163ececf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835736, "uuid": "f81e48b2-c168-4b3c-b8f4-4c3873482139", "comment": "Malware payload", "value": "a31d2fa27144f43ba8fc4882c9adee3e3d4f319c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835736, "uuid": "e5054490-10fa-49fe-bc10-df3bd1dee8de", "comment": "Malware payload", "value": "b927ff6c393f29131d699dceff4e84d4f9e99d311a2110240a60cf729cf9f11aab3a0b584f64a815cc443217a7222132", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835736, "uuid": "9af763b5-d6d6-43b2-83f0-e46f2ed38a45", "value": "T1E7763359A5457362CEB8C57B4703F6BCD0FD86EA506BF962178008863ADBB2953234B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835736, "uuid": "1e278783-0516-45e2-8d91-e1c43da23b17", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835736, "uuid": "893cd070-1621-4242-a3f1-813aa1e79c83", "value": "196608:fsidsWs3q+PIycIgL2dU1MEF3Y44lpDBO:fsCsWs3jIyPUimWDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668835736, "uuid": "585bba46-e81a-4a10-8e7e-bd93f1fd352f", "value": 7391744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668835736, "uuid": "b41fd585-00d5-4dc9-bab0-201765f78b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835736, "uuid": "1d6bd0d3-0190-4e90-b0b8-6037a6407522", "value": "e64e6388511d06f8885610ba490ce5f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cebb23b-6841-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668886599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668886599, "uuid": "fa29e6a7-0b0b-47c2-a66c-8639a5d99fb8", "comment": "Malware payload (Amadey)", "value": "ea2bb2cbc41de5c9b982e7103d9434f3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668886599, "uuid": "d3e88a3d-1df5-4465-af81-2f29912d9cc9", "comment": "Malware payload (Amadey)", "value": "739ac1294a77faec80688e46f5e88cfa506d45a6aaf2396d1743be0e3019f15a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668886599, "uuid": "c31232a8-fb72-43d6-beeb-1b306112a2a0", "comment": "Malware payload (Amadey)", "value": "496f04e54ad2bbe7431955d43d1edf600ec10cd4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668886599, "uuid": "506fa088-6ed7-4dd9-8c43-0be81a95c936", "comment": "Malware payload (Amadey)", "value": "4f1550991b9bbd94c0b68e4369757544058fec4f83a3624665faaa4b436b5f633d034ad7dcc67845112abe5b8e850eca", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668886599, "uuid": "f0bb6cad-10a2-477e-9ab7-61dbb1ccc5ff", "value": "T1E474CF10FED0C0A9C47DC5707B25CBE95A79BFE17920D91337782A5E2EB02919E22E35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668886599, "uuid": "aba48328-4039-4bf3-9a1f-278e2e4ee606", "value": "3a28fc6cbd66b78dccc28e56534d2c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668886599, "uuid": "dbd1d26f-0f52-48d9-82e9-73cbb1df5856", "value": "6144:x/TH28JSg11s7zUKONR076fK39SV9OOfsyyjaIHNthVVPE+O1voXc:V2QS02vvV6fK39SVfWjaaDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668886599, "uuid": "ba258360-87a1-45e3-9f48-567aae0828af", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668886599, "uuid": "c465c9cd-1ca8-4cc3-9ed3-0d0a6a248dc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668886599, "uuid": "66f2f262-4ba5-48fc-bbb6-42b91e1419e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbe6aac-67d0-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668838285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838285, "uuid": "0f73cf64-5aa7-499c-a06b-32987c1be740", "comment": "Malware payload (Smoke Loader)", "value": "fb7997035464edd2706589e7a8edda87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838285, "uuid": "0a48704b-1d7f-49d8-9a81-a936635f2dde", "comment": "Malware payload (Smoke Loader)", "value": "73a935b8b0fd123138510ce45d11bab4636462265d0b0d93fb946d8c19f80bdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838285, "uuid": "e29984d0-404b-486b-a283-2ec7ca4dc991", "comment": "Malware payload (Smoke Loader)", "value": "b35da69e2fc6343223985fe5e87a22d8d8941c15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838285, "uuid": "e207aff8-2d7d-43d4-a976-b4167ba54839", "comment": "Malware payload (Smoke Loader)", "value": "7f991cef06b5174dff9900359a4621c18363cdd0d62e5a1e3bac69ad6953e1cbf6de535f1f706310f9cdbb56a898b2db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838285, "uuid": "eae606b7-75c8-4563-a743-13a70fec1241", "value": "T1CF74AE907284FE72C4810535782DEBF57E29AC525F368AD733B4EE9F2E302D1A5B2245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838285, "uuid": "9a99a2d5-cc4e-452c-adaa-edf8a3d1ea8a", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838285, "uuid": "5820a2dd-5821-48dc-b5e8-3245dc10bb4d", "value": "6144:Piwu+z5mTeUfsZcYXSRKzbh+3oQ9gOU+fzYBb6:3uSkAZKKz09gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668838285, "uuid": "cbd15431-ef7a-4cf8-a6e6-7007359fbd51", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668838285, "uuid": "e0cc411b-e9c6-4e28-9af0-bd5c4dd1085e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838285, "uuid": "e942309c-d2bd-4267-a5c5-380f51f5b937", "value": "fb7997035464edd2706589e7a8edda87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51df1ee-67ea-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668849408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849408, "uuid": "529af710-c174-4ad6-ab95-f3e814f62392", "comment": "Malware payload (GCleaner)", "value": "b23b0bf9b8ab5940f4fe388545e50067", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849408, "uuid": "058acffc-b93a-431b-9f17-cfb04d5cbc80", "comment": "Malware payload (GCleaner)", "value": "73c1e4ae4ae7a50976349c93917f9b31c8b8cac3efffd3afe360dd9856e02522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849408, "uuid": "cefcd8db-9bc5-480f-bbc3-6add8e038711", "comment": "Malware payload (GCleaner)", "value": "ae72ab3c8a1544799fbe93c2550f78f460f05c86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849408, "uuid": "74132f98-44c8-4eed-bd1d-64a389a03d13", "comment": "Malware payload (GCleaner)", "value": "abbcdfca2f2e6366a0f037c5bc60ef629e2817af5048f1da0b97e845d008e79739d68a1b8ed44d693bd264a2f72adff0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849408, "uuid": "0f89080c-1d25-48bd-bd93-a9450edb709d", "value": "T1E1B5F0516A86C295C82F2DF0E65474F84DBA3E66E86E817BF3963C5DFE7C353940A800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849408, "uuid": "74e8e805-608f-4bf6-b5a0-531029da1bbc", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849408, "uuid": "8f3105f3-c26b-44e8-bc07-f7c5358ea83a", "value": "49152:q2+63ulX1sYS4Y6VryflZ61uAc6moiO77qTrZVjeBsrUxVkBaFwnm:rn4sYtJez6AAzmoJnqr3JrUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668849408, "uuid": "baf84fcd-fd76-4828-a927-2134125c9fe1", "value": 2355494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668849408, "uuid": "9919e6c9-e2c1-4832-bf96-368192ba8ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849408, "uuid": "009a86f0-a3b8-4782-a740-24dce8586c34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13829177-6811-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668865806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865806, "uuid": "b8f7f765-9ffd-42a8-997f-fd43df6d85e6", "comment": "Malware payload (Mirai)", "value": "013f092a5f020434d4fcd40846bcb847", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865806, "uuid": "496ed517-6144-4bb0-a6fe-2a178d7009f3", "comment": "Malware payload (Mirai)", "value": "7434d32d794e46c905ea5403b23efe5f18fa9c25ee717299e7f123977b0897fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865806, "uuid": "19f0df00-0257-498f-b389-57d956c37726", "comment": "Malware payload (Mirai)", "value": "8a0e1ca20cd5dfbc82d34977ea00f65b44a3a95b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865806, "uuid": "85249d86-4326-4b10-a0ce-b0ff1b09be27", "comment": "Malware payload (Mirai)", "value": "07c229df23a4676caa12e089308c259030d7a98fa3f8db2b0529134c49b56265f76fa53bd0f1d4cc8037778a3fc5d15e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668865806, "uuid": "1447cbea-7624-47c8-97c3-1cba703240cd", "value": "T1C163029263327A11F88A7C70F605AACBF91416BB9F7E78161076E97C9C2C8057DB45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668865806, "uuid": "2276c333-ee91-4dec-b0ef-66dcfd045cae", "value": "1536:01MGLy20luXm1Cmo/5UTmeDAhYFdXdCLVCRoXa3b689mMS:01lXaCmoxU0LcowdYMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668865806, "uuid": "8b99df96-0d3f-40ab-ac44-77df8dde5ce2", "value": 67344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668865806, "uuid": "cd0f1b4a-5b8a-4187-bb13-673d81c2b4a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668865806, "uuid": "921c4007-1ccd-431b-83e1-b57149041308", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60e15df-6864-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668901808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901808, "uuid": "0293a003-3ab2-4ca4-9497-1ef6c3b882f6", "comment": "Malware payload (Mirai)", "value": "4ec04339eaae40d689d76e859d0c37a7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901808, "uuid": "5d33dfe7-8196-41c9-ba7b-56af79ecac63", "comment": "Malware payload (Mirai)", "value": "74b94ae6ead26262859a7d94a26e7c6a955975e8b527c35c3270c45201cd6004", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901808, "uuid": "e7f78ff4-c7d2-45ab-b198-f2de852d13b9", "comment": "Malware payload (Mirai)", "value": "f8b336741a0b2bcb29bd36edfa87b67981ebf7d7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901808, "uuid": "151b62c3-a95c-4cb2-9d9f-aa71260bf4be", "comment": "Malware payload (Mirai)", "value": "e7d470b90ad49c8bae0106f76b1502f9f6069e6cc2a8a769137468adc1777f05c15f17bab58ed17e82e946a5fa440db8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668901808, "uuid": "bfa50329-2201-404d-92b1-882f90deee29", "value": "T135A2E01072632D66F3ED1C3CC96AC357B9670BFC90F6327A69411520C94D24A3E3CA4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668901808, "uuid": "bf955314-766e-4992-baeb-bca17c30a51e", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj8vehymdGUop5hc:vvQn4j+ZO5fKAlxAves3Uozm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668901808, "uuid": "ea22a555-2efe-482f-8d42-d78eb67dd604", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668901808, "uuid": "b175344c-5668-4f43-a2ba-380ef43afc8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668901808, "uuid": "8d4bb3dd-261d-4988-9ac3-fce6f1744b67", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea593c5-67f7-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668855007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855007, "uuid": "4b891ab3-a466-485e-bf02-51598930c81b", "comment": "Malware payload (Mirai)", "value": "d4277c08477910df4c93f71fbd1269ae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855007, "uuid": "d9938aa7-dea8-4bb8-8bdc-279661c87f30", "comment": "Malware payload (Mirai)", "value": "74e1240d2af9a5f98cd30958743ab9a4139dfb677419fa78398ddb6c5ee00e33", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855007, "uuid": "4f6512cd-7360-4e6a-a282-bb5fb5463f9f", "comment": "Malware payload (Mirai)", "value": "83651a2917f0aa541f1937be692798bb7ebb8df9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855007, "uuid": "20b739a9-c3d1-4bfc-9e0d-c1127d94b2fc", "comment": "Malware payload (Mirai)", "value": "aceb400105989221e23583c09915bb96f2d9519398eb9a6a2bd4478e441387e0cfb64bf7059aad77fcac6575357daf42", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855007, "uuid": "0422baef-f7bf-4aba-bf9b-5769540dd6e1", "value": "T134230271890E9EB125303C36DBD5D793B5E12AB1C6673023D6280A3C6FB9B131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855007, "uuid": "3b6839bc-0333-4f8f-8665-bcfc9e6ac0d5", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3h39q3UELbUXfi6nVMQHI4vcGpv3d:DECFd+A6YHAxoLRQZ3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668855007, "uuid": "fb65a84f-1b09-4a23-98b2-22b90a0a20fc", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668855007, "uuid": "643609fa-ea47-46cd-b1ca-dc5d4d203e57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855007, "uuid": "1d2329eb-ff04-4a69-9e6f-031fb13024db", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a317e9d-67d1-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668838303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838303, "uuid": "126f52b5-177d-45b9-9a0a-786b97b41d61", "comment": "Malware payload (Smoke Loader)", "value": "7659911cf4e893e9f5b6fd7491321a73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838303, "uuid": "689176ca-65df-4f81-95bd-e368d526e2f5", "comment": "Malware payload (Smoke Loader)", "value": "7520daeba068db2bb6d97eab6ef97c682f820c3a58ff5d2f48efa80326bfec4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838303, "uuid": "ee50060d-f3b2-445b-b1e2-c49ce6a1816c", "comment": "Malware payload (Smoke Loader)", "value": "185a6c3c6c0fdb8cad08e6eddd80ae65fb47d4da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838303, "uuid": "289ba9d3-f1fd-4676-b475-dbc43c493a2a", "comment": "Malware payload (Smoke Loader)", "value": "bc8b1d60ec016806a79d636f41fa14453a7f4b9b15280e8e140849bfd29812486285e2f23c3fe199d7aed3d60d4c212f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838303, "uuid": "5d25bc7e-205e-4ed1-9144-a29933024dcf", "value": "T18B74AE013684FA72C4D385719929EBF1AE29BC515F2589CF37B8EF5F2E302D0A5B2205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838303, "uuid": "e8d2762e-2858-490b-9666-d968313e55a1", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838303, "uuid": "06a5860e-548a-4ab2-a2cb-555632484c42", "value": "6144:P+CwdmzzY/SaV5mBRdUTHzFagPRoZGTh+3oQ9gOU+fzYBb6:umYaaDIPIQEAl9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668838303, "uuid": "f66f69e9-989e-4d24-b5c5-5d6308f103ac", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668838303, "uuid": "255f6035-b411-49d5-a7c1-5f8aaeba79ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838303, "uuid": "cdcf26c4-c5b9-421a-8808-f521021026a5", "value": "7659911cf4e893e9f5b6fd7491321a73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec32911-67ff-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668858094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858094, "uuid": "2e4fc79d-f96b-49d1-a1e9-6c80f21dd45c", "comment": "Malware payload (Smoke Loader)", "value": "d50a195272725f68dda1a46e36bf6c01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858094, "uuid": "96934e94-dff9-4aab-9123-f56eee357c20", "comment": "Malware payload (Smoke Loader)", "value": "75816468d381b92dd3ee2a5b86e64b8903ebec5459dae65f034dcc268e3fe48e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858094, "uuid": "ee2f46f6-9b18-4109-9340-1fd25ee5fb6d", "comment": "Malware payload (Smoke Loader)", "value": "ad4e14e5bdeaba019381e2a462c4e2d27fd65601", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858094, "uuid": "9663730d-2209-4f6d-b053-bb26c86df425", "comment": "Malware payload (Smoke Loader)", "value": "9b9abf0580cc489f139d0a214e6ef2be99549a34217cc4fab699f780ae6edf928a6715bc9b8ca0e9f3f6906619a04177", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858094, "uuid": "f464e32d-63b4-4b07-960d-c624ac36b2db", "value": "T1A574CF3472B0C8B2E1650A70C835CBA425B9FC217924D6437758FF7F6E30A9C96AE275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858094, "uuid": "67b7d78d-ed3f-43e8-b7ad-eb25dedf039f", "value": "045163335c785d665aeb43938f4d94be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858094, "uuid": "62f156e2-5704-4fae-bc42-7a17902d27c6", "value": "6144:xqYac7y9PxjHiP+VdGA5jpPnFwCLLObfwB:laRxjH1xqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858094, "uuid": "d885b002-4e69-4f9e-a5b5-107867a9f19c", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858094, "uuid": "57120453-e14a-49ad-834c-62b1a11e245a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858094, "uuid": "045060c6-7056-4e13-868d-3e41512492bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd9dc2a-6811-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1668866117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668866117, "uuid": "08c3dc25-59bc-4e58-a25d-5263bc8fb647", "comment": "Malware payload (DCRat)", "value": "8c19b5f14f97f3c5ebe3a098ed203748", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668866117, "uuid": "92949be1-5d59-4c75-9f43-2e4314d50657", "comment": "Malware payload (DCRat)", "value": "75ecc4b9579316d02067ec556447316f5340ee814b1632c3ae5aa8ea9d93d31f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668866117, "uuid": "b951af28-5011-4206-9512-9adc7191d4c8", "comment": "Malware payload (DCRat)", "value": "bff6c93410e1015569871b10c13c8576dc6f0ca3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668866117, "uuid": "f005c1d0-b866-4cda-bc16-8d0cccd956a3", "comment": "Malware payload (DCRat)", "value": "4ed54fb01ebd8a89c6b0e4bd2f2ae81e61b00c30bdc35ec341c44a6bb2d455fee9ddb549eee30e1e03fd90e7fcbebf5d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668866117, "uuid": "78a832e2-31a4-4ab2-8236-79b70b93b554", "value": "T162657C017E44CE11F0189233C2EF496847B099516AA6E32BBDBB777E65123A73C1D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668866117, "uuid": "a67ab899-ab8f-460f-95f6-3d5513f470da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668866117, "uuid": "6d55af13-2716-4229-8b43-27c99033da90", "value": "24576:Q7GNSCYRvvKceCKVYb2A8qVj0aQK2BY+KW/U9jyy3wp1Xn:eGACsvF1jJ2K+MAM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668866117, "uuid": "44c0d7ad-b342-4784-abc7-17df91f7ae91", "value": 1415680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668866117, "uuid": "818b17d8-8afc-44b9-987e-b15b69df0eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668866117, "uuid": "02063018-dcd5-453f-a451-4979a96de942", "value": "75ECC4B9579316D02067EC556447316F5340EE814B163.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8282ad3a-685c-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668898205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898205, "uuid": "32965db0-cfe5-497f-9f22-f82380e5a54a", "comment": "Malware payload (Mirai)", "value": "75892527c35dfb0efec4a2c192446ae4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898205, "uuid": "b2e9ec20-2a29-48a3-8aa3-aec29ddb1b62", "comment": "Malware payload (Mirai)", "value": "76836142b51614b2886fceb898a6eab3777dbb2710e388fc38c756725e6a22c9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898205, "uuid": "65a60ca9-39f9-454b-bb1c-e5dce2dd3578", "comment": "Malware payload (Mirai)", "value": "50514174e05ef9f4f56ae84e4e1208b507c0d0d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898205, "uuid": "2bfd8a8e-853a-4252-a568-ef78070c1538", "comment": "Malware payload (Mirai)", "value": "0ae4504861a726b9096ae2287780b2caf292b2a940563a41bed400c395ac4c562e5c4cf198e218b8775b6274280ba71f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898205, "uuid": "32ea471e-8c16-4aae-a3c9-c290f007ee52", "value": "T12E6302FEA95494B388C30836B0B0C5C115618B68D5B9FBBA6A440F1CBAC14157BBB8DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898205, "uuid": "4f779804-514e-4d4d-83e1-9b38cc67ac98", "value": "1536:/6TMY1bGxizQlMSonK8f3ZWZ8qlqeOwMSbvLQ9RnP13GSiCrEZ0Rr:y1bGxiwMSSfDwfvLQ9x95d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668898205, "uuid": "833dfb0d-79f0-49f7-b8fd-f35e1d6657c4", "value": 70716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668898205, "uuid": "c0b254f0-2bb0-4a8d-9133-42518d5161c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898205, "uuid": "84556a38-7196-4f18-9d66-b10e1a761f37", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0cfbfe-6843-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668887406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887406, "uuid": "6d4380b1-bdcb-4e0f-80c0-73e15341a283", "comment": "Malware payload (Mirai)", "value": "e671255e92bcd755f1a4ce93809037ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887406, "uuid": "a9a585f1-83b2-4bed-884d-8b197e05dca1", "comment": "Malware payload (Mirai)", "value": "7734d7c453484f1fdb903bb781e720bbd72b942ac0b1e99bd4ff2c125f932150", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887406, "uuid": "45b57c60-2fbe-4618-b025-4852f52be8ea", "comment": "Malware payload (Mirai)", "value": "11796695d0e1d1e92e3318e27e1ebb1249a93db1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887406, "uuid": "312aaa16-1da0-4361-8c37-7ef632a10617", "comment": "Malware payload (Mirai)", "value": "5d637189e4c6adf6d8a828b4f25d7225250fba5bb980d215ab631796bead9857b2b77f3e79855dc70ab109aae196f7c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668887406, "uuid": "ebaa1aa7-74c3-4eaa-b467-d85fdd81e7c4", "value": "T19B230273BAADFF71F032F263F88569106B4F3E64A1CB1851531126143CE950A9F24EAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668887406, "uuid": "c22eb837-5013-4add-a6b9-101b71a5668a", "value": "768:99eE6TDetrZhuNmBbFLdbqHlZTIYTQYrKJu9c89q3UELB96k8Okrcd3BhAEG6:bADIfmb52JugLGk8Okr4vG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668887406, "uuid": "36391ac5-e9cf-49c5-967f-6db6f9f66dfb", "value": 46272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668887406, "uuid": "8c6c1e40-b0f3-4f4c-a7eb-ddc8f0f66346", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668887406, "uuid": "770c2d9f-ede7-45cd-8f06-cd28076a2756", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b9c83b-67e0-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668844904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844904, "uuid": "90421d8f-2eb0-4ae9-9ab0-98b9ba41e8ca", "comment": "Malware payload (GCleaner)", "value": "b34526324208bdd9683adfd3ba71a5b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844904, "uuid": "25d85810-4e65-4ff7-953a-144b4f7d1c14", "comment": "Malware payload (GCleaner)", "value": "77ba2f9b3fa14a81669bca6dbc53baf7feec9d60fb83bee58a187c75e513d174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844904, "uuid": "9df8d7e8-f2c3-4b9c-b818-a17563da1c8c", "comment": "Malware payload (GCleaner)", "value": "9d5787f328f3a3a3312bae32a076f8ad8b0a3939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844904, "uuid": "0d366e4e-9ebb-4e08-ad5d-2a9002ba78b9", "comment": "Malware payload (GCleaner)", "value": "ff9555f7f0c055eb91a787e9fe72603ef5c263133ba11d7175bf5b62d455039263689e2d18c59e2a5406a53f10a4fb11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844904, "uuid": "7508a396-8702-47a5-9559-9266d6c95fc0", "value": "T1A0B5EF116A96C291C82F2DB4E52470F85CB63D62E92EC27BF3823C5DFE7D797901A841", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844904, "uuid": "fae02c2d-4819-4be3-9df2-c1aa7aaa2e7d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844904, "uuid": "5d928011-52bd-49f5-9614-5c145282e8f7", "value": "49152:q2Yg0pWyWH7azpn58kC7KXhxB9LLZlYUxVkBaFwnm:rYg0pWyG7aVKkCChxXtlYUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668844904, "uuid": "20711551-55ee-409d-b54b-9ea827a3e3c5", "value": 2361918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668844904, "uuid": "96fe7b7c-b8ec-4956-8cbb-f658c8e3bb4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844904, "uuid": "2c295d09-d963-42fa-b683-733c8a672dcc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd94f81-6800-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "2786fe3f-7c61-49a8-882c-2eb9501af24c", "comment": "Malware payload (Mirai)", "value": "75766d51a8609b8ad7ea30b29176d02a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "81babac3-c850-43e6-8697-429eeb303523", "comment": "Malware payload (Mirai)", "value": "77fd233e1e7686766ee50dbaa925d03ffb3929caffdd1ea510c2466597bf88e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "acf36da7-7b29-4ee1-8557-afa1c15c4507", "comment": "Malware payload (Mirai)", "value": "0f35114ffd7890a387c2d2180ea0ee46eaa91c9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "4093c39c-df5a-4f8b-9bbf-660f39e9e84e", "comment": "Malware payload (Mirai)", "value": "529734bce05092f0e0b02a981e22e443f917d1867a98ed75ce123e3edfd4cdf8523efd627f4f50dec9fb68e8ddc13a60", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858606, "uuid": "f8554775-71aa-477e-8cf8-a57689fdfc76", "value": "T1DEC33B46E6818B13C4D61775B6EF42453323A79593DB73069928AFF43F827AF0E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858606, "uuid": "cabe34fa-dde5-482c-9254-20e2153c177b", "value": "3072:AQO3WqAUOKMoMuPGYlqqiaoH+EuNM/9cE:AQO3DXMoMuPzQqYH+E4M/9cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858606, "uuid": "9b5f52d2-469e-4f43-a256-2538b4d92590", "value": 120446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858606, "uuid": "ca7bc0a7-0e41-4c51-be50-3c229c070e82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858606, "uuid": "204545f7-3302-469a-8e26-4989f8ffe966", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7987bbcb-6857-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668896042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896042, "uuid": "3f997df9-89f3-41e4-9778-a0ffe2dfa36b", "comment": "Malware payload (Mirai)", "value": "903ca120be0ca02006249da9efbd5df7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896042, "uuid": "2d8bc5ae-f833-45e2-af03-d0792ada2598", "comment": "Malware payload (Mirai)", "value": "78e40e22cdb42d45b82e4b0a17294f9fb51d3c065c83fd4f48bdb415c5968785", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896042, "uuid": "57a4199d-2efc-47f3-8a71-277af760800d", "comment": "Malware payload (Mirai)", "value": "f1ccea77593157703586ed86eb5b2ee9c9190102", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896042, "uuid": "cc21da79-d67b-4495-b33c-1f2321d8eee2", "comment": "Malware payload (Mirai)", "value": "2fd984ea0b7181bfe25ec0c7e8cffe334a9c5a5744a42045d30702820be4ba42e15cd5a6449bc69b3b4bfbe8d1a8c80f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896042, "uuid": "28bad87c-4f2d-440f-8ef0-b676913fbca1", "value": "T1A533FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896042, "uuid": "6f8195a0-0c99-47c8-97d9-3c5060b7aeeb", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGJ:r/hqaJMeteqK806MHdkfQX6HuCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668896042, "uuid": "a7216637-3ab8-4997-9543-10e461230835", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668896042, "uuid": "6511b989-d2e2-4646-92d7-eed66102e5a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896042, "uuid": "467976a0-36b1-4263-affa-51511eb3ac24", "value": "903ca120be0ca02006249da9efbd5df7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785e6636-683c-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668884444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668884444, "uuid": "cdfc0063-4b1f-43c3-a4a8-fc1b29635318", "comment": "Malware payload (GCleaner)", "value": "e5fc3b1d19746b21b932e38ee09456cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668884444, "uuid": "8cd644ec-737d-4e53-ac6f-c7af9355dea3", "comment": "Malware payload (GCleaner)", "value": "7911b18a7d8f4379e0d7eb6aae915461d2b3d2b97f58570b3f1074f1f2dde3d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668884444, "uuid": "80c3583a-47a5-4091-8cf4-71271f0f6962", "comment": "Malware payload (GCleaner)", "value": "ce47d3092ab356625654f95e562acba4aa5b83fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668884444, "uuid": "a94b40ad-2425-44c1-9c78-acbb5dedb82c", "comment": "Malware payload (GCleaner)", "value": "50ba4d3a4e42d2f4aa2d6fcddaad507f72e99f0f0c288f9fa4829b0e0a306008a293626c214aec8cdfcbfe7492151786", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668884444, "uuid": "217d2438-341a-4098-bef0-fd399c75e1b1", "value": "T1BDB5F0526A56C2A1C92F6DF4E61070F84DBA3D62E82E823BF3967C1DFE7D3438019951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668884444, "uuid": "4a2fbffb-ee9f-477f-8d47-2b40914d3116", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668884444, "uuid": "97d43a44-b616-425b-a272-fcbcced2a47a", "value": "49152:q2TT+ujl4zlUWFgn331xr+dLckVsVvCLQHWVGHUxVkBaFwnm:r3+ujSmWFm331ms8FV4UxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668884444, "uuid": "6f25b8ee-2917-448b-bd53-f386be289486", "value": 2378131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668884444, "uuid": "03c99577-649c-4570-804d-d6d360159e90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668884444, "uuid": "ecf52c63-b887-480b-a9cb-577056aa2de9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a37b7db-67ca-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668835511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835511, "uuid": "40319ed5-8639-4353-81bc-903eb873beb8", "comment": "Malware payload (Amadey)", "value": "865e2914bea0bd96d0d925a00303cf2d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835511, "uuid": "b15b17d5-2726-4148-8a45-21a855c91228", "comment": "Malware payload (Amadey)", "value": "7927a11b95cb1fe76f0bf51674d73ef725dd763044f61c72cc0d0ecab2642068", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835511, "uuid": "df4dbe3e-ca80-40d9-95f4-eb2ccf0f4b8a", "comment": "Malware payload (Amadey)", "value": "17d704e9fde2eb38edb6cd0857b2aa711db095a1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835511, "uuid": "fa858ca3-bece-4178-8734-68300298ad9f", "comment": "Malware payload (Amadey)", "value": "f374a203c9a74336ee8f4a6f139e457086be3d0c7459d09fcd23fdb25cd3373bfcc7d390561e292297c7f91857b0ab15", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835511, "uuid": "3e49d0d9-e150-4ccd-92bc-84904b59040e", "value": "T17B74BE107281FD72C4910771892DEBF5AEB9BC615FE586C772B8EE6F2D302D0A5B2205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835511, "uuid": "0d2ea90e-3ca4-4d65-a42d-f8dd93dbce33", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835511, "uuid": "dfe9e5e8-bbb7-4364-881d-578e8cdc7497", "value": "6144:TBS0kKzNqQ4Bqv3hmtBdwUYrBGomh+3oQ9gOU+fzYBb6:dkqX4BauXZyBb9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668835511, "uuid": "bb7d4ffd-c5fb-494b-a350-36ca7870c00b", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668835511, "uuid": "c85cd23b-2180-4be9-959e-29c8abf09a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835511, "uuid": "85c74b2a-a359-4d3f-ad93-3703bf04e0b3", "value": "865e2914bea0bd96d0d925a00303cf2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9381a5e7-6801-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668859149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859149, "uuid": "83b164ac-982d-4a8d-b6d9-cc26a1e97df6", "comment": "Malware payload (Mirai)", "value": "0c205c0d5a8302a2770a0e8af51a9422", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859149, "uuid": "e14f898e-2976-4082-9375-0e46ef7676bb", "comment": "Malware payload (Mirai)", "value": "79728cee573470d00a6bc2793a12c08e035b75cf6f73a3d554bd6849bd1f228b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859149, "uuid": "4687d37c-e4d0-4e30-8664-26937860603c", "comment": "Malware payload (Mirai)", "value": "81c536e8ba3dcdd0a37a172e20c4862329fd7194", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859149, "uuid": "35b7542e-8b9a-4abb-a3cc-b5497b3004aa", "comment": "Malware payload (Mirai)", "value": "afbe32fb7fa7bc2429a59b16f517964ca5fe8a84769e6fc29a078dbcd87fc97ebddeabcef8910395eebaf52007f4b2b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859149, "uuid": "612ccd59-a6cd-4280-9686-b9547cc2eb80", "value": "T171336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859149, "uuid": "bfb2f78f-1e0f-4dcc-a248-8190b809fe59", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859149, "uuid": "255a2f9e-36b8-4f65-8e11-2bbba1aa3626", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859149, "uuid": "51ae44a3-3564-4387-bd47-14849b9079a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859149, "uuid": "92bb9167-500a-4845-a886-22063483a886", "value": "0c205c0d5a8302a2770a0e8af51a9422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f08137-685e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668899103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899103, "uuid": "aaa8980a-2f91-41a0-99fd-39b50d893610", "comment": "Malware payload", "value": "ca35b8329c5ddd2fe58f0d369fdf766c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899103, "uuid": "1283694b-8ecc-4790-b910-11279de356c9", "comment": "Malware payload", "value": "799c0a4b999970a5e667c1a4de283576672d4d6a2316d2f434188546e6c1d4d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899103, "uuid": "2c55d2b7-d1d0-4de4-87a3-2cc6348110f8", "comment": "Malware payload", "value": "81f05d42be1951a25122e44e92dd04c255c9c644", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899103, "uuid": "93b1d91d-9fbf-44a2-9ef3-6950ff458ef9", "comment": "Malware payload", "value": "3a9806f42c3dfe219b92cfd508442efef5f15cb8bc2bec84f36e06e36d29147af0fb96ed9b4834136181134db502d7ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899103, "uuid": "7121fa1c-9b05-432a-8391-9204bfe6a93a", "value": "T1CFF1EA05BBD84669DBAE473504B743150732B727A633CB9F18CC526D1CA36980B427EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899103, "uuid": "77e9a896-aae0-4b46-8e2b-ba0fdc2ab931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899103, "uuid": "79dcfbe3-96b8-423a-b21b-296b5b78a901", "value": "96:Y8M4co5EAspdZYHmLG5rUVAVZB/uxOAyKXYHzhlVnme9qw4cKsP0M:YXo5ELtYHmLGeCP/ZIYTJnme9qwFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668899103, "uuid": "d079464b-9ef1-415a-97ea-f3838ab87c1f", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668899103, "uuid": "259cc68a-99fa-46fc-a424-e7f7dd8094ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899103, "uuid": "8c144144-c1f8-4639-a7b3-e2aaeba9dbcc", "value": "ca35b8329c5ddd2fe58f0d369fdf766c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3201a87f-67da-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1668842235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842235, "uuid": "e14e0bb0-5acd-409d-bfa4-b50fd8cee7a0", "comment": "Malware payload (Formbook)", "value": "21ea7861c5449f805634cba1f6f8a1e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842235, "uuid": "ea55831b-6646-4c2a-8095-de11651eebea", "comment": "Malware payload (Formbook)", "value": "7a138c0817c092320a3d6b499429b44063ba82f3caf4ef1517c554d4d0c4bc42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842235, "uuid": "d28211f3-31cd-4ee1-be01-5c703651bf9a", "comment": "Malware payload (Formbook)", "value": "55a8cf6ca679ed89ba6a0819210759d68549a986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842235, "uuid": "df62675f-70c0-4eff-8623-5f55481813c0", "comment": "Malware payload (Formbook)", "value": "8a3bff66650681cab7f61c703da7cadc90a0ba1f221731d2197d7a2e484873fa634847d322a131220142eeebff2cba74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842235, "uuid": "65ac1b62-cd6c-414f-bd3d-cdcd472e4d44", "value": "T174A4CF69F3B19CA1E417817E887AE9351137EE9A5527090E338E362D49733C350A7F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842235, "uuid": "809d32a2-261a-47a6-9314-acd64b58ce02", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842235, "uuid": "c948bf4d-6f59-4af5-893e-21272ae4ca82", "value": "6144:+Ea0PnsCFVCIy7MHAFc0Bbo2q8LJAjgLh49ryDcihfvV+DEMzb/nify/RK:rnsxIKB5+UJA0uIDcihfUEMfIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668842235, "uuid": "0d27160a-a3d1-4230-9755-d289339e7a80", "value": 454052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668842235, "uuid": "089be9d4-88a6-40e4-b321-f96cd8145feb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842235, "uuid": "0dfa68c5-8802-460f-96f1-c2ee5c41e6a8", "value": "21ea7861c5449f805634cba1f6f8a1e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ea5e9b-6854-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668894605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894605, "uuid": "a861df93-55a3-48ac-a130-a1d26b44efb0", "comment": "Malware payload (Mirai)", "value": "12416f7275a66047deaa3adbd08e5c68", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894605, "uuid": "bd8ed1ff-48f1-4b1b-8389-f6a0d3cf4109", "comment": "Malware payload (Mirai)", "value": "7b595bed7eae8af8229da172448711340ea1c75169af623f4fd93a213b3637a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894605, "uuid": "cf615e98-74e4-40c7-834c-64ed5a39b63e", "comment": "Malware payload (Mirai)", "value": "3a842c31897d5f415baba782bd2d1574e71206a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894605, "uuid": "9546673d-69bf-420d-b99f-ec407a280984", "comment": "Malware payload (Mirai)", "value": "5439afe53d7611058465e9823dd9fbf33baecacd25868f2501bf02217397bb70bff7006f0f5e608c271eb50d77bf9923", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894605, "uuid": "9d2fa3c3-8dd7-4a4e-af21-6d9af08691f6", "value": "T179230271480B9EB154303C72DBDA9793B6E12AB1C6673013D6190E382FB57131E5BE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894605, "uuid": "aa46667c-9d0e-4d86-938f-fafc678997cb", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3JRO9q3UELbUXfi6nVMQHI4vcGpvx:gECFd+A6YHAx/LRQZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668894605, "uuid": "ccd7f4a4-b126-47fc-b22d-c9bfca192507", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668894605, "uuid": "95de553e-4550-4d53-8678-90d776b4e5db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894605, "uuid": "425227b5-8fc1-4b69-8de4-d3e2e1340147", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acf460a-67cb-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1668835781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835781, "uuid": "2b9f2fbf-3492-43fb-af16-fb7600adcaf0", "comment": "Malware payload (CoinMiner)", "value": "9f7b501477c04a4d115df4e748660a0a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835781, "uuid": "357e9007-cd5c-4935-bff9-cc8c67d0719d", "comment": "Malware payload (CoinMiner)", "value": "7bcab7072dac6fce4e62ac27752d38f817183db6a5ab1fbf0717a7adc400de7b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835781, "uuid": "2c80e4ca-66fd-4cca-96dc-5e0ed5cc11b9", "comment": "Malware payload (CoinMiner)", "value": "0019cda61426de0e2f1f0a6881d0c4db7e00c9ed", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835781, "uuid": "eb32da90-36ff-4d58-8497-1af0e3ac0261", "comment": "Malware payload (CoinMiner)", "value": "86ccd153d9388994cebd41afbbf88beee23078d433dea840eeab138822ba345a4309d0fa4d495abfab0206e5ed7cdc38", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835781, "uuid": "e920ad8e-3a97-4295-a763-375281aa4d7f", "value": "T1B8A5239123F109AFC32E4534C2BDC17206B1784334BE59499A70CC793EB99FD2B9A4E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835781, "uuid": "c3c25ce5-c088-4094-80a2-9b0765a7b81f", "value": "c24ea937b2b0d62e829e8a8faeff5a8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835781, "uuid": "e3d561f7-15ea-4214-a1d3-ea0fd20622d4", "value": "49152:4ldnGPsSiywQC7W7C6vgGqsyAyETtlcQJpvnCny/DtOmqNp/lltmgq0+uOP6Kbz:47GUHynkWm6vPygtlcQJdCyhdap/lqbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668835781, "uuid": "e05cdd49-d192-4d56-b114-c41fdc27561e", "value": 2158592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668835781, "uuid": "51b8b6c2-d320-4a9c-a6cf-19ee3e14f60f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835781, "uuid": "6fea4148-c842-454b-85bc-2303378a6063", "value": "9f7b501477c04a4d115df4e748660a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b655fdea-67c2-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1668832149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668832149, "uuid": "7285690e-5305-47ea-87f6-b48e5d4f32a2", "comment": "Malware payload (RemcosRAT)", "value": "a5d90c7d3e393ee48132480fca1532cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668832149, "uuid": "5f9d7d42-3fe3-4418-bccc-020cf0a6c70a", "comment": "Malware payload (RemcosRAT)", "value": "7bd46b7c65926d301ef6d867258e13c68e9f6c8fc721cc541cf084aa0df47133", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668832149, "uuid": "184ae5f1-01cd-4cea-b5a9-22b35244d013", "comment": "Malware payload (RemcosRAT)", "value": "7c533f9f322a6efd50de5e1c3551571eccf0f408", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668832149, "uuid": "88edc64c-cfe9-41a5-81b4-5a2bf67c3383", "comment": "Malware payload (RemcosRAT)", "value": "32a00b9cfa375ae59c74333e3450e88eab80bd5850dab80ff9156a500e7deddf237786d0d4da690e1f189bb457746260", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668832149, "uuid": "ca1e7eb5-90fa-43e1-9daf-1d7645b74b11", "value": "T1FEB53928A5195F12819D72EF77F9A08B08D2B9B5C08B401FE6F64F4DF688B345A9CD4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668832149, "uuid": "2cce39c2-28c7-4dc6-979d-5a13558dbcd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668832149, "uuid": "b8e657a9-2f1f-4111-bd43-09c1a13c8d98", "value": "49152:8Uscf2YXnRNaqzu2yghkAwwpLTKrRMVl4pVYW17x:K8LD7pXWMTy17x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668832149, "uuid": "b4969cdd-7616-44dd-a7fa-683669bf87e8", "value": 2427392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668832149, "uuid": "049047cf-20a9-4e8b-b81e-6e658f83b2de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668832149, "uuid": "ba4918a1-3ef6-4ec9-96a2-252a71c69c7d", "value": "a5d90c7d3e393ee48132480fca1532cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632235a1-67e5-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668847042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847042, "uuid": "d2ecebd5-a130-4285-9b0d-7befb52f4af1", "comment": "Malware payload (Mirai)", "value": "c62f32f89cf139188584d08955120291", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847042, "uuid": "707a49c8-9f1b-4393-bb13-e6754d253a34", "comment": "Malware payload (Mirai)", "value": "7bf08234ee79cda77a3096f4096f16388896bc64395b8834593affe4b1b19b99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847042, "uuid": "d096190d-4226-4548-8f16-a060745d834e", "comment": "Malware payload (Mirai)", "value": "d5622eae35177cc02c8f922ebc1295cc04b7b8ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847042, "uuid": "bd408967-fa08-4841-a58d-bf31c8789baf", "comment": "Malware payload (Mirai)", "value": "26269de778bfd22064326bc428e25e8cfcdb8a8ddf49a1b39a3d95bdbf8d66ee7a609f01ee4cb99f42ea7c0298222be0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847042, "uuid": "961719b5-35f5-4b33-aeb7-da085478f2e3", "value": "T1A1A2C03110971CB0C374083AB83CC792A7E72A7DD0F5A67322660568768B0E957F855B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847042, "uuid": "d77c482c-7735-4244-8e0a-556dd86843c9", "value": "384:XzCyZMoq2dBrmx+sW/yOE5TuE4sR8yuLavYbz9KJPd8pTFW0zi0Xxy9asfhQhhy1:rZjdBrmEsBOEhmyu1z+dt/FMs3UozUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668847042, "uuid": "7bad08de-df57-443d-9795-e7c26ec166b3", "value": 22336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668847042, "uuid": "9b029230-fc51-40e4-9fb6-6fa7aea75616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847042, "uuid": "572feaed-b35b-495c-8400-bb35fc9128a5", "value": "c62f32f89cf139188584d08955120291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603a4d13-67bf-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668830716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830716, "uuid": "1111e50f-23c1-4b71-98f7-0d5238feceb9", "comment": "Malware payload (Mirai)", "value": "873bf9396e2c78eaa228917d08575cd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830716, "uuid": "8d7efd3a-a4c5-4e7f-8027-a4e34f817790", "comment": "Malware payload (Mirai)", "value": "7d74b065f04ab53cbd933cd1d4e35a07c9f68b7c17710526c6e7e685b64d8d85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830716, "uuid": "d0daf63a-c922-4987-a145-f93b28454528", "comment": "Malware payload (Mirai)", "value": "b411559ddcb59f175bc5adb1db30c4f920b347cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830716, "uuid": "4f7d9ee1-1622-428a-8003-64c86ac648fa", "comment": "Malware payload (Mirai)", "value": "9b977979776c6e2f90750b01c55a26ec340097cdcf138e1a23adcb03aaa399b104578c58a8822a03ee48f7f223450dce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830716, "uuid": "42c90696-c09a-46c4-9f3e-c73aa13b00d6", "value": "T17C73A80E6E618FBCFB5A823487B78E20A65833D627E1D541E15DEA111EB034E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830716, "uuid": "1a399c9c-d595-4063-98ae-742baaa57f16", "value": "1536:YZIJO4rSB6xXqzEIeCRIxuF9IJajZvGIyv:LPOB+qzETxxuF9IgNvde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668830716, "uuid": "251b7f08-41eb-4af5-898c-5adc08f4c69e", "value": 76612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668830716, "uuid": "9eaed8f6-f078-420a-a104-b348468cba4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830716, "uuid": "7d679e58-8755-4f43-afab-f82b9828ef48", "value": "873bf9396e2c78eaa228917d08575cd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed031464-67d8-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668841690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841690, "uuid": "b61047f9-9d23-4d6c-9eba-af632b8c871d", "comment": "Malware payload", "value": "76192e889b57551a31a59e34fab41f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841690, "uuid": "029287ea-256e-44e8-a6b4-f1cd7ac395ae", "comment": "Malware payload", "value": "7d931fc643fb2a4a35e4f965357a9100d84ba612652c90bc46580d38e305e890", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841690, "uuid": "c1fc219d-9d9a-4dc4-9be8-e175ded41675", "comment": "Malware payload", "value": "db22beaed511567be190cb643f884d8829239df5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841690, "uuid": "fa545310-9ded-4488-bd9f-82d684ba62b9", "comment": "Malware payload", "value": "c77af878519d8a8add409a5f4a66320d71edc4abac8fc7ede20fd1ab8815ced3540a8ca2c48e6f2a8ce155f520f7176c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841690, "uuid": "7c33bac9-9ad3-4711-94be-287eed229c5a", "value": "T1627633B07C928EF4D16214736A654FE5C7ACF7821E680C97E3EE22680D7BC458176B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841690, "uuid": "f23ccbcd-cec4-42eb-b347-1e480c7b80f7", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841690, "uuid": "bd954b1c-2607-4bfe-96f5-eebc82016f46", "value": "196608:91OTjqfddnROYxrisUKxgKAF3TGpIhzMZU78y/4n:3OuddnROYVTAJKpbZWj/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668841690, "uuid": "eaa70437-108f-4471-828d-c33c1b51676a", "value": 7641139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668841690, "uuid": "25b9db8f-7131-4c77-8b6e-f84423228aab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841690, "uuid": "56e2a59a-83e7-48d8-95f0-534784526a1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c93bfd-6814-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668867075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867075, "uuid": "3347490f-9517-4287-9d99-8867ccc5849a", "comment": "Malware payload (Mirai)", "value": "2fd4523ac43b74f44dbc1ecbd09e3e6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867075, "uuid": "f40293a6-effa-4e52-a2ec-fe595e9fe85e", "comment": "Malware payload (Mirai)", "value": "7d93cc91091f90941ce2d7b7471fd00fcbb83df042716fea6d020b01847f5b43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867075, "uuid": "4fa0ca5d-656c-41ef-8659-13958bd916e4", "comment": "Malware payload (Mirai)", "value": "956c23d12b1ab6a56a5a5946b06bae83c1edc7ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867075, "uuid": "4a3874e3-b21d-44e7-9acd-85d8e1be6170", "comment": "Malware payload (Mirai)", "value": "f016e8784a0c774cbbfece4736855a7a416a7cad5bb1b77be41f76597011ba68a90bfd46075ee315c210b82200c76f3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867075, "uuid": "d604a78b-403f-48f4-9eda-9341dc922562", "value": "T19A933B97F800EDBEF809D7774453490AB230B7A04E921A727257396BEC7A1E4193BF46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867075, "uuid": "352c8acf-d215-4489-81fe-ce184c70c1bd", "value": "1536:Mj+9mKLMisFvCuyMydl91jkjgAnsuouXqz88hZZro6SBvAhGDZ9agQE:fv4iaCfMydl91jCsupXqztZro6mN9hQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668867075, "uuid": "978d3bf4-281b-4f46-a8ef-ed360078e2a1", "value": 93480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668867075, "uuid": "f983ca5a-026b-45f0-aafe-ef650af1eafc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867075, "uuid": "3c940bb3-05f1-4a44-9221-278f49152a82", "value": "2fd4523ac43b74f44dbc1ecbd09e3e6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6eddcf1-67f8-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1668855316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855316, "uuid": "b8028cfa-e419-4185-9120-3e8d50532910", "comment": "Malware payload (AsyncRAT)", "value": "7cd00820b99ad64b597a8a8321fe8869", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855316, "uuid": "8ee177e1-4661-452f-bbba-13ade08ef993", "comment": "Malware payload (AsyncRAT)", "value": "7e3c5746f3c975a25a160d359155d3ce8c7372dba6f62c0da062167c5fc00c43", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855316, "uuid": "a81a3263-3249-4892-ae6e-b7a6d3de5fd8", "comment": "Malware payload (AsyncRAT)", "value": "e4627a98e9755ee6720157a2736845d4635a3941", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855316, "uuid": "e90ebb51-dcb2-4938-b53b-fba92b2fb62f", "comment": "Malware payload (AsyncRAT)", "value": "fe47f7f187815003b632e92c92cd89fa7bc1b9554697ed5724382246ac3c9c0fcdf2513b856287644bcaf13e1db0d609", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855316, "uuid": "e4417b85-4afd-4f95-97a5-4af9b733fedb", "value": "T1A7C439DD67290B5FC25C3AF8C8D9D601E2FBF9A6CB724B014EB1331EA9673826C59414", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855316, "uuid": "1068585f-6e06-4875-bfac-465e327c43db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855316, "uuid": "3392687a-f853-45fd-884e-1e2d0c6534d5", "value": "12288:VLGfhQYrgAupanwh7V3CmzlmYa/60mEtJ:VLGfhQIgAugnw9VBlmx/9mEtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668855316, "uuid": "c0782544-d32c-4601-a446-eb61e17e72e8", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668855316, "uuid": "20334d48-f0e0-4152-a185-80c60564f58a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855316, "uuid": "94578460-7f9b-4d0d-8fc2-1a487dee0538", "value": "7cd00820b99ad64b597a8a8321fe8869.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0842ae2-6821-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1668872995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872995, "uuid": "be508b96-a7c7-4e88-9ccb-853e009a7172", "comment": "Malware payload (CoinMiner)", "value": "60a14c84e056de09239b6dfd1acdee9e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872995, "uuid": "0e3a5b3b-b48e-4759-b1e4-d2f93ae010e0", "comment": "Malware payload (CoinMiner)", "value": "7e9cb3b696913bfdef0f58ca98b7d74f03d6aa836f871d5df788f4f56ad13496", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872995, "uuid": "3559cd94-6605-4e9c-aba6-a794a246e13b", "comment": "Malware payload (CoinMiner)", "value": "78d3a4c3af6b25216411872baa4d964529039a78", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872995, "uuid": "75b84dc1-0157-4f87-81dc-53a43b370bda", "comment": "Malware payload (CoinMiner)", "value": "b3dd2c648ae94ccc3ec7f534dc167609e0444686497ce403c7360c9d367101b51d285f33d415e69356fb8fe55050cb4d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872995, "uuid": "53c6be2c-853c-48a0-8166-a2f94ca2b94e", "value": "T18B75232A67F9C97AE9320B354F37C3B55E38BC108A60671B7951B3BE2D72B506807712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872995, "uuid": "1f268f0d-1c0b-4bb0-8cd2-254ef28baf07", "value": "b23b14eaec2e60d8f996b907f624d80d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872995, "uuid": "3affdd8e-ef05-467b-ab7b-e2c5cad6a93f", "value": "49152:83aNybImK124OALVo2IPQji4GnLmqDeP2OsxMLMmsp:83aNybFl7AJ1II+vmqDAUSLML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668872995, "uuid": "991f30ac-a51d-4389-bb86-24dc23c6cdf2", "value": 1649664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668872995, "uuid": "682a12d3-0190-40e8-bdd6-579fcc6089ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872995, "uuid": "7f3196c2-b769-4ad7-a95f-ee0a8a3e08f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8231837d-67bf-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668830773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830773, "uuid": "f40ecf1f-2fb9-48c0-b6bc-19724d3a66c9", "comment": "Malware payload (Mirai)", "value": "bc3c9780843a57a54e7df92172c9a7a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830773, "uuid": "abfd9755-256d-4b88-ad0b-645d9a4a7743", "comment": "Malware payload (Mirai)", "value": "7f96834987d139aa077a98713209de76e8c5e512d611b6e96df52d9eec35f1e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830773, "uuid": "c55164be-cfa7-456a-a664-a5489129122d", "comment": "Malware payload (Mirai)", "value": "f45ed929ce63f59b19457142460cbd8842388037", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830773, "uuid": "b54334c5-fad3-4971-adc8-0f0c75e5fce1", "comment": "Malware payload (Mirai)", "value": "ad4b0d2b6a998733493569eaf1c8a93833d9dc1e061ef2027fb1a19b4d623f0a5e98361b4f6d3e776aace5f99972ac73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830773, "uuid": "06fa7f58-da11-4bc5-aaaf-39bb891adf1c", "value": "T13363F746F8828B26C5C613BEF92D118D372353E8E3DEB2239E106B6077C646B0F66D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830773, "uuid": "9e4ace39-7e49-41c5-a770-fcd3b0983e43", "value": "1536:H0nDSvcYkZbUNS6Q8fKb1duEQtX+RZfZk9v0zAIyi+wcauE:TvBkGNxQ6Kb/jym3kZwcauE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668830773, "uuid": "646261e2-e9b8-4e81-afce-4940e15007dc", "value": 71108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668830773, "uuid": "25728c41-3281-4e76-b3b9-88e22a367f19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830773, "uuid": "b15d9ecc-1a2c-4aeb-b653-ecd32080bb58", "value": "bc3c9780843a57a54e7df92172c9a7a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cec778-6821-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668873009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873009, "uuid": "dcce114c-5156-44f4-9c69-7e0d06a3e964", "comment": "Malware payload (Mirai)", "value": "345736ebb5ba9e61eafd3e0a84f5ec76", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873009, "uuid": "04f96dc3-c66d-4f94-bfce-ad7c861eb4c3", "comment": "Malware payload (Mirai)", "value": "8081036750a994063fb4c55e25e350efc96fd71098e3af7680071c748a1df919", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873009, "uuid": "e38aaf07-a637-4a5e-b0fc-cf23e16c41e6", "comment": "Malware payload (Mirai)", "value": "127a2c7e3c5243b8fba3bc97fc66a8feca39f5aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873009, "uuid": "fef164bc-fa4f-43e9-8865-aa5105e3b344", "comment": "Malware payload (Mirai)", "value": "85b4e85372ea5303f293558bee922ac5a1609e3c964e56ad10d206eef3b5f5366b92ffa4d958e9815ac6def3954139a2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873009, "uuid": "7298aa56-16af-4841-8a15-b4a8d5a085a3", "value": "T19763F682BC80E616C7C01677FA6F509E331567D9E1EA33429D251BA07ACFC1B0D6B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873009, "uuid": "468b6cfa-8049-4145-b654-c22815647c2b", "value": "1536:BBnoU1QAu0Ud66g27hQlx0lB8t46uxtaVJLoM:BBoU1QPQ0384BxtuJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668873009, "uuid": "3b812aaa-897c-4c49-a0d8-3da203ab9e5c", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668873009, "uuid": "02e0e50e-d37f-43e7-9277-96cae36c09fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873009, "uuid": "41483e11-c346-4d0a-94cc-885ce177eba8", "value": "Mddos.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f147a2-6814-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668867065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867065, "uuid": "22ab21f6-b462-4e51-ae10-4b41012d4e66", "comment": "Malware payload (Mirai)", "value": "ce7257a77bb10ce50ef288556490bace", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867065, "uuid": "1b7cab53-c6a7-43bd-a735-17da175652bd", "comment": "Malware payload (Mirai)", "value": "81f5941c79ad329b9e8caa5d65604b33ce1598c052c4d0416e5331a5e4bdd83a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867065, "uuid": "0cd47fe8-5ec0-4d0d-8ec3-ce4f585cd8fb", "comment": "Malware payload (Mirai)", "value": "c9bd3d6b04dea95a8378245a8f2d08ce29d739d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867065, "uuid": "d72f60db-fd92-4bd3-bed7-5c05e61575b2", "comment": "Malware payload (Mirai)", "value": "2e534d51eb01e55880a572fc70804dd8114c155ce4fe4b1655ffa1293f8515dcc0135b2dbcee87bcef0ec3c5372cec97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867065, "uuid": "55fcc7cf-b986-40ac-b155-3d8a1ee9b1c5", "value": "T1B603F132C6412B07CC70513E9629C78E99F44BDED0E9787E294A80981ADD73B5CB47CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867065, "uuid": "ef2dee3a-a70a-429d-9968-cf369e2661f3", "value": "768:zQLfCsecOTPyGswMLxgRvlUDjU/AzAsbWwG/54/pps3Uozy:6CtcK5FoxgRNUDjUYzAsbc54/2zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668867065, "uuid": "0ddb47b8-b6e6-49c7-b281-3484c28d2b6b", "value": 38448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668867065, "uuid": "0aae4eb4-e69c-4af2-a909-dd138fbebd8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867065, "uuid": "fe41e8ad-73c9-48b9-9759-5e93b0ca7066", "value": "ce7257a77bb10ce50ef288556490bace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaca1652-685c-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1668898380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898380, "uuid": "66716755-c891-43f7-83d3-a6f8e66c734b", "comment": "Malware payload (AgentTesla)", "value": "28cb97f71b423eb54c7382aba89d92d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898380, "uuid": "c2bf8876-a7a2-4d54-b821-c4d72bfcbfb6", "comment": "Malware payload (AgentTesla)", "value": "81f5eecb34f22bd640cee738295303153d9afda2a35e365d061d058fbbfed498", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898380, "uuid": "328c3cb6-38b3-4505-b788-ea2e104a76fc", "comment": "Malware payload (AgentTesla)", "value": "06622045c5f36ddbb7e78a856e713781e6a71aca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898380, "uuid": "b74abaf7-742d-44e9-9db1-9cc7dd01cd1f", "comment": "Malware payload (AgentTesla)", "value": "9472b8f5de25f9f22cea1f29948130ff3655b14064bb6c07a822305cee1f9337dc461c70840a5abab0855e53009ee70a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898380, "uuid": "0b77c642-6dfc-42c3-9514-46fbe95d490e", "value": "T108F45AE9A893796EE5B8B25E15F1A840CAF388724EC0AE2441783DC55D339D3B161DFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898380, "uuid": "d417527e-fedc-4652-a3fe-b3d6d6772809", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898380, "uuid": "ff8c7ac5-0912-401c-80ac-8bd31a5d5199", "value": "12288:W7DcYEDdzVJoH6xv7iZDyfwW3l57fIplGQ7zkwBnM33302IgFJN0V3foYcjZnbCx:0L8d/U6J0WV9fIz57BBnG30YCoBjZnbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668898380, "uuid": "c9c0912b-5adf-4035-a37e-50c365391114", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668898380, "uuid": "459c1115-dcd1-4b0d-8bb0-dc339548bc61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898380, "uuid": "9d7ddda3-5982-4b2a-965a-2f303f8eca78", "value": "pGmFza4Vv0hJG57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692d5e2e-67bf-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668830731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830731, "uuid": "79c3d7c2-65d0-4a18-95d8-e3e3140e9bf1", "comment": "Malware payload (Mirai)", "value": "3bf35203b3969c32f49a2e7fc413b1a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830731, "uuid": "25314461-23d7-476b-8952-9f9f88edc24f", "comment": "Malware payload (Mirai)", "value": "8243789e46cc81990dcca56dda8cac5808abd43fed9514ad984174c4cabbde3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830731, "uuid": "2bbeedbf-d4a7-49bf-8e9c-27d94d23676d", "comment": "Malware payload (Mirai)", "value": "96815dc3c57bcaaf853059d288e53b1309afb29f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830731, "uuid": "108cbe82-03b5-4505-a8e7-1ca90c6776ab", "comment": "Malware payload (Mirai)", "value": "4caae9e51ec39a96599fd16661ccc742cc8523a31dce60d2ab1cfb6746e771b81566e87ee42664437961beaf8f472013", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830731, "uuid": "6595c48f-2289-4808-a337-bc7fa0237c43", "value": "T1C9D34B46FB418F13C4D617BAF9AF424933229B94E3EB730649285FB43F8666E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830731, "uuid": "61fcb015-4277-4529-a02f-ab38c638042d", "value": "3072:f0DvinprSHrDqtVxUB3RJxQds/neqfasb2mKM/9M/zrr:f0DvinprSHrDexOJxQds/eqfb2vM/9Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668830731, "uuid": "28dbdc76-24e4-4c9a-9a70-ca1d9515f998", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668830731, "uuid": "ccc58722-9ae9-4ce5-898a-3517cbbcae7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830731, "uuid": "8e21b4cf-5667-4f6e-a03a-79115ebe0531", "value": "3bf35203b3969c32f49a2e7fc413b1a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c2acd4-6862-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668900841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668900841, "uuid": "61765c2f-f0c9-4334-b2a9-a50465566bdf", "comment": "Malware payload", "value": "994927ea12212c290daad6d792b6989a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668900841, "uuid": "63da93ef-fa83-410a-9180-5c260bf404c1", "comment": "Malware payload", "value": "82959564f90fa6862907ac66d8c593c896e3a8a2f25a40a99a26c3c2097dcfc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668900841, "uuid": "8018bf17-07e3-4f01-9adc-a8c28802dd0f", "comment": "Malware payload", "value": "483e5cc545760573768eb8f29d31435484d36512", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668900841, "uuid": "55404c68-c0ff-43ac-b4a9-6b64bfc47dfd", "comment": "Malware payload", "value": "789088febe44d36d9f34d6e758648e59694157ea2808912a7bc7b266d5706f469f58f83fa9de18ac0155f463d4f4a085", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668900841, "uuid": "624836d2-7137-470f-9419-879909ce9fa0", "value": "T102B18E5763344D83C77E59B758474B023B699D62933909C40BCC8FE4E48FA54B3A4121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668900841, "uuid": "a6efb16c-a9db-4151-b2dd-74ae38934e8f", "value": "96:K1X/q/Gbka+IKoOZnknKfPoMSJRTp+JqqhTD/Y93pV7u5nMLQ2QjYDQ/SX:cfbn9n2PIH0Jm93pxu5nMLtnVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668900841, "uuid": "9a703c8f-6292-42ce-8cf0-91bfd6dad0e3", "value": 5392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668900841, "uuid": "aa424edd-9fcb-4609-8218-e30dc674e027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668900841, "uuid": "a29c18c7-abb6-4789-921e-2a0b2d95e41c", "value": "SecuriteInfo.com.Trojan.GenericKD.50062173.15571.8543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955d7e1d-6831-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668879768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879768, "uuid": "71bdfc93-0d06-4357-a50a-7df4dfee42ae", "comment": "Malware payload (RedLineStealer)", "value": "daa3330b4badc388d847ca45aaab340d", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879768, "uuid": "fbe97626-a62a-470d-8ec2-9fb42b68a9b3", "comment": "Malware payload (RedLineStealer)", "value": "831d268e5c6d79d8fe79b60432556fca95666e74895af79c8bb55bab729bbfc7", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879768, "uuid": "693a3964-6a03-4a3c-a5d2-dab714319b63", "comment": "Malware payload (RedLineStealer)", "value": "d5b627a826057b3a643e26a674b25024c0d26dc5", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879768, "uuid": "6a8b96cc-f887-4d7f-902b-da9a5c6cb775", "comment": "Malware payload (RedLineStealer)", "value": "f66ca087a4f728fdf148982a98d5bcefe631c6f34a5910abefa292a74e63b05ef9d46ddae1e4750e1d9093537cb143f6", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879768, "uuid": "85c9536f-5b25-4122-a2a5-9e58b5ff308f", "value": "T152E4E11A3768CF01C3952E75E0A346296BA1E58332BBF75E2F89B1961D132F0CD493D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879768, "uuid": "603580a2-9dd7-46b1-9ff7-107717c1ebe4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879768, "uuid": "8190e3f8-e7fb-4850-842c-9abaf3759d65", "value": "12288:ToUBnRdJqJVd764duQSdTTDuNtZsgsqxl/C05sAr2G+972POqcTuLvC19d4x/K:ToUBnRyVd2CkwtZV5/CGY2P/cTuLvbxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879768, "uuid": "d5307134-44fc-4ca2-aefa-1dfb709be070", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879768, "uuid": "f8997385-1801-454a-a84e-3b437204670e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879768, "uuid": "163cd609-7e94-45e4-bf03-68eee83a52b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f69dfb-6801-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668859179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859179, "uuid": "8c5a58c4-acf2-4ccb-87c6-2bb21390ec6e", "comment": "Malware payload (Mirai)", "value": "a926e5ea40d3e689771823d089a9c3b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859179, "uuid": "57bfc5a5-54d8-480d-91f1-07ddff313a91", "comment": "Malware payload (Mirai)", "value": "8334efcea9b69a0f3671920e08e34bd0d1650e85e5c6eff80eae2d76087bcd16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859179, "uuid": "b78b5779-a5bd-4dd1-9374-9970a01ae137", "comment": "Malware payload (Mirai)", "value": "7f1cd59b62b693a7c9e5bd841596702f7640a4c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859179, "uuid": "09a95625-5e74-412e-a793-f87c1fba7f49", "comment": "Malware payload (Mirai)", "value": "2177f5039f62f0348a014d1fb4c8bac04d5f80bee21f111868034b62d04aff9e3a360a75ed958cee4d60646d1b42cc0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859179, "uuid": "91e62c7d-6188-43ee-a869-3529775d53cc", "value": "T1BBC2E0E0B726E931C4206C3DE53B4D8A3A51067C91FF383764258D359EC169B23E88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859179, "uuid": "0dfe196f-4ccf-4ad9-a282-8b83013dee99", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrfx9q3UELuj:PKy4qfqoeJdXWgfkLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859179, "uuid": "8d51a31b-075e-4662-8645-b55583ab7e8c", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859179, "uuid": "c7bd3b77-82cf-4d42-b4d5-a80cd214bd44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859179, "uuid": "af2b673d-2d8a-42df-93df-43b646e9673b", "value": "a926e5ea40d3e689771823d089a9c3b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efe3a75-67ea-11ed-9266-42010a9c0072", "comment": "Malware payload (LgoogLoader)", "timestamp": 1668849236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849236, "uuid": "2ea3c8e7-58ec-4087-b57d-7c6562436709", "comment": "Malware payload (LgoogLoader)", "value": "b0e9d73b088bba7ae904f293e8a13c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849236, "uuid": "8e18cfac-d899-418c-be56-51e01b163a52", "comment": "Malware payload (LgoogLoader)", "value": "8391de874c21ac03bf02c2e6fa7feabc06b2421df1ca6820cc38ad911b060937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849236, "uuid": "5bc97845-29a6-4bed-b588-eb214ac1f2c8", "comment": "Malware payload (LgoogLoader)", "value": "01b96b31410af3c3e78f445c328e77b6df15efbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849236, "uuid": "5351ec1f-28d1-4b27-b7f5-a62ce08a0ec1", "comment": "Malware payload (LgoogLoader)", "value": "10bdc9e8ae6509fe2520636494fe943a42ca082f47f59b3f8038cec725be83166fe2058d1a06dc6a5f17b91e0617fd30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849236, "uuid": "95700bb3-1bcb-456f-adf8-56924b590d3d", "value": "T1F665F1A0F9F30776CAD35739353366AE07BA901E52AB851359C5E3F71E10BE7968C280", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849236, "uuid": "87e5f067-4cdf-4200-80c3-e6bc6236d0b7", "value": "c87c269684dd62d98968492b86dd710d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849236, "uuid": "2c219ab6-6723-4b34-b1ff-2a8c2cc9f378", "value": "24576:JPjoBjKAMOOSAAZTkbTQIrq3sUGPEyle8a+9CXkRKsHg+NslXiaaJnjtP0kibyPa:Vjot2dWTaIb6lle8l9CXkRKsHg+NQCnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668849236, "uuid": "141768f7-ae32-44b6-864d-b57d4d7f4661", "value": 1487336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668849236, "uuid": "425791b8-6292-4fe9-a627-1c983414be82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849236, "uuid": "4463df5e-1a02-4c97-9e3d-79c7cae71feb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a140da-67d0-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668838081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838081, "uuid": "75410adc-46ac-412e-b8cb-19632fd6e40c", "comment": "Malware payload (Smoke Loader)", "value": "51458e5eaebeebe732520bb1504f84be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838081, "uuid": "cd1d5b47-59a9-45dc-8ef9-357d523ec3dd", "comment": "Malware payload (Smoke Loader)", "value": "84fb498e2ae38f0c247cd4b78dd3f020628d5e6862695487a059fbf2a5d3099c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838081, "uuid": "55c85251-144f-4f6d-850a-b21d23fbdff4", "comment": "Malware payload (Smoke Loader)", "value": "5d195fa83032fbe7fdd1db0934d7b15a44cb31fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838081, "uuid": "e650dd4f-691b-431d-b7ac-20b8cb004417", "comment": "Malware payload (Smoke Loader)", "value": "d0b7abc51843a12aa9b60fca3903167e218d5dde7d42e5025eee73a11c4b8f7cdbad0a2343e4b9548619cf000428316c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838081, "uuid": "a96d3f8c-2ba2-4112-85de-83c3b8b2f78c", "value": "T19F74AD507680FD72C7D10171892DEBB5AE29AC725F219AC732B8EF5F2E302D0A5B3255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838081, "uuid": "39a9b61b-2887-4f7c-8ff9-f0b7b95edf42", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838081, "uuid": "f0c5f835-b1a8-4f51-83cd-a064d0d0abcc", "value": "6144:1f9ohzqthKQ61RCUEcuJvd1Bh+3oQ9gOU+fzYBb6:bokfKtDd39gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668838081, "uuid": "ed566a81-095a-45fd-ac90-e76133e0bc62", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668838081, "uuid": "37d99d4c-ab57-42cf-b384-8b4d20dc97ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838081, "uuid": "a269fff2-4c4e-4669-9bce-fda048ecf044", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9af02f-681f-11ed-9266-42010a9c0072", "comment": "Malware payload (Jupyter)", "timestamp": 1668872075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872075, "uuid": "63ccfb91-0487-4fff-b179-11de1b159b12", "comment": "Malware payload (Jupyter)", "value": "628566c6f7dd239e31971a309e76e5d1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872075, "uuid": "112e3427-3058-400f-ad5c-d680171e2d0a", "comment": "Malware payload (Jupyter)", "value": "85060968c49db70bfae719efb76e1cdfee4d7929e95d12b0ad8c52585fbcec08", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872075, "uuid": "a5aec36b-5baf-468a-94e7-feaad65d35a8", "comment": "Malware payload (Jupyter)", "value": "5b00b4dfa25d16ace8654f011c84ca8ec6ad6abd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872075, "uuid": "43ceff73-2429-4fce-b57a-79629bd957f3", "comment": "Malware payload (Jupyter)", "value": "c83bc54051d19fd54aaf3531cc1f355bf76c2b99523e6d097cd926458c92ebab978e65af0754b468fc6767d424e263b2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872075, "uuid": "18dfd0cb-2732-4c54-9787-5079dc51a235", "value": "T135D47A043BA5C84C8B6C2BF978AB9717BB2456F3D6C29F4DC79290351A5ACF14CA10F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872075, "uuid": "e0a35608-41a8-4251-9c81-20785efef65c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872075, "uuid": "336d3f62-2e3d-4487-8deb-db002f5c6a27", "value": "12288:guIcdK1+cVEVDqnJbNAyIO7x6HEOv3a7v3YT:gu/dcVuQNAyIIzOyTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668872075, "uuid": "7f08067e-7717-453b-9531-3fdde360eb18", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668872075, "uuid": "ca2ea390-ab4b-4717-8edc-a32f99d80693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872075, "uuid": "d75ef8b1-9ce9-4223-9e24-7785aa50af55", "value": "solarmarker11192022.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc622b8-67f7-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668855006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855006, "uuid": "f0b4970e-1574-4405-aff9-ca958f856d77", "comment": "Malware payload (Mirai)", "value": "231c7d68b40f2fb1b2e9d810ccaf762b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855006, "uuid": "904a28dd-35cf-4c88-ae1d-0a979c8d2239", "comment": "Malware payload (Mirai)", "value": "857e49d0cd3f509fc96124e81bcad2fd6a0ac185021237e22c1ab844d651921a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855006, "uuid": "fb589c8e-fcf3-43f5-ba5d-7d279cd1e1ca", "comment": "Malware payload (Mirai)", "value": "b08fdf1a8921629e46badfb8cf5c850804fa08ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855006, "uuid": "47e5ed1d-c64a-4aab-824c-172e8782c34f", "comment": "Malware payload (Mirai)", "value": "9ae884fe27e53dd32bc75af2430e1ef226836ad469af00bfbd4ec58b2ffdb93805eaaeaffcc86cfec8f6ba2657d2a9c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855006, "uuid": "112444fe-16f0-4a4a-8d0e-867801fac0f1", "value": "T17AA2D055BF1C828BC836397955E9E9D21252FC62F29DCC1E2540C16FB1A33A95870E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855006, "uuid": "246bf737-a32b-48ae-b571-d80fc49c26d1", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTG:798o08kxofBE+ZkXaITbp2F2TWul0c5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668855006, "uuid": "1cbf36f2-7ede-4f89-9c61-34ac1407cba1", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668855006, "uuid": "80e5bef3-e0ee-4aef-96d3-4f983eb3d206", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855006, "uuid": "bb548c13-d75f-453e-ad44-f91d96a306d7", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ac7af7-67c6-11ed-9266-42010a9c0072", "comment": "Malware payload (CMLocker)", "timestamp": 1668833658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833658, "uuid": "8ed75c25-80d8-48a0-ac1c-1685570bcbc3", "comment": "Malware payload (CMLocker)", "value": "64b5ad06201bd4474f405215753a1759", "object_relation": "md5", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833658, "uuid": "b1ea25b7-7149-4457-9fd3-99407cf25259", "comment": "Malware payload (CMLocker)", "value": "85bcbd9ca95bf780e1ec1d0e274b4ea792a65a9e8a941e1e5476f1122e420ecb", "object_relation": "sha256", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833658, "uuid": "cefee82e-89ed-43da-8cdd-1439faa58ba7", "comment": "Malware payload (CMLocker)", "value": "bd19e015111691aa2ac6c317e96d732a217c6632", "object_relation": "sha1", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833658, "uuid": "15c50b26-2b5a-4300-b538-3a9eae0d9903", "comment": "Malware payload (CMLocker)", "value": "7f3f66b6c5727189dec9ca18c9011a9552efc374e454b0d1334f466116678f65bb83bb9133d69e0746abae828fd50d30", "object_relation": "sha3-384", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833658, "uuid": "f5359bea-9ea1-4ea6-902e-85d36c0e012d", "value": "T187D451E2853973A3D801C27A9AD355DA721EC5FBF2C14EC632A70A406737C989C9FD64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833658, "uuid": "0c11f8e3-48ba-4710-abdd-fd359e81df91", "value": "384:YQc5194fj1zQcZ5v+Z5v+Z5v+Z5v+Z5v+Z5v+Z5v+Z5v+Z5v+Z5v+Z5v+Z5v+Z5s:7JVzZp5d5gZX5bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668833658, "uuid": "b2157dc4-b813-484f-87c1-e41f3f594ca1", "value": 618316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668833658, "uuid": "f13e3335-61f2-4684-ae04-be86a2867cf2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833658, "uuid": "49ab5991-2c0a-4615-a790-1ee2c07bb16d", "value": "EmailSpammer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ef21b2-67d1-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1668838298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838298, "uuid": "d5bf5d3a-c6fc-4e5b-82d4-2218f1e6136a", "comment": "Malware payload (AgentTesla)", "value": "6f4ddd69f8ba210c0df75d9147be756a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838298, "uuid": "1614b0de-bd82-4cd6-ad86-eb0f237d1a82", "comment": "Malware payload (AgentTesla)", "value": "8755b249212ed03acf40d6c02894ec5a48f62312d7f4dfb802cb17886d8c922f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838298, "uuid": "b4e34fbd-501d-42c7-8bad-e3f0c2f0cbe4", "comment": "Malware payload (AgentTesla)", "value": "153a2cdab525f2cfe57f6dce6e1e85b61406f671", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838298, "uuid": "a2272792-bb3c-4e77-b5b8-2475f06c1852", "comment": "Malware payload (AgentTesla)", "value": "fe98fd640c1b51bac5a12ab69ee2848d571c28bd10a3be8a8ea6c32202ed1ba674f5f47757611fcf057a69e4cc23d363", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838298, "uuid": "aaf89b3b-362e-4aae-ab77-e0fd52dd5998", "value": "T103B42345A781536CFE22A9F6A74BC6B35AD14A63BDD4478C8F4C0E801C701C9D7ACAA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838298, "uuid": "8b170d22-984d-450c-9c47-cf94621fff8e", "value": "12288:XyNJqds0tVx78AfOFKXSxsiP1sGgP03m223HlD9qiPeW69UqCdGRk8gmr:XyCjwX+i6PMd23HlrPy94+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668838298, "uuid": "01c1e20f-537b-45c7-b9e3-a2a21a65b805", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668838298, "uuid": "183dd782-9159-458e-a081-dab40b47202b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838298, "uuid": "bf8eb595-258b-4126-957c-d8b4d82fd0ba", "value": "6f4ddd69f8ba210c0df75d9147be756a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d20ca5-6800-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "0a1f3cb7-a1f3-4090-b1ca-adf640717a59", "comment": "Malware payload (Mirai)", "value": "e087dc261298d869c3ebb96e19360e45", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "ec36fac0-c083-4f26-bf62-cb83d74d3031", "comment": "Malware payload (Mirai)", "value": "876aa9799ecd21938cbbd162586d651d3d90674bc4fb6c3be3be42a550a1f12b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "99ccbaea-3287-4227-b687-4957cd0b5745", "comment": "Malware payload (Mirai)", "value": "ba72ae20a009928187352a531b3b45bb0695fa6f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "8b0b8e64-6daa-4d93-a748-0bf799362faa", "comment": "Malware payload (Mirai)", "value": "84cedb45816d2a4d9a0dcf840586bff7f24d025ed84a41a3af875dc45b776e1dabcae97d82585b370adee85cc95da317", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858608, "uuid": "0b4ae223-2917-4413-bac2-a0eb6d67ac49", "value": "T1C2233AC99503D9F4E82609722073E7725A37F53B1019FEC7D7A9E932AC42A01E21B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858608, "uuid": "c64fa9a5-98bc-4e3c-b5b6-1876bc84ed7c", "value": "768:qWH3bMm5+Fjer3cXF0WBtPhcy3/HwGrm6MbBWUe5gnEFZxCMuUFH2G:J3bMm5+FjerMVFBp/P7rmhCbzxuaH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858608, "uuid": "7c105279-330e-4a7b-8f8a-5f98e773883a", "value": 46620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858608, "uuid": "34157c62-9809-416a-befe-a7787805981b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858608, "uuid": "6bd5af01-7e5c-4c75-8835-4b81e3419b2a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780376a3-67b5-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668826461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668826461, "uuid": "ccce4c1a-5c69-4c7b-844c-800b35e01e86", "comment": "Malware payload", "value": "71c7df541f60feebab4f5192c909a4b7", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668826461, "uuid": "2108ba82-b2aa-4324-a6bb-471ef172a306", "comment": "Malware payload", "value": "880cbaeb6c3eb25c543fd6a450622d257e01e4f9202d76be809362f02e39e925", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668826461, "uuid": "71c9d930-a7d1-4683-90aa-b5263ac2558f", "comment": "Malware payload", "value": "172d02686b3e35fda64cd8d2679f0a05276fe9b8", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668826461, "uuid": "d8fd86dd-e814-472a-a54f-196e061c60f3", "comment": "Malware payload", "value": "ed862150b6d3dcd2480b25a54f91eada31c8c8f9f90c300194d7928359bbfdbaa16273ebc7a7eb9cf75c7b1fde2933d1", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668826461, "uuid": "9d4617a3-567d-45ec-97b9-03d4cf8a8878", "value": "T1A61193E614700F81E4328A393255D48B56EBEED6728A0F9C3CD92C37201CD147261BB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668826461, "uuid": "39d02b6f-c2ce-4b50-bd45-11af63b18d7c", "value": "24:up2Xp8psc4FpxKtp0pMtpnKXpzUtpMpPYpkPpM:0eqF4XxoSmKZK6Pe6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668826461, "uuid": "2a8a7a90-45ba-4e97-9a76-83180a72740d", "value": 999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668826461, "uuid": "a109fb23-2bbc-4f4b-8bb4-0c5bc97273f7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668826461, "uuid": "0ab86604-6a0c-448f-82c9-fe16f20c016d", "value": "h3llbins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a9298c-67af-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668823927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823927, "uuid": "8b50176c-508a-45af-ae13-ed43504e041c", "comment": "Malware payload (Smoke Loader)", "value": "7b4224f4b1acd160a1fe165562884131", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823927, "uuid": "09fcb13c-2e29-4baa-b14f-2fcda7f0ad78", "comment": "Malware payload (Smoke Loader)", "value": "88182cc6b81beec27375b9258a62903fc613f0b2e20f32c422b40329ca99fa1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823927, "uuid": "3731c66b-903c-4a2d-9285-7e4fb96240d6", "comment": "Malware payload (Smoke Loader)", "value": "a8cc2c9140106ec7ec1b9b3fed25322ab0f7275d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823927, "uuid": "09969e37-7170-42d8-8033-2a8140a85369", "comment": "Malware payload (Smoke Loader)", "value": "fc71a489cf63ecc50cc2885751498d5e101e34d4b3db5a69108ce373308bd6ec91217132192b6cac40b9c9a9ddc36f61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823927, "uuid": "182c951c-1c5f-4aa4-8516-eb636ee124df", "value": "T1AC74AD107280FE72CDD205718929EBF1AD69BC615F2586C732B4EE9FEE301D176B2246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823927, "uuid": "9d68232d-b462-4c78-82ca-6da8154c8205", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823927, "uuid": "eddfaf29-bcb3-45ae-87c0-85237b789d2d", "value": "6144:8+AvkzL0+GaAahqivOLpMf5Vvlm5rENYh+3oQ9gOU+fzYBb6:UvSrGaAahqPLifz04F9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668823927, "uuid": "260f2196-6230-44d9-9997-65985322fd31", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668823927, "uuid": "bf6f96bb-30f6-4f98-beee-2eaf67f114c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823927, "uuid": "7968311d-20e1-49e3-8222-b23ec60df533", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec9bedc-67dd-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668843760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843760, "uuid": "4091ba2b-674c-4895-8e91-a2d23e00a9cc", "comment": "Malware payload (RedLineStealer)", "value": "c9070c2cec63450c9820238f469045cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843760, "uuid": "705d7b57-94be-41c6-9a79-fb3785d2c3af", "comment": "Malware payload (RedLineStealer)", "value": "88a6579adeafcfb7ed5c9bcd054253ca0c33a2158624cf73c3f528e16add5f1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843760, "uuid": "88c58b30-3199-45bb-876f-c16d60105a16", "comment": "Malware payload (RedLineStealer)", "value": "6c8618e36b7fcb89d8eaa69c24819c11b1069cdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843760, "uuid": "7a96c08b-ba2d-4fa6-869d-b4f4d39dc150", "comment": "Malware payload (RedLineStealer)", "value": "971bfafd23a25c65070aeb0c88dd99f41a08695cdfcfbc4c413786c6bef937926d21b254d347f3783490be8e714b9f89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843760, "uuid": "265d716f-dd27-4b32-a58e-f80995751990", "value": "T1F4A4D0517780F972C5C10130892EFBF2AE79ADA16F1546C737B4EE9E7D302D266B2206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843760, "uuid": "e3d1d69d-5120-42cd-9b65-17149d691a3b", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843760, "uuid": "f95dbab5-7054-46f0-92b0-25f2060f802b", "value": "6144:1zcYjzAL/jyW3TA6Z6Oy/pNklc81c9zLFACy1ZT20Bh+3oQ9gOU+fzYQ:+YwHJTAM6xGG8G9zLFACybPG9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668843760, "uuid": "aa2dcac3-1ad4-4cba-934f-089b535ba7e6", "value": 491968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668843760, "uuid": "ff68b0ee-ce5e-4556-aaea-a03b3d9de29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843760, "uuid": "2f397262-2fe4-4882-94bb-913dba1f7799", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cadd37-6847-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668888975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888975, "uuid": "7dc52999-5c58-465e-b1af-e07ed2f61346", "comment": "Malware payload", "value": "1e17230cdf852e7fa54e17810c22bde5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888975, "uuid": "43cf2bd2-5b88-4ae8-ac60-ae3e81adf2b5", "comment": "Malware payload", "value": "896eed0383718b50190ef5dc82a7b8bb84eeb1f888b725d873bae6f60b721eb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888975, "uuid": "c6cd49b4-b8bc-4e65-854e-5f6489473ffe", "comment": "Malware payload", "value": "6a35d6393dba18a8882d4c8c9cfa1f0f8a0fe537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888975, "uuid": "48a71bc5-31d8-452d-aa86-4fa751db2394", "comment": "Malware payload", "value": "572e26e5a85a41bd72f3d05847ac9ca0293c7d6840a9c06e6451baa4c77aff439b64da4f6453831d4cd4b08f170c8abf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888975, "uuid": "5579bf52-29cf-424e-9337-290a19c7e5aa", "value": "T11D76336838E187B5C61502326BF0D7D461EDED420D782CBB3B59895FCEBED02E432966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888975, "uuid": "becb8a68-d547-4fe3-8837-90b5a5a923a4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888975, "uuid": "4da59dfd-14b8-4269-b08e-1094c72e5ac1", "value": "196608:91OF8LFK6t2rl9kohZea3P2S5VS4hF6iY/CAWvhfRvFJd:3O6HKl9pDuSbB6iY/CThfpFJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668888975, "uuid": "634c8fce-0566-4ad8-9193-d4b7febeb0d6", "value": 7633182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668888975, "uuid": "79f352d7-082e-4ce7-916c-de89ce210a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888975, "uuid": "e473de7e-7432-4dbd-bda7-f0e66332b393", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7fbe56-6831-11ed-9266-42010a9c0072", "comment": "Malware payload (CryptOne)", "timestamp": 1668879784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879784, "uuid": "27d7a6ab-b5fe-47a3-9a0d-92ff71d8323d", "comment": "Malware payload (CryptOne)", "value": "9ca05b8fb8831e86e58cebb5ef240884", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879784, "uuid": "e3eab207-805e-4528-b630-791b1b6cea33", "comment": "Malware payload (CryptOne)", "value": "89bd27cc5293dca09b72bd69870be33a9f9f4caed55f681cfd7779ffe459ec28", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879784, "uuid": "8e41c177-c02b-4612-8dfb-e048b52ff8b3", "comment": "Malware payload (CryptOne)", "value": "f34bd68a2af608d82b4d2c467cf558a56224a7ba", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879784, "uuid": "0cb7731c-52ee-4b90-8a2c-191c722b78c2", "comment": "Malware payload (CryptOne)", "value": "5b45afeb54ddb129adfcdacf924bab23d5275d8892241ee0feeca26279ca5ba04fc0d0669ea2e785554083b45738546b", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879784, "uuid": "88365613-94c4-41b3-aaf5-019d991d49a2", "value": "T1717523127EC48830D67228391EB79730693CBC311BB58DDB57846B6EAF211D2DA36B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879784, "uuid": "96eb9ff9-99cb-4efa-8c59-ba0b060e2c97", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879784, "uuid": "e52804de-1723-4509-b4ac-60fda54fc3f5", "value": "49152:VJ4oRdVfKL3S7pP1jelW22p7lzD743sRE:VJ4WjfO3S7p0lWjphzY3sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879784, "uuid": "115523e5-5a77-4a60-8c9f-134957608c10", "value": 1573747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879784, "uuid": "482b190e-ce88-48c5-9d65-765f4359a15d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879784, "uuid": "abaef853-4bb8-49d7-a461-065d7ba8690c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff192dd1-67b2-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1668825400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668825400, "uuid": "a7dea11f-4b62-4046-b6f2-993b32c40586", "comment": "Malware payload (Formbook)", "value": "420f3718285fef98dcbb490383c40efd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668825400, "uuid": "0cf36809-aa37-446f-9789-cc2b14d21adf", "comment": "Malware payload (Formbook)", "value": "89e3278b4afa50ac135ccc101ee85abe02ef3d1150d8c270eb9936f45b29e7c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668825400, "uuid": "9e361976-03e3-444f-8396-e1d6d0ed43e8", "comment": "Malware payload (Formbook)", "value": "58b55c7c809e3e126c0985fd67fe1053f790924d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668825400, "uuid": "0e63c71f-004f-4319-b193-c1b920375670", "comment": "Malware payload (Formbook)", "value": "67be8cc6356e604377fc9e3943b2a9c25deac814bc1e621b1432988d0d5d311df647a83663cf13f6c2ea8152d5eac2eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668825400, "uuid": "eed3f685-7d91-4d9b-8c5f-969853dc17ce", "value": "T1CF8422260295519FECC30F319833A7A7C73ACE7432A607B387D16F7B507A702E269196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668825400, "uuid": "caf699f2-091d-4e76-823d-5a1e3bddc088", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668825400, "uuid": "a2555575-3477-4fd3-9528-0c2f2355fb51", "value": "6144:0Ea0MrcKg0tmqPCAUtQjt/+kuVnC0bdltM2qkF0stSDVhvLP0ZvXDPLyiO3t2v3S:mrMLArj5+kElJqBOwVhTPKvLmiOd2v3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668825400, "uuid": "31a00931-5049-4005-b9e7-a6a2012a4101", "value": 396527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668825400, "uuid": "973deea5-1b59-43cc-9174-119e39e5f962", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668825400, "uuid": "c1e071ad-5cbb-4c0d-b67a-e81b940d90a5", "value": "SecuriteInfo.com.Trojan.Garf.Gen.6.3504.22847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c08accd-6822-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668873310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873310, "uuid": "cbeec691-7d2f-4ad5-9916-ccc4f28f48cc", "comment": "Malware payload (Smoke Loader)", "value": "a687e1c326c9f03569bbfef53e21c315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873310, "uuid": "099924f4-6c26-4ba8-bbb6-15cf330e2b10", "comment": "Malware payload (Smoke Loader)", "value": "8c2b385622de52145317d9e740b62edfb74260efab3478810d6c87ca41183f74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873310, "uuid": "e05843e4-910a-40f9-82b6-07bfbe367923", "comment": "Malware payload (Smoke Loader)", "value": "1993746a547c67807c1118501e1a7ff9261f7c8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873310, "uuid": "bf714a1b-fa9f-4d01-87b0-40d9a972b537", "comment": "Malware payload (Smoke Loader)", "value": "cad8f1ba8a7d88720118bfa41dbd994f395cb528ad1776b332abb39b1a25b19f26f6a8e28a66e4f79e6f5d3d076ce868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873310, "uuid": "70569280-9e3b-4e85-bc62-3f3d03e46fb2", "value": "T14D74BF10FFD8C4E6C57DC4707A25CBE86638BCA27915DA1373787A5E6FB02818E62235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873310, "uuid": "24fa3482-1521-4699-b2a3-bd257fd64e1a", "value": "063e5449636b8762744e9ce9f5564a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873310, "uuid": "6183f7a2-f0cb-4564-85f5-db3b53c21c29", "value": "3072:OJvvbtjLGg1cSgH7P7AGkZ2gdRJvh2vOfPztr+c+PEG7lOmV25lKE1miUO1a1e4Y:mtfGg0b8Gkfvh2v0BohVVPE+O1voXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668873310, "uuid": "9a9c4f96-950f-4469-a9c8-4324e8ab903d", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668873310, "uuid": "174aeff7-12b7-4477-bc2a-f659ff388bce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873310, "uuid": "dbe06568-86bf-43c6-b218-753d860abb89", "value": "a687e1c326c9f03569bbfef53e21c315.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7633ef6c-6810-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668865543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865543, "uuid": "d4bdba14-b09d-473c-91d9-82d815194749", "comment": "Malware payload (GCleaner)", "value": "b9bc782d36f725bdf0358b55d3912dd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865543, "uuid": "5b4fc317-4813-4067-a552-679efc899f8a", "comment": "Malware payload (GCleaner)", "value": "8cadade50f5d7913405d92ae5ca1ca193eb1c0b7ed70fecb9a04489dbc2708ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865543, "uuid": "ffadc4e4-9714-452c-8936-c205f266ce9b", "comment": "Malware payload (GCleaner)", "value": "37ce56cf26484d68da06e0a04fe5824b36af6f99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865543, "uuid": "60c27078-ccb9-482d-b1c6-95b8e12dd053", "comment": "Malware payload (GCleaner)", "value": "e3c4eceac1d47276c5d674077319f294ee4daa6c0557d01960b9c8f70865604ba1cc664f37335e1658f3550dceef2697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668865543, "uuid": "290358f1-e5f7-43ab-b214-0a64823442bf", "value": "T1EBC5F0152A46D295CC2F1CF4E16471F988BA3D62E86E827BF7927D0DFE7C357800A921", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668865543, "uuid": "9a7319ad-a7fc-4c88-8f26-f4dc55b04db6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668865543, "uuid": "e5396f25-2a1e-4d4e-987b-c44cb732cd1e", "value": "49152:q2GGjNbZ+x9zZOiJE3uTBqDOgF8XFOzB0fJFc6aPzq//AdUxVkBaFwnm:rZNbEx9FOiu3uTgHBtWvc6a7tdUxVkBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668865543, "uuid": "23f39da2-ce70-4cd2-87ed-358f9cdb39a4", "value": 2524707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668865543, "uuid": "d23070a2-3029-4c05-bd31-2e643a89a527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668865543, "uuid": "c793670e-1613-4817-97ce-50f64cb2f4dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf505c22-6852-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668894039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894039, "uuid": "49dd0d3a-3964-46f9-98c2-e35039827947", "comment": "Malware payload", "value": "f509401549d55caa48e89197c27fe527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894039, "uuid": "2ffbc8bb-8e40-4e8f-8f09-d3ee1625d42d", "comment": "Malware payload", "value": "8cdec06c7d5a7c8bfacaa804140f34a933796bfd44d8f1ef5c0f13d638a3392c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894039, "uuid": "a35747fb-c783-447c-9b8a-f00e1e716210", "comment": "Malware payload", "value": "98356f449e23c9d6973349a9a5b848a19fb62051", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894039, "uuid": "633894fa-0640-435d-912a-89948a105dcd", "comment": "Malware payload", "value": "b3a2c29f9289c010018f450e2864c164cb4fb0e3c54119bfdfb582cf14eaf8d30ff235ba1e981ed213d9ddcaadbe4102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894039, "uuid": "ecddde28-ecfe-42fb-9abd-4afd6ac1d5eb", "value": "T1EA84CE11FED0E0A1E47DC9307AD6C7E8167DACA16921D907333C6B6E2DB42919E6233D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894039, "uuid": "3eb5ee60-11cb-403d-98a9-b07491cfbe75", "value": "c8c0db015ca53b9ef621505ac544aadd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894039, "uuid": "1770fe33-bda2-4801-99cf-4e0867445842", "value": "6144:b5SuBGU/Q9fDLr28gCbKafCprssotvECZhVV4E+O13oXc:b5Suc75KafAotD0DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668894039, "uuid": "8e189dd6-9d01-44b7-be20-d665c91ac0f4", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668894039, "uuid": "7f258b88-9607-4ae9-a612-d45d1fe6de59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894039, "uuid": "c7390994-048a-4e29-8afb-c0f229081136", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332f3934-6847-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668889052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889052, "uuid": "36b61139-2d66-4ecc-9657-e462084b180c", "comment": "Malware payload", "value": "0910eb6498c27a26b89a0714ad37a1fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889052, "uuid": "b7145bf7-70ed-4c7e-9378-d565698afbea", "comment": "Malware payload", "value": "8d370d729f62b16bb00830e924ad2e674b0f28b8aeb9a158fe19d186b92cef28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889052, "uuid": "345a7870-30ad-406e-ab7c-4057d67b4685", "comment": "Malware payload", "value": "363f6bd41671273db9c2d5e965306156458f2ea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889052, "uuid": "781d8b0b-b0c6-4ac4-a66a-efedfa320546", "comment": "Malware payload", "value": "a7b060e7d6ac089af8cb488743d0c7d26c51ab911e4a30247d0a32753e5970bf4b64e488b82f6ac73a08bb9687bd0d2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889052, "uuid": "4d04f768-1a43-4a10-83cf-ec464058dae1", "value": "T17B56333746D0A9C6DB3673B23E0199486EB45132D745A4E4BA3F63C0A2405FEA7F8DC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889052, "uuid": "3a11d853-a219-4a42-848f-0c81cfeed4c9", "value": "a3017ccb2c25f455f959277b4c3674df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889052, "uuid": "dada3f6d-5b66-412f-bb0b-3da95451a5c3", "value": "98304:VZF0yGS3OAC5LmooRs56ySHNvdwpgXEVTukbEgzupmtLkPRDQSa9GtSA7xjJpZ+2:vqy3XC5yK56yStUwk/DLWVa9G3dzZig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668889052, "uuid": "4ebbe8fa-a345-46a2-9425-f7161f54c13b", "value": 6028012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668889052, "uuid": "06afc769-a2c7-4ed2-92d9-0337b8c73f27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889052, "uuid": "7763e094-2730-4418-aad3-b958c6196c63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5d70f5-67c0-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668831356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668831356, "uuid": "228e4bf1-d472-4ee6-8c0f-72310a35a3af", "comment": "Malware payload (Amadey)", "value": "cf53b86842570e71deefdeaacc6e15c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668831356, "uuid": "0713a6ad-b5ba-4b13-af5a-261f74d148f1", "comment": "Malware payload (Amadey)", "value": "8e91383daeb3f35515b414a8762a04922bd3a006fd8b3f5396ea2fa4f14297c6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668831356, "uuid": "cdfb1ea4-be33-43d3-9a02-9341720fc9ed", "comment": "Malware payload (Amadey)", "value": "1fa33662659c85e1596505b0077a045d08a099f8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668831356, "uuid": "c8528e2a-3a4d-4f62-815a-f0e3d6067ada", "comment": "Malware payload (Amadey)", "value": "5932a81d81f3483ce6c7bcdbb15f2ee8db1df389484b1c4c431f5ad13a9f0a43d89c8052fc22ea89f58528ca5ca2a7d8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668831356, "uuid": "9d64c5bb-ff47-47c7-83ca-e252d2c7f3aa", "value": "T14384BF117784FE72C4814171582DE7F1AD79AC615F2586C7B3B8EEAE2E303D1A5B2207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668831356, "uuid": "323e6b7f-9c9e-4cd3-9892-392f5850a824", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668831356, "uuid": "59c9aecd-8350-4d3e-9e6e-522fe856f874", "value": "6144:vYLIcbzCFV8mJxC4vdwm12R6SzY+VBKgKtcXh+3oQ9gOU+fzYBb6:vPc6/5C09+Y+V7il9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668831356, "uuid": "a518f464-f3f9-4064-9faa-f419455fc5fe", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668831356, "uuid": "db7b7418-b6b3-43f7-9bd1-5813625def58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668831356, "uuid": "1ae1ad1f-d907-4129-b87c-ac6789333f16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d052135-67ff-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1668858118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858118, "uuid": "43988625-289f-42b5-a814-6de115e0ca43", "comment": "Malware payload (CoinMiner)", "value": "9d5a351262e14f4b3f0287ca63d53151", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858118, "uuid": "431491e2-4483-4695-afec-bfbefd03b5ab", "comment": "Malware payload (CoinMiner)", "value": "8f0496ad782c0321ddbf5666689a6504a0b2b24bed97e0f7c47b86ac8dbdc67d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858118, "uuid": "414c33d0-cac5-4b0b-b650-78ae9f9310ca", "comment": "Malware payload (CoinMiner)", "value": "ac4f5fc19d72c7cbc1d5ae48e804610849ba0ba4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858118, "uuid": "a0d59c14-f8cc-4dbc-8a66-601263a3c763", "comment": "Malware payload (CoinMiner)", "value": "f26696dfe3615819d6280965915ecf090c0a00931920a792e487953bb3e493c36a06e3a8c3cad4817770ea0aafb64ae5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858118, "uuid": "2c1eda9d-b9cb-4253-b8b7-b2dbc1886fad", "value": "T125656B53F34086E3C4191031A91773971AB0DC876E9FA65B3798736DAEB3B817B42398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858118, "uuid": "0a7eb5d1-f1d7-42da-99ce-8ad5a7b5b936", "value": "b1c1e55b3870d704efa6fae5012c6523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858118, "uuid": "33e795eb-b381-443e-8056-3bd633712c1c", "value": "24576:nH3YEKZzcJ4fSlMz8yZ6W4HTFzU0Fb0M/ZKFNUhFlx/S:XFK3fSlMIy8WIzvD/BhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858118, "uuid": "34769ec6-0afa-40ef-9b38-4d346ae9f060", "value": 1413120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858118, "uuid": "e634197e-7ef7-4662-80b8-ac5d9034b90f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858118, "uuid": "d8a853c5-981c-49bd-8d90-403eda5f19ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9d737d-67cc-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668836374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836374, "uuid": "5fa192de-0c78-40af-a599-1810253ce8d6", "comment": "Malware payload (RedLineStealer)", "value": "620df8965f528754a08a978b67f31e67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836374, "uuid": "5600077e-dbcb-4263-8f66-a8b244eafd7a", "comment": "Malware payload (RedLineStealer)", "value": "9158b433505974c8a6db1f168c19604f60e46ed79f6981d8dbd42d49c1078a98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836374, "uuid": "8d585ba4-4f7e-4aec-af1f-ad647314176e", "comment": "Malware payload (RedLineStealer)", "value": "3c607ca2e52cf34611736d5ee3530ab3ad87e742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836374, "uuid": "43b4714f-5ff0-42e6-b198-0a484783da76", "comment": "Malware payload (RedLineStealer)", "value": "15e48325976e8de044e40083f49c59b6879bf5c8c10f066b6beeff625e1dee0bc610b974ba60caf2123abdb26c5d809a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836374, "uuid": "ef3a851d-b0f4-4d14-af62-8a9af01845bc", "value": "T1CD34AD03F0B441AEE1FED0BC0097E390922EA67E6F9D148FDB7E1B795B101D1A172699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836374, "uuid": "e15b13d5-655e-4597-b97a-3b9a98485eb9", "value": "19e0e0a97efc31b1e39a2bb2ebdd6fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836374, "uuid": "9994af58-aa83-4485-8cf2-a7552b2548c4", "value": "6144:L4ARM8aDXqQhylCuSWhQzL2pJH+m30CK2W1:/RMRDXlyILWhQzAH+m30CK2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668836374, "uuid": "b8166e29-35f0-4e8a-b4de-8471b06b15bd", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668836374, "uuid": "beb945c8-bca2-4329-acd1-53a7c0a2c490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836374, "uuid": "aa82a794-bea7-46e6-8c01-f5cde498ca47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1398dc-6806-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668861101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861101, "uuid": "26731569-fa46-482d-a3e2-4abcc4a3ee09", "comment": "Malware payload (GCleaner)", "value": "82123a85d2b6338ce949e84257cb0247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861101, "uuid": "ccc04429-38ce-4c0d-9ade-9f8944d20c19", "comment": "Malware payload (GCleaner)", "value": "917b27d9cf59653ca2a5ec67a52c5808f062b1801d8f1af341b599f30c4c3460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861101, "uuid": "25e8a2cf-9d38-4ee5-bb72-f7ef92efdc33", "comment": "Malware payload (GCleaner)", "value": "27a0d5caeabc356112c681a1e3371d638f362d13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861101, "uuid": "bcf0ba3f-1d04-4b13-b546-9645ca3a0e90", "comment": "Malware payload (GCleaner)", "value": "0b8fb2bd9c4d6314eb748334eed7d9a791ee8694f4918cc9d2eecc58059933ce23b26461c93543a47e7e569f7904f657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861101, "uuid": "60b9a53e-4698-4c20-89f0-adf98e9d129f", "value": "T195C5F045AA12D2A1C92F1DF4EA0074F949B67CA2E82EC27BF3957C5DFE7D353844A801", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861101, "uuid": "399834a4-bb7c-4b6e-94d4-96b0a4a78f2b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861101, "uuid": "1ea771e2-a459-4c1e-b9b3-c6acf908b762", "value": "49152:q2tan6E4B/tj8wyZY0013Z+33+NgDHXImIDEGyr4qYzUxVkBaFwnm:rE6E4vTyqr1g3uNgD3ImIDE/r4quUxV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668861101, "uuid": "99613b78-a760-4ade-8418-00e035b966a2", "value": 2518248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668861101, "uuid": "10955ec6-5d0a-47d6-b7d2-45bc92372459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861101, "uuid": "2fccc18d-fc24-4ad2-9560-f3f3ef3fc343", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adae7ea-67d9-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1668841901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841901, "uuid": "c793ad52-0eaf-4703-970a-dbccb2bb8c0d", "comment": "Malware payload (ArkeiStealer)", "value": "7e941ecf4002b95a59a2c8cfe7e88624", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841901, "uuid": "e0ecb1a5-76fd-4a3c-aa35-b70ecca50795", "comment": "Malware payload (ArkeiStealer)", "value": "91a734562228b80d8c8cf131a07f054d9fbc7709a21dc8f89909a5ccceb1ceb7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841901, "uuid": "d4689346-5e5e-46df-8381-d0c0ce53bad9", "comment": "Malware payload (ArkeiStealer)", "value": "e6ee448fe01db6d60760ed34a283f8172b0e93f2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841901, "uuid": "7d6e89e1-9252-4499-a7d4-b7ee36d6aa67", "comment": "Malware payload (ArkeiStealer)", "value": "932956e5dde1bf104e64b5d8f033af769cef27e93115bfee47d8174fdf47cc0760167494e91eceee585d587dfe8f9d2c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841901, "uuid": "3fe4f72e-b96d-4575-bf47-0cd560a17132", "value": "T14615CF5CB72996D0C926897378C60312D3BADDE41C9DC2C26A3D3DD1BCB69C53A4A8DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841901, "uuid": "cce44736-41b9-42d4-bad5-b6342d4a8b0f", "value": "24576:43i31tbTIv7798KFjruZWDUfAuTOAM5hSqzH:X31tXmaKFjwWeiAFqzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668841901, "uuid": "9c8d901c-0ffc-4cdc-9b10-468ed1870ae7", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668841901, "uuid": "99272ff3-8223-492f-bb1a-25121e5f453e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841901, "uuid": "e97382bf-f896-4a15-bc60-c0e7c508bc8b", "value": "7e941ecf4002b95a59a2c8cfe7e88624.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9832bf26-67ff-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858298, "uuid": "43b7628b-475f-44c1-a804-cbd644e346b4", "comment": "Malware payload (Mirai)", "value": "bd5c39675ba67bed59a3b1eef4b47aa1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858298, "uuid": "8502864b-a07e-4302-a8f4-984f3caff4cf", "comment": "Malware payload (Mirai)", "value": "935b0cdd82416532629d955dfcf03ec2b9576574df5158eb4ea5d4f04abad008", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858298, "uuid": "36653602-40fc-4c12-b8b1-e300b8dfc7ea", "comment": "Malware payload (Mirai)", "value": "5db4a0888d8b6cb4a69a2958734e3041d26b80a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858298, "uuid": "c5b1ee67-516d-4df4-b61a-c96537868728", "comment": "Malware payload (Mirai)", "value": "9336dd6f0c40b46faa008e871627f61cafaa35292622f9138739beba7e71e1e945fc0e3df8af7807b9440f6408b00315", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858298, "uuid": "cf226b7c-e02c-4ed5-9477-0703f569df7d", "value": "T1ED331A8968512D6CEAD758FD51768F0DDE642220A063031FA3EBFDC32D332A4FD55A98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858298, "uuid": "39317d10-e815-4bba-8866-5f6d889c15dd", "value": "768:jxoRapoxSug9pCympQHPDCXk8LHm3+Wel7r3abBskJ7BMxr+f1pruUh0Apep1n:jxtSSz9pCyaSLCVH3LI7BM5g1pZqFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858298, "uuid": "c49b65a8-60e1-4de4-b0e2-6f6ddf231410", "value": 54860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858298, "uuid": "1514fe89-cce6-48c1-b590-c2e68b481cfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858298, "uuid": "128d0398-a2f5-40bf-acc1-e065bf8d5c30", "value": "bd5c39675ba67bed59a3b1eef4b47aa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5f5cf4-67f6-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1668854416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854416, "uuid": "6470abba-0b18-4455-a48e-ac8d531ee87e", "comment": "Malware payload (RemcosRAT)", "value": "7a391075867a3febf2f0e3cfbefe9a5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854416, "uuid": "84226513-b4a8-40df-a909-8c787a9a5873", "comment": "Malware payload (RemcosRAT)", "value": "93a5ba05804d8ff143b1df9061c38ac61d23dc984319e3d00ac1d6bb07560b49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854416, "uuid": "c6a8d465-ebb4-4772-afcb-3792136429f5", "comment": "Malware payload (RemcosRAT)", "value": "979d4475dee2382272dfe9c5c3b1792dc11c1409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854416, "uuid": "671ab91b-1bf7-4f3e-9375-f900efc091c9", "comment": "Malware payload (RemcosRAT)", "value": "b2a9c041a25eeff524e1a5bd57bd648cd13d0feb570f9fe9ededda51e561cc91f528bd678e8092e633d20d21871289eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854416, "uuid": "7605a142-21da-414d-a041-bc82dfe895e4", "value": "T178A4AE02BAD2C072D57161344D2AE735DABDBD202835997BB3E61D5BFD30180A73A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854416, "uuid": "6c059639-35d4-4490-9776-5832a52c5698", "value": "5d354883fe6f15fcf48045037a99fb7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854416, "uuid": "83eb8e1e-e7d6-4dba-83ad-b2f6e4199125", "value": "12288:gmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSXn9:giLJbpI7I2WhQqZ7X9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668854416, "uuid": "435efb0e-c09b-4d23-bcf6-85a4871426d3", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668854416, "uuid": "12687ca4-7283-4773-8f00-b0d88adf61f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854416, "uuid": "7288ce4d-37ea-443d-9d89-ed6959d9097c", "value": "7a391075867a3febf2f0e3cfbefe9a5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288fe64c-6830-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668879156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879156, "uuid": "013a971a-f4b4-4a7a-97b7-f2202ea46d44", "comment": "Malware payload", "value": "49e12e0bd76941ab54dec0db51cd6e22", "object_relation": "md5", "Tag": [ { "name": "Blackrouter", "colour": "#C55BF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879156, "uuid": "0992c59c-35c3-41ce-9185-08a2753951a4", "comment": "Malware payload", "value": "93ef2fa0328042928677009615f67ff52fc95cc32f872a32cebadc370a30c3e5", "object_relation": "sha256", "Tag": [ { "name": "Blackrouter", "colour": "#C55BF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879156, "uuid": "b6b71c82-9b2d-496b-8daa-26ea7ccf0038", "comment": "Malware payload", "value": "da575ad370d523ed8017f354645dbae9f22180a7", "object_relation": "sha1", "Tag": [ { "name": "Blackrouter", "colour": "#C55BF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879156, "uuid": "4c194525-6caa-4f79-8756-ea4144c537dc", "comment": "Malware payload", "value": "66c74b0eb2501bf3325fdea884967433e5f91d1d580980117eb038a4dce48ded548f28433d7d9c8ef2b781bdfdb1d88c", "object_relation": "sha3-384", "Tag": [ { "name": "Blackrouter", "colour": "#C55BF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879156, "uuid": "39da8d53-d506-41d0-88ca-9b2068fbe3a5", "value": "T16314A9A9731C71DECF5690F1CD549CA4A6302F6EC23A0103AC53F6B9AD1D996BE14CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879156, "uuid": "f5d968ea-359b-4080-8de4-f8d1b815349c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879156, "uuid": "cdc650a1-24a4-4e55-86d9-08c1b34ed11e", "value": "3072:TLzqgCJOpVLvX9DJSfWKIBDJb3Lpo43EK:LZphvp8WKIBDJb31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879156, "uuid": "4bec31db-8615-427e-85a9-2c3d36bb117d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879156, "uuid": "96c9b67b-3ba7-4368-9a9f-4ac5499dcfdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879156, "uuid": "6a19cc1c-2c08-4ca8-9717-527bd2f0359d", "value": "BLACKROUTER.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f7f8d9-67d1-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668838584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838584, "uuid": "d2362bc0-6057-41eb-846b-2a7240fb136b", "comment": "Malware payload (GCleaner)", "value": "6d5fab44b58e9b631be13263fea37093", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838584, "uuid": "baa1592e-c2c7-4779-ad43-17a529b9e41c", "comment": "Malware payload (GCleaner)", "value": "93f54b703d952461467e70348ad2ddeb511010823cce059f7ec2b5b3ac3cda67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838584, "uuid": "fffed84e-b459-4b29-9a24-a249ab20015e", "comment": "Malware payload (GCleaner)", "value": "a08223f705380f6c6679801eb77a45e7f06a32e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838584, "uuid": "c2972db3-6d42-4b1d-bc7e-54b01758d67d", "comment": "Malware payload (GCleaner)", "value": "d58fb39b794474c59045df41a13e8732ae7a21daca99f3c9ffbb8ffca97e0c5a8db10cce4f10c0b90d161222faf91bea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838584, "uuid": "33222be4-de2c-4f64-8244-7b29b5a67ef4", "value": "T176B5F0516A42D292CC2F1DF0E66074F849BA3D66E82E827BF3963C4DFE3D3938419950", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838584, "uuid": "a11429ee-a7cc-4ed2-ab96-9891c455ada6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838584, "uuid": "27eafa6e-27c5-4489-878d-b2e662596abd", "value": "49152:q2v66WSWRVbtZFVvdE8ouWuGfHFWvd85psxPqk5EH0ycUxVkBaFwnm:rv66Wzbtu8sHppkCUlUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668838584, "uuid": "56af18fe-931b-467e-a8a4-2c75dd183ad3", "value": 2374767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668838584, "uuid": "078cad23-2d29-4f2a-9314-3c2a6040faf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838584, "uuid": "5bb81be9-5786-4186-a302-4d9ffcc93f29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd98e0e-67be-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668830474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830474, "uuid": "b6251cf8-4f1b-4cc3-a4b2-6f60afa1db1f", "comment": "Malware payload (GCleaner)", "value": "50356206ddd6b89c8a6a22dae966d39d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830474, "uuid": "6c517d10-1716-45ed-87b7-223cc6d50f6e", "comment": "Malware payload (GCleaner)", "value": "9425b10dc060f45d6ad013284d2a3437f238711aede54312d04177c6c87b7159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830474, "uuid": "850c9098-ca1d-4d16-94e4-31413b574d49", "comment": "Malware payload (GCleaner)", "value": "8eeb1081e0cfbf40c9209f8938bca3c718e9b7a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830474, "uuid": "da68b1ac-f519-4169-965f-25dbe8caf5a9", "comment": "Malware payload (GCleaner)", "value": "9bbfb2a66bb2bdc975efacde5dc24242a8055d674631fc422db1acc013e28a33d16d7b83cedf296ead3e4233dea7f99f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830474, "uuid": "59661cdb-e02a-4840-892d-d180b5bea804", "value": "T13FB5F0116A46C2A1C92F6DF0E65074F98DB63EA2E96E827BF7923C4DFE7C3538049411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830474, "uuid": "556c4732-4c2f-4c3f-92f3-d9bb3f9fac2b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830474, "uuid": "a1fdf6df-fb83-4358-9788-144473254e96", "value": "49152:q2HLSDa25GCzkIcmSef8Hk5k9vvzFv3KMCEGy27/EiUITTUxVkBaFwnm:rHj25pzkIcm8k5kdzF/KX8izUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668830474, "uuid": "b939addf-d817-4802-9f05-4c02931942f0", "value": 2494110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668830474, "uuid": "7ee18b47-3c91-42bb-8276-a32eda6f5afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830474, "uuid": "a09aebac-e3ac-4d04-a45d-629817225d79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2320d6-67ea-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668849339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849339, "uuid": "67d3fadf-2164-4681-ac79-264f2af3d445", "comment": "Malware payload (Amadey)", "value": "385cf6112b404a4cb8312039375129f0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849339, "uuid": "515f787f-ebe4-476a-b72f-2368ffeb1032", "comment": "Malware payload (Amadey)", "value": "9441c40f3c83146b6e640eebbc2192aea36d248702593f6bc6e35b397a42ea53", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849339, "uuid": "f2fce662-ea25-479c-862d-7d22a5d773b5", "comment": "Malware payload (Amadey)", "value": "05e33cd9fb07579e60e856d65bd276768d86db63", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849339, "uuid": "0d2663d4-1dc5-4e35-aa06-127272aa07db", "comment": "Malware payload (Amadey)", "value": "1cf6e4a4843440c2d759d5e6b97ef97c616e853a3feca2feec14323e80eb76825535fe0f9253223c2fdd50359a282aab", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849339, "uuid": "b91004ea-0aa8-4ec8-a732-4295bc2706f2", "value": "T1FA84CF3472B0C8B2E0714670C525FAE165B9EC207814D5077E14FB7F2E34A9DAAAE27D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849339, "uuid": "2176e2b0-9019-4ca4-9bbd-6c25327b862a", "value": "938ae2aaaa8ec1fc2d05063ef7a2e3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849339, "uuid": "4234deac-938f-41d3-8f90-1ce4658fbb56", "value": "6144:Msl951YcmjZrwa1Rc5IcBGLCJ0/hkjpPnFwCLLObfwB:/5nmFwaHqGLCJKCxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668849339, "uuid": "53ff4c9f-3a89-4017-a4eb-8e3fbe63302e", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668849339, "uuid": "78b3101b-2d91-4405-90a9-d7a5ccc2a3d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849339, "uuid": "68eb768d-09c3-4b7a-a19c-9c40453d1062", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23c4354-6808-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668862207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862207, "uuid": "b30a546d-feff-4322-99e9-1138e3f1044d", "comment": "Malware payload (Mirai)", "value": "5308a1b736ff23cd548307dc8ea3c457", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862207, "uuid": "aecf96fa-b45e-408a-b912-da8c4549741d", "comment": "Malware payload (Mirai)", "value": "944a41637def8580536a786c8c00ac3f976b2431e540f8408a40e48f23b4621f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862207, "uuid": "477e809b-fbb2-4bb1-bcc3-02bfa45dbceb", "comment": "Malware payload (Mirai)", "value": "a850ef3be7b0264419f57df3dfed0da7a41b69f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862207, "uuid": "82e373ef-11ab-4921-8f37-a998d36a9315", "comment": "Malware payload (Mirai)", "value": "cb6be71c65c7fb887357638aecb9f962019a3c77499a9dc7319768218e06f9c67397db2c0f1781225fed39f6a2dd8052", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862207, "uuid": "237e1f0d-1ec4-4b67-b227-2b16c7cd376e", "value": "T1B043022052AA39D146F0243F86EAC7A1B24F9F7448DF90BEB6BBD1757B1242B34F5401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862207, "uuid": "37e30641-8d97-419c-8721-53e9169ba483", "value": "768:kTtuPJ+ZYthwWuFKUw83v0I577OgWs4kwV1cyf93tWJut9q3UELcG0lIWl2ffe+0:kTDYthSvx773sFkJ5LcGsIo2fdksxhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668862207, "uuid": "31ac3faa-c150-4e5c-b7cc-2866e7f26675", "value": 55352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668862207, "uuid": "1c8a8915-cc17-46b0-8ca0-72a6c84eb890", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862207, "uuid": "b767308b-99ef-4b91-a58f-33ab8ef05f5b", "value": "dark.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e487b5c4-6864-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668901805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901805, "uuid": "3633082b-398c-4f87-a31c-e89db29327f5", "comment": "Malware payload (Mirai)", "value": "d231bebb5f01cb2ea6ac8ca06d66bc99", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901805, "uuid": "8da0b1b8-33df-4695-bacc-5cea3585b770", "comment": "Malware payload (Mirai)", "value": "95528c58c3b8eea660662c6cbdae050f4c748d44942028445f14529143892217", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901805, "uuid": "9e3556b1-557b-4311-86ca-d93c01143221", "comment": "Malware payload (Mirai)", "value": "ac5cb6eab8b8c2a21bb15d4b26434bb5bc806fad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668901805, "uuid": "df7e17bc-a8ca-4319-a76c-e1587023542d", "comment": "Malware payload (Mirai)", "value": "7319a6d32a144167e28982c78c2ddcbaf874a951ff3fc7eb338ff4d7997f485f729f3930177a00316d2f0f3188ba3c21", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668901805, "uuid": "03fe2e7e-dbc9-4add-a143-d57720890d78", "value": "T164230271840A9EB125303C36EBD9D793B6E12AB1C6672123CA1D0B3C2F757531E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668901805, "uuid": "7ebfe746-e9d0-4814-8ce1-9413161aa4c9", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3lhf9q3UELbUXfi6nVMQHI4vcGpvb:DECFd+A6YHAxlhOLRQZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668901805, "uuid": "d1c7f028-d209-42df-b449-4b6bb05919c6", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668901805, "uuid": "c8b8b537-146e-49df-ae3f-841bb69fd2ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668901805, "uuid": "1c517043-d27a-4a3d-8829-f5f104593ec7", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3afd72-6827-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668875404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875404, "uuid": "ae173efd-a867-4a7f-a705-2505fce01d5e", "comment": "Malware payload (Mirai)", "value": "2b2ddadb7da1ea51d0fede6f3543dc87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875404, "uuid": "98ea1840-46e6-4ec0-96db-58f986889791", "comment": "Malware payload (Mirai)", "value": "9561d74db5b44b4513d99e1092674488afc36656722d819fe5d08dae99c9f028", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875404, "uuid": "00bf071c-b9bc-4494-b3ec-0994afb7ce95", "comment": "Malware payload (Mirai)", "value": "4b92ba964c788d0aa9459cc3c701119a2ddb2518", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875404, "uuid": "a6d57cdf-c520-400c-a44c-47b307434295", "comment": "Malware payload (Mirai)", "value": "f9322820e11093f1e12c46294ae0c397eac9939fb58a4d3599b175b19f3eb2c7a1f3c96d1425fd6171e91fb9c066fd25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875404, "uuid": "d85d2f8f-1c91-4105-a077-187c872d6a92", "value": "T129539EB5C5ACAE58CA1440B8B514CD398723F408A5A72EFBD646C796900BEFCF1587F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875404, "uuid": "ecad74b2-f951-44c3-89d8-16fef53a3b90", "value": "1536:vaA9lnzF/mUUNztiYm26CxCYrzofs3QPyNxjNZpaJCr:v/9lzFeUUfwtkzUf+QaN9NZpaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668875404, "uuid": "cac5f6d2-fa2f-4ae4-8058-8deb9484d19e", "value": 63788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668875404, "uuid": "b58a77ba-44fe-4620-bdf6-89d01a1a4127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875404, "uuid": "55f6ece9-d5e6-4575-b023-e2c77c9e7775", "value": "2b2ddadb7da1ea51d0fede6f3543dc87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c151963b-6837-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1668882419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882419, "uuid": "68b108bc-f925-4f26-bc6f-691beaffcec6", "comment": "Malware payload (Formbook)", "value": "c7ed1ef5cb78c4fa7db734ea7bfc981b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882419, "uuid": "f80d63e9-5d4a-4860-a49a-b8adfc7318f8", "comment": "Malware payload (Formbook)", "value": "9580bddf76a3d9179e760fba40850e85f6dc3baad1356165b78cf160bad11f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882419, "uuid": "4c4c76ab-b5eb-4806-9e95-7eabefaac37d", "comment": "Malware payload (Formbook)", "value": "3aaf69a5b44ff33d314ca1e240ac17b7d780a1a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882419, "uuid": "a36c1aa8-97ed-43df-be0b-29a48a9bfd71", "comment": "Malware payload (Formbook)", "value": "fc80fc0a2305558e14d36519444ecc17390101d6dce75c237da29494cf5b601a308f18938a912ea9ff696a3d9784d867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882419, "uuid": "7d719b02-1550-4e84-bcf8-0bf4780e7f78", "value": "T1D4351201F7C988B2C1B22F325935B794AD783E601F24DB1FB3E4692D9B365902125FB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882419, "uuid": "da9309cf-8ae3-4a06-afb4-549f98fc7c85", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882419, "uuid": "4d66e422-6417-4407-b3f7-4ac93fc5a09e", "value": "24576:LAOcZXMu+6mYxFdv0kpLr+mNUqUjLzCXPQMTjRnt3u:NMxf0fmNVaCXYMT9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668882419, "uuid": "2cff74d7-43cf-4139-a7d1-1663016044ef", "value": 1157112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668882419, "uuid": "3538d08b-4ea2-4973-8eb9-359f6b724a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882419, "uuid": "69eebc97-f25e-47e4-801b-222170cc8210", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4771e65e-6832-11ed-9266-42010a9c0072", "comment": "Malware payload (Glupteba)", "timestamp": 1668880067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880067, "uuid": "c4a0be4a-7b20-41c1-9f82-578df54e57e2", "comment": "Malware payload (Glupteba)", "value": "976468fef0a9d5864aa7abf46e435b51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880067, "uuid": "4cf6949f-942e-4c03-87ee-f228229bfe16", "comment": "Malware payload (Glupteba)", "value": "95cba00443a1e709507fbaeb51205b88c204f3011686868c2b48512cde732db6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880067, "uuid": "e4ebfe8c-7f3e-475d-9da8-e20d940cd8d5", "comment": "Malware payload (Glupteba)", "value": "c3187dbd13d8d955c54e026eb3a5bf7836638c1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880067, "uuid": "6dc60b67-823c-48cb-bbe3-c9bba5161927", "comment": "Malware payload (Glupteba)", "value": "6e574d78b02b7bf213dd68f912c8cdaca3795347b0faec3828e29bd5d65c0e2da1bcd832492a8b5fe3f9cf3766057477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880067, "uuid": "ad9372fa-354f-4995-83d1-fd439cbcc3b2", "value": "T136264B90E9EB10F9E7075A3045E3523F6731620A973ADEC7C7402E96F46B6E11A73227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880067, "uuid": "8cac231a-28e2-4fa3-b903-4b5aeb4aeec9", "value": "f0070935b15a909b9dc00be7997e6112", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880067, "uuid": "39d8c27e-685b-4808-b8ce-01f13224d53f", "value": "49152:DIeU0gBPKUZITukVOA3F0A/aCaPvCButqcAb7/i:DPeBSUZIqkUA3r/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668880067, "uuid": "50f1569c-f7b7-4184-8e69-9e287aa9a4ab", "value": 4463104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668880067, "uuid": "0cf43748-6f25-4469-9a07-061a79851d86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880067, "uuid": "d42ff556-c6de-47ed-93f7-5ff3a3bfd85a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e58318-67f0-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1668851847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851847, "uuid": "2230cce0-3d71-4b71-bcef-41c85b7f84ca", "comment": "Malware payload (AgentTesla)", "value": "986d201be0de714e6e89fdb89af8f172", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851847, "uuid": "83e27eb4-d2f8-4fd9-b799-fd2f971648cd", "comment": "Malware payload (AgentTesla)", "value": "968be89e91c52db13b473bf5894e1b11de82551176fff293d752e388f7e83175", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851847, "uuid": "6d7e5a7a-c25f-4d7b-9e7b-ba557f530506", "comment": "Malware payload (AgentTesla)", "value": "95f4ffc07db4709c9d148273320cee228fbf088a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851847, "uuid": "500375c8-4e1d-45a8-8418-bf735ba894fe", "comment": "Malware payload (AgentTesla)", "value": "ee2859787539f04e43c6a6ad1f059787b5e06bd67551d1784c6ff2895aa7525c29f93d9ac09c577f9d9315299833c58a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851847, "uuid": "e1c18e97-2c91-4bff-b3d5-95fff519b736", "value": "T1D805392DB9BCF412EE3AA5B71EF69E4BCC305141121E811B0D2937DEE86587A3C4E54B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851847, "uuid": "f7f92d83-7dd0-4650-ac1b-a89b72aaffbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851847, "uuid": "5f3de5d7-9c38-4a6f-97f8-a142c61e7801", "value": "12288:IWuFITqcSpFKgLIvGTU5YakRORcm4Y2JGAfmjobA2r:MFnc4FtLIKakRDVhug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668851847, "uuid": "be41ffbf-7c00-429e-bc7f-32622fb0289d", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668851847, "uuid": "b8dc29d3-1502-4166-b4e3-a0e1ee47e4bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851847, "uuid": "a922042b-d75a-47dc-9e44-549da8a6c300", "value": "Purchase Orders.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1416c52-6802-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668859602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859602, "uuid": "df97d7a0-0be7-411a-aa76-69af4a3eda5d", "comment": "Malware payload (RedLineStealer)", "value": "5419be1a60c23a2d2abeaa8956340967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859602, "uuid": "8c0efc6a-fc73-4ac8-8833-7721629801f3", "comment": "Malware payload (RedLineStealer)", "value": "9746de42e598888d36496f78c8cdb7145db4fa524ab4fa924ce7e2d19480731c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859602, "uuid": "cc6c52b2-1963-40ba-8ae2-bb59d58f85d7", "comment": "Malware payload (RedLineStealer)", "value": "82fa963ceb4b04e13c7f6e0a46032ef8050eb1c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859602, "uuid": "747176ef-5e52-4262-814f-33203f805ca6", "comment": "Malware payload (RedLineStealer)", "value": "2370852280c4cdf0fd8782d48e2ce8fa21882b1401e617ab0bdb8619087f675a21ade8eb647e5c7e57b8c27712aaf4b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859602, "uuid": "cd8817fc-a43a-4855-8d1c-f774f45b2f8d", "value": "T17C348C1374807536F9ACC7F5C89D9E16457FA7E1278022CB152C072946F27FEEAA830A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859602, "uuid": "afd4f301-3757-44c2-8c79-38807a68902d", "value": "19f81fe756f31ae8a7d11110e6e81c7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859602, "uuid": "b29bc8bf-5cc7-4098-9c25-9d271d0fdc1f", "value": "6144:a208XSOBUewg89TjLctzA1jqb7ZdGv2GkLZmHxYKcTrL:b08COKe2TjLctzA1jqb7ZdGvlVmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859602, "uuid": "a85984c4-62cd-40db-b29f-92cdeceb0f16", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859602, "uuid": "c8937a97-4d6e-4827-a48d-271d4ba3dc53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859602, "uuid": "0c114276-aa1b-4c55-bff2-8641bc5e79e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98606dee-6806-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668861305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861305, "uuid": "f04bbf23-acd8-47a2-aff6-98c2c9292df5", "comment": "Malware payload (Mirai)", "value": "f60551c262d4e2f850651947034099a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861305, "uuid": "a95f9fb5-9699-4001-acf5-f5923c308176", "comment": "Malware payload (Mirai)", "value": "9842eeaa30e95b4d44af8e667d18907e355cd95cddc59c6463eb31771ddad87c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861305, "uuid": "5fefe5f3-e216-4948-829a-59cced3186aa", "comment": "Malware payload (Mirai)", "value": "e8541ed626cadec43cef7a806a7f9db23e8bdf2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861305, "uuid": "037361a6-f77d-40a6-a0d1-7047882731ef", "comment": "Malware payload (Mirai)", "value": "4983b4cea7f147f49776e3cadf10df6499b3e65f1f5eb9d34038af4aa35e55956a7894a2b6028e8dbf4a61d8b468ce2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861305, "uuid": "9013ca17-b1cc-4e14-9dfb-0c96621c28a6", "value": "T17C539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861305, "uuid": "60cb70bf-f759-48d9-9762-4ee4ed1a7ed5", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668861305, "uuid": "1d08f457-d71c-4b62-a3a2-ba7339130c4d", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668861305, "uuid": "bd775389-7054-4c54-a504-65f06233c253", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861305, "uuid": "f2a6cd9f-620c-4c86-b507-a47fadc7d180", "value": "f60551c262d4e2f850651947034099a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e278dfb2-67a9-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668821486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821486, "uuid": "8b030178-5f38-4307-9dae-d3674ea34923", "comment": "Malware payload (GCleaner)", "value": "577bd4243e386edbc82d7c90d59e9463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821486, "uuid": "b2646679-3a52-424b-b88e-cde9a322a20e", "comment": "Malware payload (GCleaner)", "value": "990df27b25a0189c0117b30bcabbf56f7e017d50f309fe7fad9ee0fe724fdfcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821486, "uuid": "70b39375-7318-476c-b5a0-dd51dbeb6a7e", "comment": "Malware payload (GCleaner)", "value": "08b8186cc2b86a45741d2ec6b82bfd05197ca138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821486, "uuid": "f15960de-eb13-4e6b-8e80-3b4e069ad338", "comment": "Malware payload (GCleaner)", "value": "32c648ed3f3e402ec7be28b92a8eddefd4166bce0a21856add7ff42de9d2f3cda63760317fe28cd96966c790d222bb72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821486, "uuid": "53637b7c-50f4-4daf-be4b-d4a0ec024086", "value": "T13D953357C6C199B9D064DA349E20525BC2BAFF30DC64393E3ECD5ADC99368901622BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821486, "uuid": "cb43fc05-6756-45a5-af95-4b6d29de0b4c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821486, "uuid": "5edc63d5-b55a-417c-9f21-94443e6be1f6", "value": "49152:q2UCMNtnTvPr+G5dOyySxtwDGQ/yjq/UzpvAMTsu7HyHfRx7Pq2:r3M3LDbLOyySxmDG/tvAq/7SPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668821486, "uuid": "9cd26f6e-9c2a-4fbb-9ba4-5ad2b9502306", "value": 2050494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668821486, "uuid": "44e0b53e-a2f3-4e9e-ab34-75de3e46221d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821486, "uuid": "08e4dce1-9992-41ae-a1dc-27f4b512d273", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fa7380-685e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668899097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899097, "uuid": "00ef7460-47c7-41b5-a15e-f1b63fd098e1", "comment": "Malware payload", "value": "4b7274017184cb204757b8ce3fcfe2a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899097, "uuid": "3bc117a9-9f2e-4550-8a0a-d3d98b9d289b", "comment": "Malware payload", "value": "99697e7265b579f6e6b19470f0b7daf6b150b57e78f28041a63cc0bbae76caf8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899097, "uuid": "be7c16c5-09fa-48b6-9e70-f6938a32600e", "comment": "Malware payload", "value": "e48b9dba9a61ef894d27524bc7944a08ca48f8a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668899097, "uuid": "d7cef74b-5c45-403f-9dc3-c1a725707001", "comment": "Malware payload", "value": "5db9c8d214b2b2e3b1b49f6f34ccb97387715770535f0e2295126e73dfd2034d709de7eff9b0c65bf51bcc31a2845e20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899097, "uuid": "a774abef-dc92-4ddb-92dc-4f60ebb4ee0f", "value": "T1C2C35C1370846436F4DECAF884ED8A55953F77F0178061C72B8C0B595AA23F9AA7832E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899097, "uuid": "cb7df6cf-19e5-4028-92bc-1609b1300949", "value": "19f81fe756f31ae8a7d11110e6e81c7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899097, "uuid": "e5db880c-180d-430a-884f-1552273276e4", "value": "1536:iZYsofKZRLb/N2N0QLP9z9kLqY1pEVwS02gy5H6Zh1wJPf2:mYs3ZFb12PcpEVwnVyAvq32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668899097, "uuid": "0ed08f4e-b5b1-4091-926b-a0c1d92e28b0", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668899097, "uuid": "b41c330e-7fdb-4a4d-8add-ba5e537eee78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668899097, "uuid": "e4428a35-c349-4332-8fa0-4c16d933abf0", "value": "4b7274017184cb204757b8ce3fcfe2a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b357e450-67c5-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668833433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833433, "uuid": "cb8fde21-ad17-4838-a04f-f2595c10326b", "comment": "Malware payload", "value": "b341ed23df569945a6ad9b0fdad318b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833433, "uuid": "4d8c8ab2-acba-48e3-adc5-42f4caabf4e9", "comment": "Malware payload", "value": "99fdd0a65aaf6b535e4383a9e65981d722b54b6776870ad65c4ea634e14d0dc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833433, "uuid": "6e2f9ed0-394e-47ab-8e6f-f379f0ee6a40", "comment": "Malware payload", "value": "f0534397c4c960ae0bf73e9c31635e587206097d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833433, "uuid": "125e5a1e-c903-489a-aa0f-887fe635b410", "comment": "Malware payload", "value": "85d3e2d0aa1961b218bf900caaba81e1158631a6c609ede72587f33587d37bd429ca8cf18c6752cf638dbfd3781efafb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833433, "uuid": "4df02d30-7cdf-46cd-b711-faf5f52efe1b", "value": "T1C176336176FAC8F6C2A204728C140EDD63A6F2444A91BC6767225B1F6FFD68FD430A35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833433, "uuid": "bed2cd41-85e9-4067-b8da-0411ac224333", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833433, "uuid": "6e3a9005-120c-4655-aeb1-793b16215ba6", "value": "196608:91OADghxgJ3dbZIfs1uRLWt7R7NHlgVpQH9evpN:3OAkhSJRZaXIltdqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668833433, "uuid": "a3b115fe-3cc9-46dc-b9c1-e37a3862dab5", "value": 7606126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668833433, "uuid": "befdfd8b-3301-4741-bbc2-c960f3157e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833433, "uuid": "3167b2fa-358e-4004-99fd-5d6aa0300347", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d93b13-67b0-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668824129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824129, "uuid": "c0faf51c-e210-4894-88c7-fa337514c214", "comment": "Malware payload (RedLineStealer)", "value": "40ad46ca2f94bca0e2e50942fcdb045f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824129, "uuid": "d4fe1441-4d64-4d54-bf1c-7fcf314309ab", "comment": "Malware payload (RedLineStealer)", "value": "9a11305a7524bab8a9c9beba2ee51f9f3f43d3492d62404d16db4dad089c2a4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824129, "uuid": "d4386690-ce96-40af-9b66-637512a2e537", "comment": "Malware payload (RedLineStealer)", "value": "47e5ab100e4a5352e5f337a178ae33753760171c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824129, "uuid": "31c3efa5-c2ba-4e02-8c27-1ec83498a7a4", "comment": "Malware payload (RedLineStealer)", "value": "7d13f3ea2373f064c8cd6556f50c30fb3eae02ecbe1ff147bb5983ce89abcfa984e12db8c8b34157a5070d4cd3a20689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824129, "uuid": "ed160040-7fdf-4b2a-b2ee-554babb78834", "value": "T12E34AE03F1B541AEE1FDD0BC0083E790922EA67E6F9D148FDB7E0B7A5B101D1A172699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824129, "uuid": "c2e44920-10fe-4144-a60a-0170d03e7807", "value": "19e0e0a97efc31b1e39a2bb2ebdd6fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824129, "uuid": "063d1f33-196d-448c-bf34-17e4ad4ed951", "value": "6144:d4YRMLazRHhylCuSWhQzL2pJH+m30CK2W1:9RMOzRByILWhQzAH+m30CK2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668824129, "uuid": "d24a2b48-6bf8-40b7-b4cb-a3546a2aa2d9", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668824129, "uuid": "b6839eb9-2ba4-42f1-8ed3-55bc8830fc47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824129, "uuid": "f88102fb-1539-446f-8150-938e842f598a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed29d3d-67da-11ed-9266-42010a9c0072", "comment": "Malware payload (CryptOne)", "timestamp": 1668842310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842310, "uuid": "adf87a01-7ec5-467d-811c-bc6ae583e8f2", "comment": "Malware payload (CryptOne)", "value": "8ac52504d7d9a72b9a7032859f6fcd73", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842310, "uuid": "25d0580b-a65d-4aa1-8357-8486840fa4be", "comment": "Malware payload (CryptOne)", "value": "9a36b21d87356c8c5d4ead58873afa409625bed5b0df65441b704806723d5f8a", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842310, "uuid": "88685293-3c87-430d-9e16-c477021385cf", "comment": "Malware payload (CryptOne)", "value": "db6f0c4e0430a1ec4631b5540008577129225568", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842310, "uuid": "3d45d117-dc2a-4e33-9fff-42d542d922cf", "comment": "Malware payload (CryptOne)", "value": "b1fa17cdb69176d1e815c1be891af8f6eede733e319eca940799ccf2c47ebfc3ee24b2587c29934c9a7226aaa9c9eb1c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842310, "uuid": "0d413236-3571-46e9-a750-8de6e696b598", "value": "T1907522203EC09471D132693499F9E734A939BD311F258E8BA3D46A7D9F701C19B36BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842310, "uuid": "ed8f0302-1d07-4067-b8a0-ca37d863772e", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842310, "uuid": "e00268fc-a5e9-4066-a4ff-55ce723b4e6f", "value": "24576:zry2uXzmwLS8mr77oNLMIfgqMhg/0LXE0hoDAa5GQ0FwDdLBODbGRJ9IvkkKmw3J:zuntQiea/yEoo8M2FwZLYGRvIsX53J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668842310, "uuid": "1b4c9209-7420-4a06-aedf-d767df8e9e5d", "value": 1606711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668842310, "uuid": "e9b0b1e6-8c0e-428c-8db6-926c6bdaa2d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842310, "uuid": "40c58788-de8d-467a-9fc0-8b55f47cd192", "value": "8ac52504d7d9a72b9a7032859f6fcd73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8dcb99-683b-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668884154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668884154, "uuid": "88ce69c7-ba02-4099-b60d-bed91bbedee5", "comment": "Malware payload (Amadey)", "value": "aaf3cdd0223fae89b9916701b7d92809", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668884154, "uuid": "cb48ee5b-634d-4058-810c-0a8bd09354fe", "comment": "Malware payload (Amadey)", "value": "9b9fc5c3d715a62020bc9d481264f599d5828379c38e10eb35e0d34f80da3589", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668884154, "uuid": "fc101dd8-73dd-4a22-9206-5d3befcc6ade", "comment": "Malware payload (Amadey)", "value": "3f1ecab32889528779d5a6f8c364f4d915e5502a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668884154, "uuid": "e17f5e65-fbe1-4d0f-9471-071f2ecf0fbd", "comment": "Malware payload (Amadey)", "value": "ab2ca1935a6e1425c2f4d195e6808f1bdafde273ad68a0005a4e2cbc9a66bc0532e1b695f1ace434b90d142fe3f4f040", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668884154, "uuid": "00dc1fe8-06f4-4f9f-849c-f210f388dc80", "value": "T16F74CE10FED0D0A5C47DC570FA16CBE86EF9ACA17D25DA9333342B5E2EB02518E62275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668884154, "uuid": "bf3f643b-83be-484d-869d-8d488903d083", "value": "3a28fc6cbd66b78dccc28e56534d2c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668884154, "uuid": "a3882cc1-c585-4003-b5d3-699581b112ea", "value": "6144:QlOOPa7szKUu8vLA+GwjFxULiyMhVVPE+O1voXc:QlOOPa798dG8FaLiXDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668884154, "uuid": "507a6219-2615-4b44-92ab-861bc3337aef", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668884154, "uuid": "064eadbd-10e5-42b6-8612-bb2f7e0e1af6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668884154, "uuid": "76b38ed8-4975-4095-83ef-5f21d94ae969", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14920ddb-6811-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668865808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865808, "uuid": "47fa9604-36e6-40ae-a9df-c3280cf205cd", "comment": "Malware payload (Mirai)", "value": "162f4349810e29fd8c7c2bffb14666fd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865808, "uuid": "5f1a716b-a14b-484d-9a13-6ef80bbbac08", "comment": "Malware payload (Mirai)", "value": "9c50535782cd9306edc0a97190022fd2267e95b2acf70bbebbd4df58cfca84ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865808, "uuid": "bce36ee4-c274-4e8e-81aa-cccefabab4f2", "comment": "Malware payload (Mirai)", "value": "acd3876397fb8dbb6f60a0e8b8dfc2a6fd3f300d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668865808, "uuid": "7ef78d0f-6964-491a-afd6-3f24b1ee2230", "comment": "Malware payload (Mirai)", "value": "313777e6648db34be2735ec4e975aadaa9318d0d741f62b146a66859bb3131604bf8a178946d21ff263d369802b1d097", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668865808, "uuid": "a45a9d90-a920-4b4e-92c7-67555cdffa3d", "value": "T19903F21219E46C2BEE71E536FEFD42C107A703B0E39D77236A5062B6B94A043987B1D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668865808, "uuid": "b06de86c-b8f3-4816-bc6f-f8daf2e13b10", "value": "768:ZfEo4o0Xk9NrvN70QecSlHbcdrzVeb3OGi7s/Ekok3qsMis3Uozz:eo4o0XkHZerbcdrzVeb3pmgEtFZzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668865808, "uuid": "e5a14f49-f02a-410d-8f05-c7526b737a7b", "value": 39972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668865808, "uuid": "5f8dda86-70be-4333-bd2b-63843ce0fd73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668865808, "uuid": "3ccc2fe3-99e8-477b-93c8-7796b6c7579f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fac2117-67d9-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668841882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841882, "uuid": "aed69e52-f8d0-45ef-8aec-06ef726401f3", "comment": "Malware payload (GCleaner)", "value": "0c7545baac2cffe7d1ffd57a7775dbbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841882, "uuid": "14735146-fe52-4d21-9d96-42671bad2bfa", "comment": "Malware payload (GCleaner)", "value": "9c8e8b7a65db59215b739fb24203f56fc13a317b981c0b76e2d7b23000abe354", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841882, "uuid": "2cf74a31-4794-4031-ae7b-744c878c5e96", "comment": "Malware payload (GCleaner)", "value": "a6a6f7ede7dd6b77f11286e5508d09fec6b13dd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841882, "uuid": "bd4e44ce-78bd-4bea-97e6-1c47e1de5600", "comment": "Malware payload (GCleaner)", "value": "f762a149d1d1e7591865458b76670937ea2b1a138fda82cbdc18c848ff652831d4d3621b5ada8c7517e919b10a597318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841882, "uuid": "1987e452-1753-4e91-b7cc-7e3168d1624b", "value": "T1B894DF513690FD72D5C56031882EEBB56E7EAC506F258AC773B4FF6B2E302D069B1242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841882, "uuid": "c111ddda-6702-4220-9150-2b98aca5d386", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841882, "uuid": "25f991e0-3b5e-401e-931a-440c5bfd9f69", "value": "6144:kRsJVzAnrzn+PfTHpbNPHPXNIFHiMHca5oBh+3oQ9gOU+fzYBb6:JJWrzn+HTpB/yFfbj9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668841882, "uuid": "0d4a68aa-bc08-47ed-aac1-9c15a90a9994", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668841882, "uuid": "31960508-69b0-41a6-b45c-cbc4a95bf113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841882, "uuid": "c6320a7d-a4a3-4efa-8406-a8b64cf4b0b3", "value": "0c7545baac2cffe7d1ffd57a7775dbbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f6bd29-6800-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858610, "uuid": "4cb3775c-d764-46ca-bc7a-4b585b0b6f31", "comment": "Malware payload (Mirai)", "value": "35f30f878173314d6207ca69fdb07996", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858610, "uuid": "06176d04-f49b-4443-9664-fac0b09c0c38", "comment": "Malware payload (Mirai)", "value": "9dccd6a327b40001f32d2b8c010e4e5bfe76fec8d67b52f9c9d377d884b73fdf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858610, "uuid": "2b837b53-497d-43cb-8d70-10b40629a590", "comment": "Malware payload (Mirai)", "value": "503c997d0c99d35f5f7189ac994634f642e68d5a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858610, "uuid": "e2115b11-a1e6-4b22-a1f4-7070b3523c62", "comment": "Malware payload (Mirai)", "value": "430d2e0dafd1f288074983a5f18f2ea4406e04946c39794656aafe0833b7d37367592fbb1e1d7e6bce86553576a88b09", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858610, "uuid": "fb7b8e87-29d8-4a9b-9818-39750b1a6c45", "value": "T17A231841B8818623C6E4137AB66E46CE372563E8E2DFB3179D221F503B9682F0D67F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858610, "uuid": "821fbb8e-325e-48cb-a1db-57a226c4493a", "value": "768:p9T3kFvFsOvIZg3VevqKxpn9m+/8KOUfPoVs//N+WX7JTzLgwo:L3kFvqOv0Q8lg+fF/z91o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858610, "uuid": "dc59f5e6-2bae-4e23-9537-508c99ba212e", "value": 46864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858610, "uuid": "f35dc423-b462-4ff2-8f88-6881a8b53b1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858610, "uuid": "16d04af8-2a0e-4537-a963-3cadcb9537cc", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda80400-6831-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668879863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879863, "uuid": "894a7131-f219-4e04-aa23-b3662c21e058", "comment": "Malware payload", "value": "44a7e13ecc55ce9797c5121b230d9927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879863, "uuid": "f672b02a-7ef2-474d-91e3-2b0c01f20696", "comment": "Malware payload", "value": "9e0425e14520485fa7e86057d07d26e8064f99a7ad09e35211edd4a428ee57ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879863, "uuid": "c2ec0e7e-4972-4664-a80d-803ac7aa99fc", "comment": "Malware payload", "value": "b99f1d86e6d9c7e0d694ca605abd205663278487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879863, "uuid": "b8032e63-86fc-4588-8125-30999588e382", "comment": "Malware payload", "value": "9e809756987fe1546ba2c14c601fc5e421061ae1ec280ac0fe327a90bb21f502e418c0f1bd1353a10a16c58250501c08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879863, "uuid": "60ba8ab9-9d57-4900-b161-e13428dd2936", "value": "T117E5234422690CF5D4728179EC42264AF933B8924770EBAB13E8671BCF236D5AD3F791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879863, "uuid": "8be9fda3-9554-4d35-95a5-a4ccdc1e302a", "value": "f777c957cf02d8a283fc1fa1f4fe21b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879863, "uuid": "64783c71-8cfe-4d37-acaf-befe6a001142", "value": "98304:9R5aeXkEIsmuDvFmvNtLmVLF5HLiBrvpPFI:9Dv5lJz4v3LMLiBrh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879863, "uuid": "0143764a-b145-4652-be4d-a58d017f8d41", "value": 3188224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879863, "uuid": "4fd1b3a4-c783-4077-9061-139b4dd0c9fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879863, "uuid": "64a4be9f-130b-4965-b4c5-34733cd5aa3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98af8ec5-6801-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668859158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859158, "uuid": "d1cc7b0b-fb43-4909-b2be-66ae05cf386f", "comment": "Malware payload (Mirai)", "value": "f4b2bdf0c19474327bcc2a20b2426744", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859158, "uuid": "862596b8-7007-4fad-9045-a4a0edaff40e", "comment": "Malware payload (Mirai)", "value": "9ee03c27abfd2a59a2830380ab3366e6cf7d6d755a768b188f0f1d9da8d39ca2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859158, "uuid": "a049cfb4-98a4-45c7-a7e1-79748783930a", "comment": "Malware payload (Mirai)", "value": "33fc91feae86715c20e831a901f8c16d4e9ddf98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859158, "uuid": "6b07d829-fc83-4304-a72a-233c88afe902", "comment": "Malware payload (Mirai)", "value": "ea1e9bcee47c3b23f71774c1956affa9a7a6dde6b8336df19c442efd5f269ad6b054d1625da80f0689a789fa853ac56a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859158, "uuid": "c3606f4e-018f-4919-b00e-1462cd19c3ce", "value": "T188534A8A68424E2DE9C35CB894764F0ECD541351A4D35B07A2BBFED739B36A5FE02C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859158, "uuid": "ca38c551-a12b-4fca-b370-3aa0cd04532f", "value": "1536:tFVvY/ANVJfQvgdO7J2Cvtp9/V770k/6g1pkZp:t9LCvL9ycDpkZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859158, "uuid": "a103bf62-97a8-474c-8f39-8384e2928b22", "value": 65984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859158, "uuid": "ba11594c-0c66-4697-956b-55aaa0fabcfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859158, "uuid": "ee585467-8ce7-4325-9135-8867a33d75d8", "value": "f4b2bdf0c19474327bcc2a20b2426744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df6e26d-67ea-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668849154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849154, "uuid": "e6c63b6c-7e4e-42d6-9ac4-34dedc100580", "comment": "Malware payload (Smoke Loader)", "value": "6c7ecc0bcdb84124d26b1b0c42413e42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849154, "uuid": "7fd68249-6ff9-4d6d-a2f3-3738ce06640a", "comment": "Malware payload (Smoke Loader)", "value": "9f1e06250105f439c99d3dd3c6212632f3f743ae8007bc24370e0699ba94b368", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849154, "uuid": "1d772a86-15d1-4179-95ed-422c2939340c", "comment": "Malware payload (Smoke Loader)", "value": "e82b757ab4a5ccf5b30a3814a398d0ac6fcd2278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849154, "uuid": "543fbed7-ad01-4370-a125-d58e2cbc9a5a", "comment": "Malware payload (Smoke Loader)", "value": "7025bd31fb17a45f029d2fd24f14d13cfae5b3fdfd74ddffa223454846570ee06eac86079d180ce41dfa72f30defd377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849154, "uuid": "916898ba-0da7-4f4f-83f0-bd5a6ff79873", "value": "T1FD74BE3872F1C4F1E4664670C825CBA16AF9EC217924DA073354FB7F6E30A9C966E235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849154, "uuid": "26460ebe-9a68-409a-ab4e-7735f4f72970", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849154, "uuid": "ad9a11a3-65de-4149-8c52-4be960b241a0", "value": "6144:sSe/y4znqrPYFhvAihqwu8XJfHRjpPnFwCLLObfwB:e/yqKPDqu0HJxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668849154, "uuid": "e9fa4fae-94c9-4510-9cd9-46eacda017fd", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668849154, "uuid": "91676119-af10-4a86-bad0-2ada01aa5313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849154, "uuid": "9da95ac6-bb97-4da4-9d02-7217fecc810f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d0e8e9-6818-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668868983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868983, "uuid": "9c5a5f42-ba76-431c-b18d-04151f0a54f1", "comment": "Malware payload (RedLineStealer)", "value": "eeed0a75a776f47d3f000f6f8fdb7f0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868983, "uuid": "2317d0bb-a5a9-4463-88b2-032285e28ad1", "comment": "Malware payload (RedLineStealer)", "value": "9f802a2ecff20f749a93b197cb18ae6b67eeca85b12f801f3d5de0bae0c54066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868983, "uuid": "1f0152fa-8336-4ae7-b95b-a864e61795d8", "comment": "Malware payload (RedLineStealer)", "value": "2228248e9126bb55797aa23013291731bee52c0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868983, "uuid": "31822b9d-e063-448c-91d7-df35be44a7c3", "comment": "Malware payload (RedLineStealer)", "value": "71b3a4221785962bf926b36ebadcd7c9e405211f840885e533fd6b1c8312711b65bf52e5298355d53842afb0e00ca148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868983, "uuid": "51855b31-7cab-40c5-b0e8-ba7beea72d80", "value": "T1B6B4E03076B0C4B2E1614670C025DBA5A9B9F9A03415D5073719FBBF7E30E9E4A7E23A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868983, "uuid": "65f4a6d0-1fc9-41d1-a913-5267b11b9d62", "value": "063e5449636b8762744e9ce9f5564a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868983, "uuid": "39ce4fce-c3d9-498c-a7d6-48e999c05456", "value": "12288:eddTvPjeW+toUvCl70z5crRZt0pHxqC3O:edFvPSWzo5crK94C3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668868983, "uuid": "a1e53085-b10d-432a-9a0d-db974e7935d4", "value": 496576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668868983, "uuid": "d871cbf7-6356-465d-9269-4c98b660f880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868983, "uuid": "520ad4bb-f60b-4531-89c5-91f91da05f59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf0923b-67ac-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668822686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668822686, "uuid": "0b81c164-9015-49a6-b860-29af06fad948", "comment": "Malware payload (Amadey)", "value": "9120a1bf4b440d99ab51fe3f14d79708", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668822686, "uuid": "926ba8ec-93cb-4dc1-ab42-1d6ea685658d", "comment": "Malware payload (Amadey)", "value": "a00b414b422067db2cca0ff03dfe181371ff6d4d24055f833f071f875ebcb6bb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668822686, "uuid": "b3513c4b-eb1c-4200-8c50-42ef97370c59", "comment": "Malware payload (Amadey)", "value": "fccfcbef826bf721302bf13402cf038e78aae471", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668822686, "uuid": "96650327-9f4d-4547-a7d8-cb76d9f661b4", "comment": "Malware payload (Amadey)", "value": "c6f9a91a4bcfba8c64dea4d2b9811af0ef2762500548f8eb056d14c571ff9800510c8c3d56fed090d09e20438c1fdd70", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668822686, "uuid": "047d3a9d-e0fc-40dc-8893-79739de2a3db", "value": "T1DD84CE117694FD72C4C20175682DEBF56E29EC614F2189C732B8EE7F2E302D1A6B225D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668822686, "uuid": "2f3b132a-81b4-4b70-9da0-fc1cd11f98d7", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668822686, "uuid": "f7dc5c1a-21f9-4470-a4b1-8e845d65b343", "value": "6144:Dt8b+xzUrHLccmnRLom8xdrJisRGh+3oQ9gOU+fzYBb6:iS+EVhUJisRB9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668822686, "uuid": "2648c786-3c92-4d17-9a50-d4b5f857b342", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668822686, "uuid": "80aaeb68-ebbc-4342-8899-e37ebb1e8978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668822686, "uuid": "4c5d57fd-f6c4-4040-8677-9f580404f454", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34997007-6859-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668896786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896786, "uuid": "32f6cc70-22c9-4448-b423-eae9bdb7e3b8", "comment": "Malware payload", "value": "0d607bcfaad4f42bf2456947ed33773f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896786, "uuid": "53ff2c44-9f87-4946-b41b-6a6bd72745ad", "comment": "Malware payload", "value": "a125ff9baf65332857ef7b213c79c8001b101770ba3faf1ffdbf539b68933cfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896786, "uuid": "13af35e0-92c7-48f5-bbc9-ed5232448973", "comment": "Malware payload", "value": "2b70d399a984c0b71356fc264b7d831e25270368", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896786, "uuid": "1b22ec30-5c2a-4139-9cb9-4db8945607c9", "comment": "Malware payload", "value": "6db344b34f28143a3dd4e81a2c7d3bf5e062638baad17a693b33b82813aad9aa5e2c17a45b2110361bc4dec89b3cb7d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896786, "uuid": "c168f14c-3751-49ca-b244-910c2fad7ce3", "value": "T17084CF00FFC0D0A5F47DC470BA25CBE95679ACA179A1D91333746B6E2EF0291AE62335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896786, "uuid": "8392944b-1d00-48d1-911b-6385fcc6aaa2", "value": "c8c0db015ca53b9ef621505ac544aadd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896786, "uuid": "6d90c96e-2ed4-4aad-87d7-4036a08b9b92", "value": "6144:jyiEQHUrLqy6gjhrV+GAs9Js+CZhVV4E+O13oXc:jyiEcSjZAP0DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668896786, "uuid": "5e30d7c1-415c-4f3b-ba54-49beb4276e73", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668896786, "uuid": "eb122b11-5769-41f1-b324-1a57952a31b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896786, "uuid": "1d3aa251-650f-4403-9c66-253830fa73f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62dd9bb-67d1-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668838645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838645, "uuid": "2eb8fe69-ba8c-44e7-abf8-9bb683132c4d", "comment": "Malware payload (Amadey)", "value": "db548fffa34124aaca87316f99e50c0c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838645, "uuid": "661c2c6a-5671-422a-b664-7cf5bb887592", "comment": "Malware payload (Amadey)", "value": "a133d70c35e81e1a67e820ac0003c5c7af76ce8fc540d5b658638568b079de8b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838645, "uuid": "4b68bbf8-48ed-4bab-8a15-1fa5ad77a1d6", "comment": "Malware payload (Amadey)", "value": "b175c8ed193e2c2fff6c5a0b2af2cb784cf6857b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838645, "uuid": "744207c6-e6cc-4474-93cb-6f6788f42514", "comment": "Malware payload (Amadey)", "value": "8ea60ad61a4720b3d3a6637037db5d8d67d5cdb444e17fd2a4ab9e2be7ff16bf006db2f9b29e202462050e4a9e34255e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838645, "uuid": "62d5108e-11d8-463f-a843-87483328433b", "value": "T10684BE107684FA72C5D11675882DFBF86E69AC619FA685C373B4EF5F2E301D0B6B2201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838645, "uuid": "4e12ea6d-7068-4b44-8c57-e587f6b8d65a", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838645, "uuid": "ef88d7ac-c1a1-42c2-b457-f00ec6927574", "value": "6144:Uni87HzovGWx7i5do2D5B6zyTvKXM2pj0FguaB7nh+3oQ9gOU+fzYBb6:A7EuWx7uBZ2H2wM9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668838645, "uuid": "2b604284-6092-4771-820e-7083f37cd4a8", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668838645, "uuid": "fbd872cd-310b-4e4a-a438-b83adb301f27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838645, "uuid": "106f0f70-7229-433c-9259-8a9c59caff0b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4e10c1-67aa-11ed-9266-42010a9c0072", "comment": "Malware payload (CryptBot)", "timestamp": 1668821714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821714, "uuid": "5837a42d-e8f1-458b-861d-661bc2c02b41", "comment": "Malware payload (CryptBot)", "value": "4d2a3cc1554ef983894618476b12b0a1", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821714, "uuid": "8978635c-15af-4a23-a237-4038d5a98988", "comment": "Malware payload (CryptBot)", "value": "a17e38eb9cf906557d7e718135d95bb3d7683ddd40093c10b91414e0c84cbb1b", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821714, "uuid": "4fb4226b-c1c1-45ce-8bfd-f4091b0b49e3", "comment": "Malware payload (CryptBot)", "value": "927d8ad52afb1a1ea046d481aa530c6f5f079f0d", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821714, "uuid": "ec1d567f-4ed7-4ffa-b407-d736783ed673", "comment": "Malware payload (CryptBot)", "value": "3d1bfe7eff26ad398c8e99fa273900d232359a908db5ea295e9e6682b3e2c17e8f276325b262a11fc4658499ee61d850", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821714, "uuid": "eefce717-450e-4378-8898-590b31b7fb2e", "value": "T18845231A9D934172E45049F4AC79CA394F73FA170D3DD8647ABEAD5F8F2B65088283B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821714, "uuid": "e0431fd5-1818-4a35-a004-edc8fe07af78", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821714, "uuid": "d40bb553-0e82-45c0-84e4-32123ab772d6", "value": "24576:Z2epE9QFepfZbWmDMhb3gIfxZ+i5xkPBIxTIValLdfY2Q1v9hq:Z2M8QFeXW2YQuxf6WxTI+A5hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668821714, "uuid": "339b532d-a421-42f3-bc1b-961de9348352", "value": 1226917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668821714, "uuid": "635fc03e-f818-4fd4-80dd-0cfa7634e3c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821714, "uuid": "04388a16-7ea0-45fe-8172-4c07f91e5155", "value": "4d2a3cc1554ef983894618476b12b0a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a810ef24-67bf-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1668830837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830837, "uuid": "902dc1a8-d99d-4176-9463-0542df47fba0", "comment": "Malware payload (RemcosRAT)", "value": "fa1c8d8657c45e7545764d8098a5029b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830837, "uuid": "82339a34-ab1c-466f-b6df-a3d1de498d3a", "comment": "Malware payload (RemcosRAT)", "value": "a202a3843b54121f7d345b48af88393440cee64240dda50ece88cb7bd395b71c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830837, "uuid": "fae9058b-0831-454a-b3ff-24124acb87f7", "comment": "Malware payload (RemcosRAT)", "value": "f75439902782b8d983410221ec0952b55974b75e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830837, "uuid": "29b606c7-9e71-4a7a-9436-111d846c3a30", "comment": "Malware payload (RemcosRAT)", "value": "934d56ad94282c85b6c9d164564f9c70b568125e2414fdbc0cf669f6003561dbf565626bb27e2aae8faf5b3803b72c5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830837, "uuid": "d11c21a2-7de0-4389-8d7b-2b2b434d144f", "value": "T14045D05B86865AE6C4594D729D69C4B932F00F1B5064E36EDCC83DE3BABB707D2120B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830837, "uuid": "24305df7-6363-44bb-865b-ea14bf7c5124", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830837, "uuid": "9c8f5555-bf27-4230-b305-ecf2c374177c", "value": "24576:XJdmrAIpX5kEHsOzj4j85M1hUQDAxzJX4vDYdfa:Xu5psOzj4jGM1aK4FXhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668830837, "uuid": "c2157e0b-f3b5-4c92-8b39-3c40c016bf96", "value": 1243136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668830837, "uuid": "c55671ac-bf76-419b-97a5-ecb9aae1ff64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830837, "uuid": "6b1d94a0-dacd-46d2-a670-a0a135232bc5", "value": "fa1c8d8657c45e7545764d8098a5029b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93522438-67d0-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668838104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838104, "uuid": "f57359fd-3c05-4e71-b085-ac5d6f3a41f9", "comment": "Malware payload", "value": "86523662d857bc23ef49552b4a0b1a24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838104, "uuid": "0ba81de9-ef9f-4c67-a17e-92d3ddb9a859", "comment": "Malware payload", "value": "a3881d0b503bd0172d5a70e17b05dd5b00351cd2f29393fff8d0dc6b413fce4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838104, "uuid": "55275e4e-6d89-4931-9abe-594038a57a44", "comment": "Malware payload", "value": "4e4f7de990db58f11157c6e2febdf55f60500d31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668838104, "uuid": "edf36634-0231-48f0-8a96-56ffee7160c6", "comment": "Malware payload", "value": "85fa144ef1cfa08a8045b094dce22b7cfa108e07697c1a3c063890b6223ea210a7cb0767e4f2b8bd00c6e29aebbdb5ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838104, "uuid": "4c332596-17b5-4033-861d-40351e83f5fb", "value": "T104763345B4F188B1F67F247CC668DFC175DBA9050F284CC307D158AECE6E2988AB295B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838104, "uuid": "d66fe8cf-afe4-4222-8bd0-85b7ad57dcfa", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838104, "uuid": "4d81596b-4a4c-4ca2-9675-f45a9117f469", "value": "196608:91OVnelcZtq35M+FoCD+v/TLNzp/ncyWD62X:3OJRJ0w/TffWzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668838104, "uuid": "eac9b191-2ae5-466e-a168-e3ffafed1ad6", "value": 7608017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668838104, "uuid": "411b3fca-7164-42a3-ba1d-2801f2897a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668838104, "uuid": "76aa04a6-dc29-4a99-b306-862c40af7a85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a15f780-67b2-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668825123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668825123, "uuid": "d31b4185-9ad9-4493-a2ee-f1e0dcb6b71b", "comment": "Malware payload (Amadey)", "value": "cb7c4711189a33cd8bff6e4ed9df6a81", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668825123, "uuid": "3a11eb1e-61c0-40d3-9bdc-7ef0acd8e7df", "comment": "Malware payload (Amadey)", "value": "a4b21b0cbe0f54bcd631135391d050484d293e25d4bcc5ad425818eb388a807a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668825123, "uuid": "60095b1a-1e0a-473b-b297-b6314899c199", "comment": "Malware payload (Amadey)", "value": "cfb663b27d9f624d19ea62829dc5d302d13f924a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668825123, "uuid": "12aa8c0a-2abe-4881-8af4-28eca3f18b5f", "comment": "Malware payload (Amadey)", "value": "5f4dd7a0610d89626b8a8a89f2ac13cfa0182d5975575b6920720a205222e05417cf718f4a7df88e40bd731b424c8070", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668825123, "uuid": "3ffa5a22-7486-4474-9689-35b77c6acc97", "value": "T1C884BE1076D4FD72D5C12131882EA7F56E69EC607F268AC73278EE6F2E302D1A5B2315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668825123, "uuid": "ccd462aa-b8e8-4d4f-ac31-c0338b7da61f", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668825123, "uuid": "ad757c01-7afb-4b4e-87c8-c8aa90165c63", "value": "6144:FZQAdzovlmduKqtIrAWOM7n8iZzzwZ4/rk09/Hh+3oQ9gOU+fzYBb6:oAGwduZturXnFnwWrkUo9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668825123, "uuid": "6c267af9-c002-4e7a-a4ae-ee56adeff332", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668825123, "uuid": "0da50dd6-f035-4098-93f1-f5b42360a1d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668825123, "uuid": "154ec9a5-6ea3-412f-b5bb-ff50a9e47767", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c773766-680f-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668864989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668864989, "uuid": "35f4733c-9dd0-4acb-904e-08399cf96113", "comment": "Malware payload (Amadey)", "value": "aab6acc6280ab339a748760886eda65c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668864989, "uuid": "76a3abce-0b74-4084-a204-dba75993454e", "comment": "Malware payload (Amadey)", "value": "a4b4703c12f17bdef054d08506c676542e31af522ddd1669f1cecd68fec7cb34", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668864989, "uuid": "8b2d082c-2d95-4ac4-bf2d-08021f184d96", "comment": "Malware payload (Amadey)", "value": "895cfb1d5b0df275ee43888c52e3ba460fd6f91e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668864989, "uuid": "fc92e11e-ac19-409b-a9cf-b24ea2f8e2d5", "comment": "Malware payload (Amadey)", "value": "53de6a72d7142b8423f98baee3d6ee63a1bd45be91d725455c48638ddbcc9b2e6dbff6a2afae8433842763153dac6559", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668864989, "uuid": "8933bb3e-2adb-4f4b-93ec-f474d81d249b", "value": "T1F284CF3472B0D8A1E3A10674C825DAA456B9EC217C13D943371CFB7F7E30A9C9A6E275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668864989, "uuid": "32726261-faa6-454c-82e5-2dba5d74b0c8", "value": "063e5449636b8762744e9ce9f5564a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668864989, "uuid": "feb09fc2-06e7-4a8c-997e-926654309ab6", "value": "6144:1kBJqEWbhCPwWRQPQ82zcQsld0y6jpPnFwCLLObfwB:DwYWRgB2YVlsxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668864989, "uuid": "48ce19b5-f422-4798-a7de-17bc77d5865b", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668864989, "uuid": "6b517f9c-898d-458a-92bd-775a859c7c50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668864989, "uuid": "59669e69-d430-471a-a865-7534af7e141f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdc54d5-67bf-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668830764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830764, "uuid": "b6a207f6-d5b6-4447-8ce4-9d5890372875", "comment": "Malware payload (Mirai)", "value": "11dce4303aa7d888ce6f431f57a88575", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830764, "uuid": "5258fe6b-a451-4a9c-91ad-18eef5cde8f6", "comment": "Malware payload (Mirai)", "value": "a6ad9879e4ecb048685a20b021d628202d47c3bf61259f0b66c2df46579233f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830764, "uuid": "0246da59-22dc-44ad-8ff2-ee23a8e5139e", "comment": "Malware payload (Mirai)", "value": "e36df7e5a0179997754482efdccedb1508445bc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830764, "uuid": "bd2de578-5add-4a93-a4c6-4c7c83f118d7", "comment": "Malware payload (Mirai)", "value": "48fc3a10a7e38eb11e06ecaa1fc4d8e01720db95655fe29d2db6b2814fbe0f031ffa4cd0378ad4380ccc73396d6648ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830764, "uuid": "2a0ffa77-0c50-4612-9e00-38b642b21277", "value": "T167535A21BDBA2A27C0D0A57A61FB8765B5F503CE26A4CA1E3D720F4EFF215401603AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830764, "uuid": "054ed6d3-dd38-4b64-8243-f99343a534c0", "value": "768:QroKQQs8sVWgdDZweJ6ls0m7hCGF0irtLeAWpFpcVqO+A7gnCgN:QrcQnsVWgdDZwm4FC/F0i4sV4ANe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668830764, "uuid": "698a9ac3-00d5-4bc1-bfd9-955c0aee7892", "value": 63936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668830764, "uuid": "77bd103d-9c0d-427e-b159-ca33c3936b68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830764, "uuid": "bf48b11b-5f16-430f-a1b0-339cc09870a5", "value": "11dce4303aa7d888ce6f431f57a88575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4404484-67b0-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1668824415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824415, "uuid": "a45810fe-c588-4000-94da-72935db408db", "comment": "Malware payload (njrat)", "value": "5124aaebf1ab6da085b27c6c2ba0cc51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824415, "uuid": "24d111dd-d102-42f0-a934-e5c6b3c0fda6", "comment": "Malware payload (njrat)", "value": "a7746acce6168760a25635c553af74bbd6887d2b5e0d7b6bd9b45c8cd1e5b900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824415, "uuid": "8125e4ce-ec09-49ad-a82f-87b4703e71bd", "comment": "Malware payload (njrat)", "value": "fbc12d3abe1925183aca35b6576650fc8e70396f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824415, "uuid": "2990b579-d58e-4b17-a2d8-166bead50c29", "comment": "Malware payload (njrat)", "value": "59551503178b4d6e8f917f952c3615deba5f4ebebb6cfead6bd33e84c21ff9133e4630024835cf0995cddf587736b43f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824415, "uuid": "0482c612-22bb-46fb-8c36-dcc61e1096f7", "value": "T189B2194E3FA98856D5BC17708AA5965003B091870423EE2FCDC550DBAFB3BD92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824415, "uuid": "8d57e4b2-55b4-4588-92a7-198f8c631e5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824415, "uuid": "e317dc5d-4284-4c96-a5d2-66ef225e2257", "value": "384:p8aZYC9twBNdcvFaly2H0dbJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZ35:xY+sNKqNHnSdRpcnuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668824415, "uuid": "6f979a63-fd71-4730-b9c2-7d9ab2c701f8", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668824415, "uuid": "d6e842b9-e4f0-4237-bff8-8e64d2611a38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824415, "uuid": "581696d2-9d0d-4a02-a65c-98f3f4df1b6f", "value": "5124aaebf1ab6da085b27c6c2ba0cc51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d75251f-67f6-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668854334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854334, "uuid": "679beafa-1f07-48f4-9276-c8ef75cc770f", "comment": "Malware payload (Smoke Loader)", "value": "e25bfbb2e971415ea20bcdba6763d1c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854334, "uuid": "85c6058c-556a-4bc8-9567-d451e7c5983d", "comment": "Malware payload (Smoke Loader)", "value": "a993c4bf8b199ff8dc1fc1ab49005c2091897988cc1e6f2ba3e450ceb4a0bb27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854334, "uuid": "2c566ff7-2486-4bc2-bc53-56c222e5eda9", "comment": "Malware payload (Smoke Loader)", "value": "a2f027c93b3506e05d5b869cc481f15a87218498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668854334, "uuid": "6bc5a1af-e636-4b99-98e2-22ca3f7f1608", "comment": "Malware payload (Smoke Loader)", "value": "2df40479dcb54e238db5c740dcd8a8e45c68e528ef9aaa0b49892fbed7a2439c88102e7b92e204bf59e57da9d4521815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854334, "uuid": "8d9726a1-8e36-454b-a8c6-3834ae04ab34", "value": "T1FC74CF3472F0C4F1E1314674CA29CBA56AB8F8113814DA537714FB7F6E30A9C9AAE275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854334, "uuid": "2728ed9a-abc6-41ae-9373-67f6c5cca97b", "value": "045163335c785d665aeb43938f4d94be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854334, "uuid": "d53d9cd8-ba82-42e5-96d5-42e5de6bc9a1", "value": "6144:tn/k2dHAn9ptyDo1EwN/djpPnFwCLLObfwB:tkgSdEaxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668854334, "uuid": "0572b5f3-d100-498f-a1c6-25d08ca6682c", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668854334, "uuid": "c54f9e79-f728-4da4-b82b-afa1ef817617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668854334, "uuid": "0043bfa0-2812-4e45-a6fc-4cd96793efa3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305ce0ed-6850-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668892913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668892913, "uuid": "fb7de2f6-7bd9-4219-b03e-2b4d259d6c38", "comment": "Malware payload", "value": "54086f83dbeec50eb64bf1effa80e031", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668892913, "uuid": "3f198f08-19db-48c0-854b-459be0ccc1d0", "comment": "Malware payload", "value": "a9d5ec72fad42a197cbadcb1edc6811e3a8dd8c674df473fd8fa952ba0a23c15", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668892913, "uuid": "f6ad6bde-eb47-46be-bc63-07b1d2548ec8", "comment": "Malware payload", "value": "abcaa9f6f6ac47d11dec5fad101c4d1f3eb38892", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668892913, "uuid": "37cfe4b8-9b45-4c6f-b05b-0c293a4d9711", "comment": "Malware payload", "value": "b08b46f346430104d05169e82d97c8306975d787b5cb7ba8afc9bcf1bb7514e7ccff168f264c2716f4ac10d0ad539679", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668892913, "uuid": "50bdf2da-3a17-436f-a9af-3f4ece81a8fe", "value": "T121441D3E47D37ABCCF8AC1F1817225992F75579102E8CA15F5A1686422D1E3BF783E88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668892913, "uuid": "982e3390-a56e-4e5f-a19c-855289e23e3d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668892913, "uuid": "a307afb8-eb54-48ec-8098-d9ed88593b29", "value": "3072:b73/71nHUVc9kuPU7bs/cgFTOssI7rgrbZKM2vM/nJu/lYzpwmOqbj2flGFq1:njF04wo/ceOssWrgrm5GzamOB9GFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668892913, "uuid": "78a6039d-6789-4663-884d-304e3727958f", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668892913, "uuid": "6b0eec41-5eef-4f36-8ab6-8f3845fbe27c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668892913, "uuid": "77127fd0-0bba-4f92-87fc-f614241f937a", "value": "a9d5ec72fad42a197cbadcb1edc6811e3a8dd8c674df473fd8fa952ba0a23c15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34c06de-6831-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668879818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879818, "uuid": "937613a1-0d6e-4dee-92c6-97bba68e2f14", "comment": "Malware payload (Smoke Loader)", "value": "cd109a697e89e121e14ba8bed25d8ed6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879818, "uuid": "0e1c7540-7dc2-4bf1-a60d-48ba9d0ae37e", "comment": "Malware payload (Smoke Loader)", "value": "ab305012a0b6c6eb40e40299510e791c5fe277ce56715002c15c6e621bd70988", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879818, "uuid": "4e0e8594-39c0-4ac3-b367-1125375ff50a", "comment": "Malware payload (Smoke Loader)", "value": "b9c84c7442d70b5a63d12b1f88925658afd24122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879818, "uuid": "8b4178ac-8f61-439b-a574-750ded214523", "comment": "Malware payload (Smoke Loader)", "value": "24e42442f93d07bd08039d593f754389626e320222d707224d80f3fabfe8bec0031a22f5426de355e7f44d535cad2e70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879818, "uuid": "be240bd3-0268-459f-bea2-584669a519c1", "value": "T14D64BD10FED1D0A5C47DC170BA26CBE95779ACF27A24D91733346B9E2EF02918E62235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879818, "uuid": "19125046-b07b-4e2d-837f-91aed9de9aa4", "value": "3a28fc6cbd66b78dccc28e56534d2c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879818, "uuid": "815caefd-4ef5-4365-b17e-b36f91ad7d1d", "value": "6144:8J/Gpd7mBBAmrZbH89mJhVVPE+O1voXc:8J/GS3vr1DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879818, "uuid": "4a546deb-d991-4656-965a-581b2c2db59e", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879818, "uuid": "cab71919-1358-4718-a309-5464b7926d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879818, "uuid": "c529a5f7-9b2c-4ed9-a83b-3826dadc802d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd74acb1-67ca-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668835705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835705, "uuid": "05ad2aff-c71e-4ed9-861b-9bed61bedbbb", "comment": "Malware payload (Mirai)", "value": "22bc6ad05a7aaa1241e62e0bc9cb45da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835705, "uuid": "00a9e6ef-93f9-4e0e-aee8-5eccb5c2e7a1", "comment": "Malware payload (Mirai)", "value": "ab30706256858c860d5d011681cdff465a4f10a94f713b6ed4dd48765d54d0d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835705, "uuid": "61fda026-1d91-443b-ab9e-387ed2c46dea", "comment": "Malware payload (Mirai)", "value": "3868018292e35155c7e6ec1cffe1326179d1c9bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835705, "uuid": "31506934-7bb9-466f-b297-b5da583115e1", "comment": "Malware payload (Mirai)", "value": "603f47ef5dd4bd32a28e9b7736a8e29e7cb717ba6a12ad164992c7bb808b071041ad7350b45ad04a0c09bbf231912694", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835705, "uuid": "22c5f090-0d33-44fa-b898-0a19ade113a5", "value": "T123A2D029E345AEF5DFAF9C9053C1C2C277E543C62786C8E240FEAF016506056FB88D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835705, "uuid": "8d2809b2-b15f-4ecd-9857-a25b4e528127", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5oM4uVcqgw05VxJ0:mRxsSVsMD6xiJJE5zRWNh4uVcqgw096", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668835705, "uuid": "ae7f57fd-4cfe-45c6-b5de-0577d0bc95d2", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668835705, "uuid": "1a5ae56b-d7a7-4a7a-829c-de05be177cc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835705, "uuid": "b3590c4f-840d-4825-b41e-9393ffb86359", "value": "22bc6ad05a7aaa1241e62e0bc9cb45da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f35d74-6801-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668859205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859205, "uuid": "92263da9-0746-424d-b630-f4c49a685d6d", "comment": "Malware payload (Mirai)", "value": "cc1e6c458b380f9fc2dbfaf34067a8db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859205, "uuid": "e2453620-0b75-46ac-a6c3-edd7be301117", "comment": "Malware payload (Mirai)", "value": "ab7a3f846f7cadad95649734eb3711d7e8aa84508c30b0bd4b9a293f094f8014", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859205, "uuid": "8a4a45e0-6fd5-4944-aa1a-f8c78f4144e8", "comment": "Malware payload (Mirai)", "value": "9b9047b60c112ecfd8e3c76982c37cd148256463", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859205, "uuid": "d27043f3-7e57-423b-936d-dea968a92177", "comment": "Malware payload (Mirai)", "value": "4d7e664ec0f5d31bab2a71a44e512f4c7f24d367802c1fd81a7dcd601e60d3d9ea407272973b95d2122680d7769bf35b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859205, "uuid": "18077b7c-a7ed-43c9-9678-8b54863b05e1", "value": "T13EE2E1A2D6DB8F41E89B51B664FE622D0749C02A416C88763EC451B56F73F3A261C3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859205, "uuid": "29e9cc7d-8346-44ad-b613-b7a4ed124672", "value": "768:ALckxx1WWmIMbE7Y2NX661WtCwj0rOFdwJUUZpWH8nbcuyD7UHQRjM:ALbx1WtbIV1ij0rM2/ZpWH8nouy8Hy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859205, "uuid": "218a1176-5b9d-4d60-8a73-04016158112c", "value": 33732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859205, "uuid": "7fe374e4-0b77-45a3-bb94-05a26f514097", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859205, "uuid": "8afd60fa-ea9f-4c5a-b2a5-76b9b97a1b4e", "value": "cc1e6c458b380f9fc2dbfaf34067a8db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f765d7-6806-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668861400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861400, "uuid": "48b96d49-9e81-4978-9985-ba03b0482a0c", "comment": "Malware payload (Smoke Loader)", "value": "e7315223679af356143e6eb58ced1af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861400, "uuid": "82fbcef5-f21d-4c8a-bd6a-3f3c033c243a", "comment": "Malware payload (Smoke Loader)", "value": "acda12ff010cdb42b04f396eba776b7b6b5c6fcde4ca2a0a4a923866c6305cfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861400, "uuid": "6f8186bc-bf4a-4e54-88c0-b5766fb7e809", "comment": "Malware payload (Smoke Loader)", "value": "e32bbf730486f6f1c241f2e27db7bf1da245c70c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861400, "uuid": "0fd28307-35d2-4b17-a234-36efef89e38a", "comment": "Malware payload (Smoke Loader)", "value": "cd871b665b6c3b1225ee2e1b246e1d331f9580bcff0d3cc990e9bac4c668f2095c21de1621ce126ebf210f86843b4a5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861400, "uuid": "cbdc7bc3-278b-424d-adf5-567965ab4ee8", "value": "T1B574BE3472B0D8B1E1714630C825CAA866BCFC227924DA437754FF7F6E30A9C966E275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861400, "uuid": "d02a2dd3-01b5-47f5-a4a4-650315a788df", "value": "063e5449636b8762744e9ce9f5564a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861400, "uuid": "796214c4-4341-40df-862a-33d0ad5d85cc", "value": "6144:xA2ykOHOUPoPp81XzOkjpPnFwCLLObfwB:okOH1P081DLxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668861400, "uuid": "c1bc14d6-73ff-4384-b5bb-bac3d1089bdc", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668861400, "uuid": "f121a391-dafa-490c-97fb-db614b99c62e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861400, "uuid": "5b0c8ca5-9c8f-45a8-a73a-2767e11c6cb2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51808ac7-6828-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668875789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875789, "uuid": "948b44b3-3f15-446a-8adb-87d0b493100a", "comment": "Malware payload (Amadey)", "value": "9f34cab20bbda1169bb3b66b5dc90bb8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875789, "uuid": "e9374b67-3142-4ec0-b8cf-06d487fe51f5", "comment": "Malware payload (Amadey)", "value": "ad0a26b0ab0f050fc7c330ec4e19ced104a2405789d73c6cdc0ebb77a115acaf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875789, "uuid": "33b3096d-a1d7-47b5-9dc2-b0533d1a6f38", "comment": "Malware payload (Amadey)", "value": "3cac701b74b221893fdbeb2027f3861ecc1f208d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875789, "uuid": "0d0c037b-a49b-46cf-809d-16fed0072d50", "comment": "Malware payload (Amadey)", "value": "569bb568600fdbc9e0a509312d1d761807c6701a4707e9b9343c441596cc472999d90b2972e5e43c7050cabad27dd90f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875789, "uuid": "5f1462c0-aa7b-4d6c-80db-4ba52e0c380c", "value": "T16C84BE10FEC0C4ADC4BDC5307E15EBE86579ACA17A10D91373746A9F6DF02918EA23B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875789, "uuid": "e85ccd8f-9c41-4ec2-b313-60ca1a6b2aec", "value": "35f46893ae897497be39cea0547d1715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875789, "uuid": "12e03b76-f9a6-4a87-ab12-3f912ae0cdf6", "value": "6144:ijXEx4AN6JNbCratAR4qX0QddHLnHthVVPE+O1voXc4:+XK9QiYAKi7H/DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668875789, "uuid": "be581f28-82a3-425b-9502-256718c20284", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668875789, "uuid": "68ba0f4a-f066-4e24-911c-06f3e89e0773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875789, "uuid": "29047f56-41ea-4b25-accf-8bc535644443", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619fdee2-67d9-11ed-9266-42010a9c0072", "comment": "Malware payload (CryptOne)", "timestamp": 1668841886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841886, "uuid": "f2e1aba1-a22e-40be-ac3d-f57bec3230ba", "comment": "Malware payload (CryptOne)", "value": "feb1630bf2898d0e9b1897eb165d20cc", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841886, "uuid": "38b418b2-f588-4e90-9068-1b70f9027a49", "comment": "Malware payload (CryptOne)", "value": "adbce9992523240b7244b9f73dc2b8fbe0b575a3c34a0fd34d9385fc800651b9", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841886, "uuid": "15094836-96fd-4090-853c-2a0c405547c5", "comment": "Malware payload (CryptOne)", "value": "e8c1d9daa4cf7afcc0fcff43e7c75e3ef5e897d1", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841886, "uuid": "140f2173-164e-4825-90b6-26a60cb6ef38", "comment": "Malware payload (CryptOne)", "value": "86f97cc56d7a65ab9a10f25016b527a740501069eeeeeeaa9b4bfdb81aec45a9835cddde1ff0de155941a9ef2fe133a9", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841886, "uuid": "3df061be-693b-442c-a42a-26b891551c9a", "value": "T128852303B6C589B2D9624A354D32BA25587A7C200B24CBDFE3E4156DEE325C17B36B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841886, "uuid": "fbb8031b-e72c-4fa0-853e-58105e87dce2", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841886, "uuid": "d0a9ae23-8597-48d8-a23a-a0394c9df73d", "value": "49152:TlBfJXAEGcKcR4Y7wn49kRX5b2SP6kfe+3gliFVBkKdTh:TlBfKEyn49DcRfmoFcwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668841886, "uuid": "31ca0802-1802-4809-96b7-a790d40b7a4f", "value": 1834632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668841886, "uuid": "20d8b0b3-abdd-44e0-9ac6-6d75a2608e6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841886, "uuid": "8779cf73-e19c-4e35-b9b0-4d0f6612a8e2", "value": "feb1630bf2898d0e9b1897eb165d20cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67083f5e-67e4-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668846619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668846619, "uuid": "5aceef5d-34b7-441d-8c1c-3f1a4693e1b1", "comment": "Malware payload (GCleaner)", "value": "74bfef38b891c022ce9bf013a1c3578a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668846619, "uuid": "66da8af9-fd78-4a78-ab06-4d8f55565fe6", "comment": "Malware payload (GCleaner)", "value": "af21323f13d9a7abe768302a0e104a0dfc5a75936da119dbb61a23e97cc6891b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668846619, "uuid": "b936b328-1334-432d-89a5-8080a81a4344", "comment": "Malware payload (GCleaner)", "value": "710ee538147090f94e2b199437b52beb9de6891d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668846619, "uuid": "eb258ca6-c7cb-4d84-b9d2-e89b2840fdf0", "comment": "Malware payload (GCleaner)", "value": "47080a68636970e6c7ed00ddc61ee244a9c8de35d3477125b42ebe4cf157e2013780d7a4b30d597463fbec4d2b610f9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668846619, "uuid": "a85d62fe-b65b-469d-a289-61e6a043102b", "value": "T139C5F0016A56D2A6C82F2EF4E65074F849B63DA2E82EC23BF3927C5DFE7D3538419501", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668846619, "uuid": "519fff46-0c53-4342-a7e3-a70e50df8988", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668846619, "uuid": "684a56b5-bb6c-46b3-bc44-d501ca885480", "value": "49152:q24sxJGkfxJHkJzn/J5UQZRT5st4VCmcG0IJAZ5JBgaDhkKz0MvUxVkBaFwnm:r73RfPE9nx5TRVseVCmceU5JBxkmNvUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668846619, "uuid": "a8b4ba46-3a12-4386-ad26-9856fa302a0d", "value": 2525122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668846619, "uuid": "ab525603-0cda-4587-a697-3a6c5a2752e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668846619, "uuid": "1d94d28c-519d-4104-9524-e19dda9fc9ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3478f6fd-6818-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668868868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868868, "uuid": "a2f0e5b5-4d58-4ab5-8142-0d21aed9cd9c", "comment": "Malware payload (Amadey)", "value": "df2a21aa085fe093c55078c2e2cc2c3c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868868, "uuid": "2208a939-03bb-402b-87c0-c651cba5e5be", "comment": "Malware payload (Amadey)", "value": "b1850d00ff6b49d892472951f00e52a86e4b7ddb4d417bfe93de25131632336d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868868, "uuid": "82b62861-3ccf-4745-9034-3d4bd547b972", "comment": "Malware payload (Amadey)", "value": "c1c1c2c3cc1f0d7f191782e3d75efc73372d8312", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868868, "uuid": "49843c1b-0003-42b2-8882-63f53d7a7f79", "comment": "Malware payload (Amadey)", "value": "8fdd48d43f5057d23a251a8df90c7e36c66fae272f65e843b92f546ee01efd6ec1db2c5c22d2a9ad8e0b82327c846db9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868868, "uuid": "24c7a4c8-b7a2-4618-84cb-5618f55d4a6b", "value": "T19484CF34B370D4B2E0610671C829CAA4E9B9FC217914D50B3319FF7F6E70A9C966E276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868868, "uuid": "56cb0727-f38b-4a18-b228-b24781d2e198", "value": "063e5449636b8762744e9ce9f5564a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868868, "uuid": "0e9deee5-58f8-4281-849b-109e2741147b", "value": "6144:cHaiYoxUNxD/qG+j48FJnNJn2KjpPnFwCLLObfwB:7iYRg48PnXxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668868868, "uuid": "cf7772ed-974e-4228-ab8c-63c2d31c0f3e", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668868868, "uuid": "fb442d8d-e90b-492c-96dd-ed63a615b8bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868868, "uuid": "b6916a2d-9ef8-4b02-8c34-80a8b9295ed6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a5334f-6831-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668879829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879829, "uuid": "a9d85821-407e-424c-858a-e6760ec32283", "comment": "Malware payload (RedLineStealer)", "value": "e0352f8b20303111fea43044e736c0e5", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879829, "uuid": "7907d6b0-fa03-49c2-afcf-8d6cac08e53e", "comment": "Malware payload (RedLineStealer)", "value": "b2280bc6cc58ae7bcbabc2ed5c5878d70ed463b46cab27da2103ac19ea5e52fb", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879829, "uuid": "6cb18028-b2d1-4586-854c-532215c6636e", "comment": "Malware payload (RedLineStealer)", "value": "fef8e719f5dd55fedd6c99090f7f5e175f124740", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879829, "uuid": "e10592fe-d745-4af8-9dbe-f0f0b979c9bb", "comment": "Malware payload (RedLineStealer)", "value": "bcec3d762883f356d0f021ddac61dec195128916d0bf2327024b6d15f66711b04abfa8affc0ae07c6d50d4321bc601b6", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879829, "uuid": "9c0db123-692a-4215-a1dc-914dfb43cc6c", "value": "T149A4CE482B5E2026FB2F06F0B450669816874DFE3DE4A68DCB45E0AF5E3F3E52178947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879829, "uuid": "13605884-82c3-407c-8595-0f6d974c6f79", "value": "6144:oTD9Gm6Hi6PfmxGoxXLuOlJmu8s4o7POv/beGU0t8mBvyoFRZiemqVh/YzEq67TM:iDf6VZoFuwJ3cZ8mhfQeth/IcovvpQzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879829, "uuid": "a336d65a-63e9-468f-884d-31622d9aa7dd", "value": 463360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879829, "uuid": "e2c8a49b-320c-4a79-8e82-958313677206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879829, "uuid": "be6b196c-6008-4e90-9397-d81b3aed227a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b3566f-6800-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "07cda93a-3ae6-4d5e-b9d1-a2b0dff99c25", "comment": "Malware payload (Mirai)", "value": "3f64441561d35a6d6628e255b03a657d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "a9f22f5f-ab38-4511-8294-743ae04b1f40", "comment": "Malware payload (Mirai)", "value": "b2d9b66f89d04bc5d5a0f261d857f5b67a0ec9cc8e6989f7f07cdf4e524522d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "a7e41e7d-c585-43cf-a48f-cd0dcf93df52", "comment": "Malware payload (Mirai)", "value": "ace10628480c0b3880821ddc4c2bef18d6bc345d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858608, "uuid": "c4fbc2d4-60b5-443f-b292-e3f05c30f1c9", "comment": "Malware payload (Mirai)", "value": "af522f5f179345aa8662e94f6ac69eb5ce06848abd542c76b8c55be374593702c9aa09a417eef87f9074b42d107ca494", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858608, "uuid": "3ef6b0aa-5c8c-4150-9de2-ecb702d41d5e", "value": "T1A71318C4F553D9F0EC5A06703076EB365E36F1FA222CE553D3A5DA32BC82602E60699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858608, "uuid": "4440e533-1985-4195-a7bb-e8241eb5b095", "value": "768:xMlB2zs8ssGfrRI6aQ2oEenz0q8uDOycN95VlVs:YYzs8ssGfrRI6aVoEeIWOrNrVla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858608, "uuid": "84f0195a-f467-49df-96fc-b0c67da09fbb", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858608, "uuid": "37685cac-716d-48b6-bb68-6c6f12a9eb62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858608, "uuid": "6fd09850-32f1-47f2-8fac-2f6963ee5aef", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee3ea68-67ef-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668851276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851276, "uuid": "872c9c58-5534-4cc3-b58c-2dfb1d6a947b", "comment": "Malware payload (Smoke Loader)", "value": "75e0fdaddab98cebf622fc6e019f323b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851276, "uuid": "bf7a60a6-e8ee-40fb-9e67-49c73514e5c5", "comment": "Malware payload (Smoke Loader)", "value": "b2e22e92d3dd4c41ba36a1c69dad833967673c1ff7b620bb581d980d1278f0f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851276, "uuid": "b6b82624-813f-4b42-8933-965b9fc980e5", "comment": "Malware payload (Smoke Loader)", "value": "d837878857e8cc7df24d405480f562612945cb2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851276, "uuid": "c6017199-7cb8-4bd5-8055-327d6c9d7749", "comment": "Malware payload (Smoke Loader)", "value": "61e00bfd53c80f2366f3057fd7ab0a6beee2824ef9e202731721bc3f4ae6d868ce203ea59ae6aed265eae3bf04b8fe38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851276, "uuid": "ed7e2914-870c-4d7c-90dc-86660a4e41bd", "value": "T16374BE3476B0C4F2F1624670CB25CAA459A9E8117924D7233354FB7F2F30A8DBA6E275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851276, "uuid": "f6df2b9d-a09b-47b2-b9e3-17c7a4ea4fbd", "value": "045163335c785d665aeb43938f4d94be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851276, "uuid": "535bdcf1-b347-46a5-add7-49266a4223de", "value": "6144:PSjXhRI1vMYY3UWsDZoGKGOcZjpPnFwCLLObfwB:EhRIeYYAZHhxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668851276, "uuid": "576e89ad-8bd9-4080-acde-d8d2b6e9b245", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668851276, "uuid": "82dd2f6d-bd17-4c02-bb01-f582facfeff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851276, "uuid": "ffc89e2f-fbca-488c-ae13-b510b392c4b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b6c539-67c6-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668833913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833913, "uuid": "8abf2a97-5da6-4f06-83c1-cabd2b6a1257", "comment": "Malware payload (Amadey)", "value": "c85c3528e1894778335e939110801fc5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833913, "uuid": "87df425f-c0c4-47b6-ae44-17ba51ebb9cb", "comment": "Malware payload (Amadey)", "value": "b2e2fa8d22fb102537d39e93232d58d25c566bd81ceeec2aaaeeebf1a599a419", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833913, "uuid": "e6ea6db0-76fe-4171-90ce-0ff83d0b44e8", "comment": "Malware payload (Amadey)", "value": "ccab7baf9443fb06e5b2c3b9509f1e3404b42209", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833913, "uuid": "28206599-804a-4a17-be40-453850f700d9", "comment": "Malware payload (Amadey)", "value": "047e406a00d9d41bee422e9ac8ad34a474a4774acca8772ff30d2acb830bd781b06548b5de17ee757f08cf22cf769af1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833913, "uuid": "39973e07-301d-4278-b0fc-e66b21854636", "value": "T14084CF503290F932C4C10175A81EEBB79E69AC615F2A8AC773B4FE6F3E301D165B2E15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833913, "uuid": "c09a4cc9-34ec-4c10-8a7c-1fab375c42ac", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833913, "uuid": "f08bbe53-588b-4cea-bb87-7812681741e9", "value": "6144:z7oglz0Lq1scpL3KoZ7huz1uXh+3oQ9gOU+fzYBb6:ggy4L3txkz849gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668833913, "uuid": "65f9ec3f-ea65-4d53-8bed-02fd3833c86c", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668833913, "uuid": "8fadc799-0ead-4114-96fc-cddb55d4bfee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833913, "uuid": "42d378c9-6d0a-4533-a76a-1191a25ea389", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15c26dd-6839-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668883305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883305, "uuid": "decb9e9c-d107-4489-840f-6898f68a1f4d", "comment": "Malware payload", "value": "52a56292e6c4f3eb6214f03c54301bb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883305, "uuid": "b6957239-874d-4abf-bb27-746ef53d38bd", "comment": "Malware payload", "value": "b2f131f3974ee99f4810745adc994a0d002b3c481efd0de400f2c6b62a09c319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883305, "uuid": "611d1d4e-1b80-4a19-bd31-80fa10391f38", "comment": "Malware payload", "value": "affe746b36f7c21e8a71e1265dd0d880a55b08c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883305, "uuid": "eea462e3-3e0d-4f06-baec-ffb3b3eabf9c", "comment": "Malware payload", "value": "f11fb4d0d10c28591a81ebceca5088c65a3e938aa800975f77566401c2d1ab7ea381de978b302898778a790bc54574b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883305, "uuid": "bd994a6b-6a0c-4989-890f-373b84d0406e", "value": "T1FA668B217E3180A3DCE2FD38D81696A8471DBFD09924E5CF25E53E4CAF7C643A924276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883305, "uuid": "81fcb4ed-8e61-47dc-bcce-7b7548097cc0", "value": "f2f3f34374c9bc9a22331ab942e3fde2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883305, "uuid": "18b00a2d-694c-4c07-a15c-6ff25f4dddfb", "value": "196608:D6wwX+wwCwwX+ww9wwX+wwBwwX+wwaF8RTkCEt05C:D6wwX+wwCwwX+ww9wwX+wwBwwX+wwaFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668883305, "uuid": "d3b00c8f-88cf-4a36-a661-980ad77d9093", "value": 6492288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668883305, "uuid": "57736047-ae2a-4d84-96a4-46d26f6ffeac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883305, "uuid": "b1fb5ef2-a928-46f4-87a7-9684b5c194d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94139d47-67bf-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668830803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830803, "uuid": "6530fc4c-21a7-4047-9daa-74e821b4ad1f", "comment": "Malware payload (Mirai)", "value": "c7ae4c194afde1d581156dce7dd00115", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830803, "uuid": "5c5b69a2-a480-412b-90fb-b7f399826c70", "comment": "Malware payload (Mirai)", "value": "b3ac22ae99eed9d9a0214136089c7e3b083963cc58f68fcc71a5b592bf9e5d17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830803, "uuid": "03f31ba9-8fec-4bac-99c4-52988cda4de8", "comment": "Malware payload (Mirai)", "value": "81f6f00df3aed409f469233ff4ca47b36554bc63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830803, "uuid": "e3355993-4e98-42b9-a06e-e85862935603", "comment": "Malware payload (Mirai)", "value": "238cb45e93877f634d775b0fd62918fb54d0df7acd8f8bff6a0175dd3d32ec2a8ee211f219eefd968ade89f606b8a67f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830803, "uuid": "3f3d9187-f21e-4f0a-b099-2662b34b11a9", "value": "T10B534B9AF4018E3CFA4BA67E54160D0AB971B39152934F2772A7FDC3ACF30697A02D51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830803, "uuid": "b64e7723-e09e-4a3d-806f-f1d80a7419b2", "value": "1536:LE2dKd40y5tgp28qfPgN8l8MsINprfm7uCciPY:I2WqHg6um+iLiPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668830803, "uuid": "c83f7e02-7aa8-4c1b-be0a-e85cbe07083c", "value": 61216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668830803, "uuid": "d3d24fe9-4939-4ff5-99c3-640775c1c377", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830803, "uuid": "a077e008-135e-4859-9893-6c4169a0ddfe", "value": "c7ae4c194afde1d581156dce7dd00115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7a6858-6857-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668896182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896182, "uuid": "bae54d16-f179-4ab7-ac05-cf6bd94a3ea7", "comment": "Malware payload", "value": "88046aa632d5cc971924476ab085d72f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896182, "uuid": "675856d1-a070-4266-ac66-d3667c2c1f0b", "comment": "Malware payload", "value": "b6f726035c880a4c3e2e7148413cfb8aa7bb71f3e4bf2b22c6cbbdc68452f521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896182, "uuid": "ad92aaeb-de29-41d1-abb9-f3747ab34c83", "comment": "Malware payload", "value": "3197ac4bb5c5b930f75e990644de5cee14c5594b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896182, "uuid": "2d7f7030-0808-4a6c-a54b-0203110637b5", "comment": "Malware payload", "value": "bff8bc26aefdb90992a13f48fad6af65496fe24dc2f13b7469547f6957d04c8faca6135fc713a905bc6631ca300340b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896182, "uuid": "c44c191f-4c74-4e25-a71c-c9ad63fe8c58", "value": "T1BD74BE10FED0D4E6D67DC530BB1ACBE8563DACA17921D51333786A5F2EF02918E6A231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896182, "uuid": "4b7b630f-ba29-4bcd-bebd-eb05029e5c69", "value": "c8c0db015ca53b9ef621505ac544aadd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896182, "uuid": "9324b966-980f-4083-a9d1-5dd5746b8ff1", "value": "6144:K9jqOLJtL1uA0aiL6FknrCIwr79CZhVV4E+O13oXc:K9jrJ91iL6FkB0DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668896182, "uuid": "3ffe1d7a-66de-4159-a77d-2dc0033847b7", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668896182, "uuid": "ef4b399f-3042-4a90-930c-6aa4d28f8d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896182, "uuid": "a25f94cd-5559-4183-b996-7181c050fa49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e2d8b1-67d9-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668841898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841898, "uuid": "23732e6d-d3e9-48c6-9bc6-c2bd84a429fd", "comment": "Malware payload", "value": "cc71aae03ea182438ba96eea911cf1fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841898, "uuid": "7b652b48-f3e6-464d-b61a-3145cb52ad85", "comment": "Malware payload", "value": "b7672e11f90609938e6ec98a1d418c1e260616b2e326e9c4d8a16944a4e98d59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841898, "uuid": "4b869d2b-f30e-4ab8-a1b9-3a08e80818b4", "comment": "Malware payload", "value": "384b7ae9a68d799014c662fe50b65082829f79be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841898, "uuid": "a7ee6bf6-e8f6-4feb-bd66-a8f410768644", "comment": "Malware payload", "value": "bdcc92d8aa23aec3cbca7de3385549567a3f63f401e6d27d0c468198e7da51bfdce4255f6b1a38bdcce7ed2009ea5cc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841898, "uuid": "4ad1d764-6919-4dfe-9353-75bd20f0c377", "value": "T1A8B5E086BB14DEC7D21D23BC85E177A542241FF4E05AEBDAF50939242EA239D5700ACF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841898, "uuid": "529acbc5-fbf6-4880-baf8-b934b3c6d346", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841898, "uuid": "41822976-34ee-459f-a955-a83dc6c926f5", "value": "49152:4mPD/DL/D9CuZrr2h60qPqppviYmIMbJYmIMby:4aD///UUrPei3Vd3Ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668841898, "uuid": "936b841e-4f0e-4091-94e4-c3be5d81d2d0", "value": 2309214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668841898, "uuid": "1142d2c7-42b0-4bbb-bab7-82de8a09ea66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841898, "uuid": "7c1e1d95-a255-4dfc-99ea-0e15a1e695e1", "value": "cc71aae03ea182438ba96eea911cf1fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15a2af2-6808-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668862206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862206, "uuid": "29bbee12-6d47-41bc-b408-56884bd803b1", "comment": "Malware payload (Mirai)", "value": "3df83457c0450aa72b48fd93bc9737a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862206, "uuid": "0b41c272-9997-4d85-9119-687a2211e7d2", "comment": "Malware payload (Mirai)", "value": "b7aeb3c19547080551764d5222290afb1e3844c29bb9701c6d78386e06097cd0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862206, "uuid": "f679afe4-e8fd-4926-92f9-cc01250a518a", "comment": "Malware payload (Mirai)", "value": "89e73a4967d2874de881ec9b800801d1de6add01", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862206, "uuid": "bc089926-53d4-423c-bd20-2ce9e2a148bd", "comment": "Malware payload (Mirai)", "value": "275affad8907c4501dc5b9078f7949e381c9cb9fa7874cfa167bb5d04251d62c235d1a3821da043e961fcc26c36f867b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862206, "uuid": "f158a6a3-91a5-492b-9d30-9d214379758a", "value": "T141F34B46EA419B13C1D6177AFADF024633239B64D3E7330699286FF43F86A9E0E53605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862206, "uuid": "c2a79059-6cbb-47a8-8432-a71a826bf80d", "value": "3072:pbCFTyAso++OCgaTNSaLTVGdrYf/MHf61pIroqJDbM/9QlsP5P2muw43BeV:pmh3X+LraT8aLTVGNYn+6IrnxM/9QW2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668862206, "uuid": "04cc4914-832c-4cfe-be3b-27836f70a7bc", "value": 161597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668862206, "uuid": "c30e2f4d-79d9-4ed0-a68c-485df760164d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862206, "uuid": "c9f51d12-9471-4c78-99d1-c25716a8c56b", "value": "garm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248d78ca-681f-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668871848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668871848, "uuid": "37561e6c-eb53-42f6-b43e-12e165de41b0", "comment": "Malware payload (GCleaner)", "value": "a25bc64e0938e4cbbe2e538759fed0a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668871848, "uuid": "cd750208-9df1-414f-b363-919a2dcfbba0", "comment": "Malware payload (GCleaner)", "value": "b804c90ba42690ba77659263f8515a5d3922d2fb9ef154a0b663ec446930370c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668871848, "uuid": "6ffa1f87-ee22-48c9-bf88-764558ba173b", "comment": "Malware payload (GCleaner)", "value": "c6e8c21cf1158ea048a3e8ee96e0a3e478fbc6cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668871848, "uuid": "aec3197c-285b-4bd5-9e80-3a831c4de874", "comment": "Malware payload (GCleaner)", "value": "e3d58a0aa1c2c0f736afd368f876da96f8d6e8722b06d9e1882c8b7e7b7b11cdb6df38e66dc9cfb41bd0135ed0e3fc75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668871848, "uuid": "b09c9f9a-404d-46bd-bc42-28725943734a", "value": "T15AB5F0052A96D292CC2F2DF4E52475F849B63E62E92EC27BB3967C4DFE7D3878009501", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668871848, "uuid": "2f2e3b01-dd74-4251-b888-172fdc41eb0b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668871848, "uuid": "1050f4e0-daa6-47ef-929d-6a79977a44cb", "value": "49152:q2kGgXeJH9Sbcl//8iIaNMBEMvUxVkBaFwnm:r+W//8i5p0UxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668871848, "uuid": "0256eba1-f884-4aa1-b2af-c6a5df6e7c43", "value": 2371564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668871848, "uuid": "1cfcfa12-0b4a-431f-9699-b75514884ba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668871848, "uuid": "a834b998-a3fd-473e-adc9-793d4a5bf25e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52ec4ac-6821-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668872950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872950, "uuid": "777e8d03-793b-4506-89fb-d226aa8b5e4d", "comment": "Malware payload", "value": "b231abf6513ab83f67e8f5251229dc08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872950, "uuid": "2a3fff60-ed77-495a-b7c7-1aa51470a02c", "comment": "Malware payload", "value": "b83bec19a53c1e5d8f558486ce3f91ce6b80d2dc3324ca679e7721bc2bcd15eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872950, "uuid": "24dae651-5087-42c0-a730-6706017c351a", "comment": "Malware payload", "value": "dce1e88ce6694b962e65c05581fecdb77e49e465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872950, "uuid": "416a144c-8363-4957-9492-5e9ab46e89a2", "comment": "Malware payload", "value": "669249ba512e8575a2c4ba5a1d6a36bc3fd0d63d0d87b4eb34b42b5a48560a653a07714f1af3820af5abda6805bb5a8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872950, "uuid": "2478006b-dcee-4aaa-9737-6e7488f43c69", "value": "T1757633313EEE85B0D1499CB1957DBBD1D289AB50CF3A056753B1C30CBA2DB0C543AEA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872950, "uuid": "bdd0453a-4185-46a0-aef8-2d5d20572fe5", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872950, "uuid": "65123061-5e35-42ce-a537-b8305b1a4055", "value": "196608:91Ojrt+f8hlgcP4BVCtl/2I/MK5jvTOKN:3Ojrof0We4qtleI/bjvTPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668872950, "uuid": "5d7aa2c5-9c0a-4ae7-894d-ef0dfa01fb0c", "value": 7579911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668872950, "uuid": "471c9116-fc3a-4fb0-a6a8-7b87886cbe57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872950, "uuid": "df44b822-5531-4cb8-9d13-1336a3c0289a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226c723a-6854-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668894608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894608, "uuid": "d7c332e8-fba1-44a8-9fae-984f057d2eda", "comment": "Malware payload (Mirai)", "value": "c50db208819f7624ff590134c5ff1545", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894608, "uuid": "173bf86c-9d5e-4e5e-8a12-b494855e2fd6", "comment": "Malware payload (Mirai)", "value": "b91479e3df23de511c7705559e5b06b676cb47d54cfb93beb77527d2946a2590", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894608, "uuid": "5b345baf-5018-409b-ad59-e444bb06e863", "comment": "Malware payload (Mirai)", "value": "7a612dc9472734488d8493abf244f9c62f65d7ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894608, "uuid": "75210902-4ac0-4351-a671-a0a856b67f32", "comment": "Malware payload (Mirai)", "value": "e9934532ed5cf4792124c1a788e50f37079f22e9a0e0b0a534de44c6f49c54d63e2bade6f74c801a1b45b91af9519f3d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894608, "uuid": "45693c0b-41f5-4072-942d-8b19e4f10c49", "value": "T100A2E11176532D65E3DD1C3DC96A8327B9670BFC90F6327639415620C94D24A3E39A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894608, "uuid": "f3e19673-65f9-46b6-b121-97623d277aa9", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjOOhymdGUop5hR:vvQn4j+ZO5fKAlxyOs3Uozr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668894608, "uuid": "237df744-faa7-4b4a-8f7d-fcfb66d25ea0", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668894608, "uuid": "825ddee8-3b9a-49ad-a5a9-8c30bc0cae91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894608, "uuid": "0b0d0310-65a0-4597-87d9-1c08f62e98f8", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c6249b-67dd-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668843611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843611, "uuid": "c6b26020-6382-4e1c-9cfa-b215a1c0dcd0", "comment": "Malware payload (Amadey)", "value": "e465975605b9c76a80ceea6e5272ba25", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843611, "uuid": "3d9b0de9-b069-444a-a311-9d3eafcb94ab", "comment": "Malware payload (Amadey)", "value": "ba7ae4d81230ea130fc253909c9a37c3c72a3ec900377210d3ae87182e545408", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843611, "uuid": "0a0c0a67-f29a-4292-8e81-0ccdb85e28b0", "comment": "Malware payload (Amadey)", "value": "54a90f145cb07acd2476c0ceae6bc7715061153e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668843611, "uuid": "0151b682-fd2b-462e-bf71-23f08b96cccf", "comment": "Malware payload (Amadey)", "value": "9c51b64cae8a142e47530b8c6b16f6e46a2771b85c4c3e1b23e5f7fc566d09f5645d6fb4f2948b01985a520ff8822f8b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843611, "uuid": "c92071c5-50db-432f-9c19-ad28f2b1132d", "value": "T1CA84AD107294FE72C5C10136892DA7FDAE69AC515F2589C332B4FEAF6E343C169B221D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843611, "uuid": "c0338e02-022b-4acb-bcc5-933c23326fcb", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843611, "uuid": "cf70e35b-1127-48bd-8c26-98ce6d37ee59", "value": "6144:sgwn0zFi1OsLsCRb15Va2TtV4Rgr2+W5JAbgemh+3oQ9gOU+fzYBb6:anQb6sCJawQRgr2+W3reh9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668843611, "uuid": "826e35fc-4b29-430e-a82c-747a7b62d11f", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668843611, "uuid": "a0043a5b-3b37-4c8b-82c1-6cffd62ae98a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668843611, "uuid": "b9797cc1-ae1d-47df-a1ec-a3d9bb05fff7", "value": "SecuriteInfo.com.Win32.BotX-gen.30508.25126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501e02a8-6823-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668873639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873639, "uuid": "98d12b9c-cb4b-4f87-943b-2f4d1caaa213", "comment": "Malware payload (GCleaner)", "value": "28438f711a6c9be54bebd7d56d1da89f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873639, "uuid": "4b277536-0d77-49c3-b75b-fa0226e82740", "comment": "Malware payload (GCleaner)", "value": "bada42b269aa0b517c67fc9a6ecd419f820b608bf0804d35f13cf9a3d399a873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873639, "uuid": "fd2e015a-4879-48bc-b7d7-7cf63e5804b1", "comment": "Malware payload (GCleaner)", "value": "93276bf7675732b7d8b1f1128dc28070de43f3e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873639, "uuid": "759593d8-bb90-421b-8287-800e3ebed2e6", "comment": "Malware payload (GCleaner)", "value": "fbdbf269bc75d6a581c70463b2020b54b6c98d3422276f0c56a36b99cfbc05de9a646a0b5efeb0da29e0cb4d0a99e4e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873639, "uuid": "46fef4cf-b118-4414-ab64-9dc2ac3ff27d", "value": "T179C5F0512A56D2A5C86F1DF0E62038F84CB63D62E82E827BF7A67C0DFE7D3679009541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873639, "uuid": "acb46930-10de-49cf-88e9-948f64de2adb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873639, "uuid": "dc3b4526-00bc-48ac-861f-f51218a84560", "value": "49152:q2R9TcX8hAmabmOUs66woKYxDumNv+C7BZwUxVkBaFwnm:rR9TcyoyPZi+yZwUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668873639, "uuid": "178500bf-3a63-4859-a5c7-6566f0ad23b5", "value": 2536118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668873639, "uuid": "a8f0f089-dfba-4e36-b6d0-3599f2ad6913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873639, "uuid": "f6baa63c-3dbe-413e-a6e4-1a0863ba6372", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990d360d-6808-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668862165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862165, "uuid": "dd8c733b-821c-410c-b624-b8d81539c5c2", "comment": "Malware payload (Mirai)", "value": "51ecd531e525438263494d00cff43782", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862165, "uuid": "881852c7-1a8c-4899-ab7b-0867ae276670", "comment": "Malware payload (Mirai)", "value": "bb868ff559cf91a5e65988accc3bd3c5bb086548678d3b4007d051da53bc28df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862165, "uuid": "ecd7d62d-0221-49b9-9d93-a942c655d27d", "comment": "Malware payload (Mirai)", "value": "676487893bde71bea9a47cca93b8160646c8b2f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862165, "uuid": "4bb4776a-6441-4598-936d-034c0bbc9764", "comment": "Malware payload (Mirai)", "value": "61dcd6cf3a670c0a2ae2ea914a36bbbc94e53e1a6c156649405e98f901d94c890e603ddbcc992ebc4e5d966a45f21559", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862165, "uuid": "94a2fd71-1bdd-4dc7-b449-23209cfba0d3", "value": "T1BFC2D044F005CE05DEEA69F03E50C6DAFFA16F2E69528E8126A163D29F5C2A78345DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862165, "uuid": "82e50983-d453-4cb9-819a-81903c3c3e62", "value": "768:FVdafO76jpmNJJKehmA7trpfIX9KeA7PH4uVcqgw09l:tam+AnKehPRa9af4u+qgw09l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668862165, "uuid": "d39fd2a1-617f-46c7-97a4-3bbb98391a11", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668862165, "uuid": "dbbf7daf-8697-437f-a9e7-d472d20823dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862165, "uuid": "00d25708-edf0-4d73-9530-bc25921fe2e4", "value": "51ecd531e525438263494d00cff43782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fe77b0-67bf-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668830756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830756, "uuid": "820fdcf5-a4a0-4a04-bfbf-edad89d526ea", "comment": "Malware payload (Mirai)", "value": "59a3cadb304a87456fc84314db4c2ecb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830756, "uuid": "5b0d84f3-4d2a-4d99-8d0c-e1fa5d4c4859", "comment": "Malware payload (Mirai)", "value": "bc47dd7ff3811a0d079dd7b455ab297c33bd540d657ecfa1d06ad26ab3550a30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830756, "uuid": "f3680483-92db-489a-a4ce-dd9e81e98214", "comment": "Malware payload (Mirai)", "value": "a24fbb7eca2121acd8b1a410d6da9f2454b4026d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830756, "uuid": "7b2972af-305c-41ff-a35c-a569a27d5345", "comment": "Malware payload (Mirai)", "value": "423c0b6a8881bed7e03a389b2a947422318e426a45e7ad927f0b419dfbcf8217ade73136ed4bb98eebaf9660872bdfb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830756, "uuid": "80ad4958-aada-4205-b4c1-ca023dce5e0c", "value": "T14D430856BC818A12C6E0127AF66F85CE3B2123E8E2DF77079D211B6136CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830756, "uuid": "fd2d8a51-fe88-417c-812b-8b954e105017", "value": "1536:FH0Rv9hcS5f76tdOE1gSqwcO8rsgBXuL27P3hFBw:FH09gQ3jFBg27fhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668830756, "uuid": "ad0a9060-91b0-4893-893d-6f2e1f23a076", "value": 60476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668830756, "uuid": "d0d641c5-8c65-4617-84c4-18ceead47a49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830756, "uuid": "658cd414-9d99-4635-93d2-1b48f88b0e26", "value": "59a3cadb304a87456fc84314db4c2ecb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9f943e-6836-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668881794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668881794, "uuid": "8eb2b2bc-5684-4876-807c-53431e37ec50", "comment": "Malware payload (GCleaner)", "value": "8f49d56cfaa321f37662a54b89913419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668881794, "uuid": "e09404e4-3d61-4f56-807b-36fa2b3348d7", "comment": "Malware payload (GCleaner)", "value": "bc68c8485d9e117ba76116d11b308b30da64d337e6c473aae4fd5062accbcdc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668881794, "uuid": "63f38db6-26ff-4380-b700-96811d272672", "comment": "Malware payload (GCleaner)", "value": "83eb029a43ef80fa707dafd35d5ab623956b32b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668881794, "uuid": "69324509-708f-4241-8751-04304a81552b", "comment": "Malware payload (GCleaner)", "value": "42bc1a53be0e84789c964c97803bf30a4bee85280079e4ebc10be2c76d8a07d31e599ce743d2a620e6a5baff7b057ba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668881794, "uuid": "82d71e6d-b4e6-4b9d-b431-26261acd7e26", "value": "T1DDB5F0516A52D291C82F2DF4E65474F849BA3DA2E82EC27BF3927C4EFE7D3538019841", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668881794, "uuid": "550f28eb-230e-4a11-9b47-69e4a1491333", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668881794, "uuid": "6ecdfed0-eb3c-4e9d-a5fe-404487deaf5e", "value": "49152:q2Fwi1dAVidtKQTVv9E54fpmARNjuc5VruamE/lUxVkBaFwnm:rt3AVI8QLE41/flUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668881794, "uuid": "b919b1ec-3bdb-4293-a91c-b190610897c1", "value": 2349999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668881794, "uuid": "fd8cb374-d5a9-4932-8961-0d97aad23b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668881794, "uuid": "df206936-40af-4003-ae35-51ad56d481a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb62ca8-6816-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668868290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868290, "uuid": "d3329afe-c124-4fac-9b06-fc9af96dc23f", "comment": "Malware payload (Mirai)", "value": "70757861338717ef0739bf5532aa4d78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868290, "uuid": "8e78333e-ca57-42b8-b56b-5b4a9532a824", "comment": "Malware payload (Mirai)", "value": "bccdfbe60743c4f7356578f4f5d72c29a4d3a043535d0ce97d5c7f891da87b6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868290, "uuid": "56d94570-a2a2-4aff-97b0-13fc867a69de", "comment": "Malware payload (Mirai)", "value": "93b5b4d0df40454be2732cb9cb7aa11cf170f566", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668868290, "uuid": "a762c7d0-b9d5-444e-821b-32edcebac78a", "comment": "Malware payload (Mirai)", "value": "4d38f5c317bf3a13cfc9e781c91262665aa80472b59748255c6abe6fbe742090ecb039d4dc19110fd2417fce4b62b77d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868290, "uuid": "0284c6e2-e23e-4ee5-ba9b-2dc156f7ce6b", "value": "T111F2E1CAB01942E9D86AD93429D503E19E7C16F0360B781459ECDDE88B81AED3483FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868290, "uuid": "634fdc52-b924-459a-b4e3-966715dfc73a", "value": "768:wf2oVhv3d8KUCeikKDI+/QTzCr7khreWJDdGbAIMqCJgGlzDpbuR1JA:Chv3d8KbeikKdoTzi76rJ8AIiVJu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668868290, "uuid": "72a2194a-2eab-43ab-9d1d-d21fc249d47b", "value": 35544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668868290, "uuid": "ba4f18f5-3994-481b-83c0-9f45a185c1ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668868290, "uuid": "05aa1092-55df-49ab-90d9-6deef4fa1ec5", "value": "SecuriteInfo.com.Linux.Siggen.9999.7635.14049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd28580-67eb-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668849716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849716, "uuid": "0f172cff-b18b-457a-9328-09e0692f55c9", "comment": "Malware payload (RedLineStealer)", "value": "891d71f6e3e535e8589e8544c9c1a6f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849716, "uuid": "e04c3902-8ecb-4570-a3f0-b77cac092719", "comment": "Malware payload (RedLineStealer)", "value": "befb72b0133ceb62aebbc2cb3cec399f89b3a99f6cb163d494f1176685ed19fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849716, "uuid": "f57ed16e-ed31-41cd-ad08-6cca6958fb3a", "comment": "Malware payload (RedLineStealer)", "value": "94be131ff676b8925c1662b3d0cb5cbf642d3e91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849716, "uuid": "3fc58b15-3915-42d9-898c-36274b260c2e", "comment": "Malware payload (RedLineStealer)", "value": "7b41c1b30fb2bd679b3fc26519c20cd3aeb6729234125cd60aafc8110e63b978049237cb0a36517f05140578039daa49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849716, "uuid": "695978e9-91d6-4794-be46-8f87a066eeba", "value": "T120A4E13473B0C4F2E1624670C466D7A669B9E9613814D5037614FBBF3E30A8E667E23A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849716, "uuid": "5e7a7064-13f8-463c-8b2c-82fed33f271d", "value": "938ae2aaaa8ec1fc2d05063ef7a2e3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849716, "uuid": "696821b7-383d-491d-b4e4-9e6eb31ddc85", "value": "6144:7UpoclY1LWHAeF/iuubvyuI2xZWMNcCfnzfnVYmTjpPnFwCLLObfwB:ClbtbWv1I2xdjrdpHxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668849716, "uuid": "3953e95f-e1ec-4964-9b1e-355e04320bc7", "value": 493504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668849716, "uuid": "9d1c6a85-0026-4f43-b3e6-b3966927d279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849716, "uuid": "e7113ac5-e756-4aec-87c5-fca9591143d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fddfdfb-67a4-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668819012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668819012, "uuid": "6e15702d-492a-44b9-a610-c3b891a883fa", "comment": "Malware payload (Smoke Loader)", "value": "3ccc128d39d9af095db0dd858e014a6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668819012, "uuid": "55c70241-1949-4a4c-b3b8-bfd918da0319", "comment": "Malware payload (Smoke Loader)", "value": "bf5ca1af65b2ee4fc38f8b4c3faf1b1c0ae1b93476fb4abf44bd6d2407c4b758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668819012, "uuid": "7cc36572-80a5-4bd5-83e7-334653037f37", "comment": "Malware payload (Smoke Loader)", "value": "3ece036309c1b84c0addb01c3e0a9898a1673833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668819012, "uuid": "c6de1694-1ec0-4ac3-ba4a-5df80192e54c", "comment": "Malware payload (Smoke Loader)", "value": "c89fd9b0ca21b2bec36a93b3038c2c16114e49a9a1bf827d3fd03aa4b3a52880ed88208ac777cf9043e72fb075821eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668819012, "uuid": "e9ac1bb7-eba0-4db0-8565-f6627e3bff04", "value": "T18174AD157684FAF2F5810171842DAFB56EE9AC514F259AC3B3F8EE5F2E301D0A6F2205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668819012, "uuid": "21a92b74-2184-48b7-851a-5b95ecc5dc8b", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668819012, "uuid": "d96bc676-6483-4955-8d15-319ebc31c12a", "value": "6144:h/QZBzKN5Kp2YIdNd738ULcZh+3oQ9gOU+fzYBb6:eZk2pIdPMW9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668819012, "uuid": "4841429d-2c2a-441e-a40e-3ebdd57fa875", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668819012, "uuid": "5c9f8a34-cc66-4fc4-8492-709d8442e82e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668819012, "uuid": "f3f76b04-5c5d-4d11-9635-02b0b511e7af", "value": "3ccc128d39d9af095db0dd858e014a6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b505fb3f-6860-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668900008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668900008, "uuid": "73d8fb04-299f-4aef-a915-26b8a8d3dabd", "comment": "Malware payload", "value": "67d241546045796737a4372de987ebee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668900008, "uuid": "10eb2a42-fdee-496c-ad52-a00feb66c6ef", "comment": "Malware payload", "value": "bfebd4f8a04916790f80f9ecf0b15bee7396e792156bc68b0088495127dc1817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668900008, "uuid": "0eb40dac-0834-4c95-a14c-9cb72961c221", "comment": "Malware payload", "value": "2f70282f6d68615fa39dda313e0a1fe098bb90e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668900008, "uuid": "f1315678-1f11-4180-8168-1fa58e332eb1", "comment": "Malware payload", "value": "6d2f8baa20af42ae9141c667c97e80c991d4f52ca2cb91388ab752e3c7df352d550b01c9302608911871a3628472202a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668900008, "uuid": "b87430ba-e297-4c67-9232-16219552e7d2", "value": "T1BD84CF11FFD1C0EAD47DC570BA15C7E46639ACA17921DA0333746A6F2EF02919E6223B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668900008, "uuid": "8c901400-677d-4710-b241-af3bd5a5baf3", "value": "9fabaf303efb2031ad569e397ab31c33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668900008, "uuid": "88947c73-93b8-4df8-abbb-86256349d07e", "value": "6144:zpBW+ZCB/85l1nfXDcPIf3wHubPCZhVV4E+O13oXc:9BW+EC5l1nfXDcPog30DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668900008, "uuid": "65391111-8f10-4549-8912-d6ffcdee3d86", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668900008, "uuid": "c0b77f69-03b3-44f2-8c21-4c3c94679412", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668900008, "uuid": "4927d48c-4e01-48fb-babf-4c7f2e7596da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d3f912-684d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668891708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668891708, "uuid": "cc6d3bf3-3577-4e62-9a02-9b19cf3a6be5", "comment": "Malware payload", "value": "5b53e0b3d9105590f16903908a707b9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668891708, "uuid": "2058954c-0ca3-42b8-b9ae-c09f48222a4f", "comment": "Malware payload", "value": "c073804c0d498aaa8ba831c2aa7daa02b90d62aa1be9e820e2697b0adc61ac15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668891708, "uuid": "3e0c3bd2-e611-4cac-8926-3e2c2fa41bd9", "comment": "Malware payload", "value": "dd9b2297344ed807865a2945e5a019b658ba0cfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668891708, "uuid": "ee2cb016-04f0-460a-a8e0-ddca9ad25089", "comment": "Malware payload", "value": "650c1a3df25f1e76996dc5046b51d7fafed64e96509db992f5777f3c9d25cc5d6c6b7eaf803fee3e485fa39532dd48dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668891708, "uuid": "2a20a03d-d3b9-48fe-a0d5-a5db4664253d", "value": "T1AB74CE11FFD3C065E47DC570BB16EBE81A7AACB12A21D913F7742A5E1DF02908E62235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668891708, "uuid": "ae74e5c9-f744-4605-a8fe-9d64cc2fd56a", "value": "3a28fc6cbd66b78dccc28e56534d2c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668891708, "uuid": "85c942e0-6e78-4908-a336-d572375879f9", "value": "6144:Hit9t47GK2sQhudxQg0uETzzd35vQKiEChVVPE+O1voXc:HiLtjiQMUg0uER1Q1DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668891708, "uuid": "b0c414dc-557d-40b9-bf3a-0ea0ab99c720", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668891708, "uuid": "433534ed-1bc3-4613-970e-645748035236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668891708, "uuid": "bea73d59-2ae9-41ee-80d8-a3d23bb4e70d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5003616f-6829-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668876216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876216, "uuid": "3fdc1b65-c4d0-47d0-b2cb-68ebc4152e14", "comment": "Malware payload (Mirai)", "value": "5b3f39b180a6fa9a5af4f08b51f42283", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876216, "uuid": "481310f2-4de1-4894-beef-c34fff0daca7", "comment": "Malware payload (Mirai)", "value": "c1d3b60aa89708e70056ed15bfa3a7ae6208d83cade33e27cd6fec54924a49fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876216, "uuid": "0ccf273d-2ae5-4d0b-b8a6-44f154992323", "comment": "Malware payload (Mirai)", "value": "cf4c1ceb2678f595b7883514211bdeca03495d70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876216, "uuid": "9c89e6c9-de8d-49e1-a5be-6bdfaa98aadf", "comment": "Malware payload (Mirai)", "value": "6e8f4b8f3f09261e83737731d8d3994f3d8a0b98e86f4daf05015c8d54adab5ffdb73677bc63a02f4beaefc5fa53166e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876216, "uuid": "c810e1ce-818b-4579-a654-48dbc7c23a15", "value": "T124D2E19DA018F5C7CF3E0438E19D5370CA38352211DFEB99935288C4FA6E967B51A279", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876216, "uuid": "dfb91050-b3a5-4204-84d3-0bf498982705", "value": "384:HG1OClNFkWYj300xkRQQ+ClyKkwoRyUyoQa4WxA+yVWKjrI0Z1tRWGVCz0NvT3E:HGUCPF8Zk3RDo4UyHKGtjrI0j7WiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668876216, "uuid": "0f1fb9c4-27da-4fea-91ea-b25297a80fb8", "value": 30332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668876216, "uuid": "a9e4cbb6-39f5-46d2-ac70-5f44b939d3f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876216, "uuid": "a0918a23-a2e8-4dbb-b00a-17d103d8d704", "value": "5b3f39b180a6fa9a5af4f08b51f42283", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8237dc-6832-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668880206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880206, "uuid": "d4137244-efe7-4ede-9176-51e4a643a8de", "comment": "Malware payload (Mirai)", "value": "6945ba3d50bc31c3d85e71683a003da8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880206, "uuid": "f7fd14b4-5356-4d07-8145-e4951eea5ec5", "comment": "Malware payload (Mirai)", "value": "c390a4e3b92a07ffd8f6f4d7a14d98c0a821c3ee5bc4aff8a571af61dbb81543", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880206, "uuid": "02376ad2-6894-4f7a-bff4-c0b15be48359", "comment": "Malware payload (Mirai)", "value": "a3fb631f160295c27f4278eb835a7018f3239d31", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880206, "uuid": "6485eefb-7bd4-47ca-a8f3-8450254b473e", "comment": "Malware payload (Mirai)", "value": "76f8ee8c303d95623168b35d667fb40de518bc1a1a692132616310fad1c10548d8230d379e56fc82259d43e72f728101", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880206, "uuid": "96e20569-fa2e-4c50-a09b-2751da085dab", "value": "T1B5A2E0217F1DE98FCC37B27886E5F5C6A3D07D20D2DC89866741C12FAAA36846830E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880206, "uuid": "1ccefa31-cbe3-447b-80d3-679f7c93ecb7", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtnjSy6:M98o08kxofBE+ZkXaT47C2EpitnZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668880206, "uuid": "2204b164-e005-4ea5-bec8-9a8e0d4436d7", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668880206, "uuid": "9316cb7c-c4fe-47c5-84ff-6efaf645dbbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880206, "uuid": "da617004-f284-43dc-ab85-7f4cc300d517", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629c7ff2-67ef-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668851336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851336, "uuid": "c89daa1b-494c-4703-bc87-b48334ba0256", "comment": "Malware payload (Smoke Loader)", "value": "0b4a255ca42d116a305c26265a5f605f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851336, "uuid": "d484f643-7f91-4745-b73d-42f88d9d606c", "comment": "Malware payload (Smoke Loader)", "value": "c3ac86b3dfaed540a466f230e12c3f12c56e10755b6d5d195001ca5523d80fa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851336, "uuid": "8634efb1-533c-4909-b4b2-5ea792291220", "comment": "Malware payload (Smoke Loader)", "value": "198def6bbfc773cb3398fdb7e9c7c0fb55ed7012", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851336, "uuid": "787f0a79-4391-4d5d-b55b-3d38558991d1", "comment": "Malware payload (Smoke Loader)", "value": "9e480cc6785f9ea6e6b06996c5fc8379e6da96496ecbf0eae1dea90f69a52ce1dd47c3f6e42bd3e7d9977bde2cc37736", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851336, "uuid": "0a13b910-efe6-47aa-bc60-f172c3cdda30", "value": "T1FA74CE3472B0D8B2E0754670C525CBA96AB9E8227824DA037314FF7F3E30A9D567D276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851336, "uuid": "5e3cbd60-a8f0-4ad6-8932-8d35f1355813", "value": "045163335c785d665aeb43938f4d94be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851336, "uuid": "ecca2594-5c07-43ef-8ac1-d87ef75f60e3", "value": "6144:IIWDlpDVjenY0GaoOxHxlohXjpPnFwCLLObfwB:CDrDcY1OxROFxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668851336, "uuid": "aab5b6ae-09d1-49a2-9b3a-4c97353ceb01", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668851336, "uuid": "bd3dd3a3-8656-405e-b9d6-f68158f3668c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851336, "uuid": "b865a45c-3f90-4fce-af38-2a3e5ec7c5b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7cf9d7b-682c-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668877705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668877705, "uuid": "3cc529fd-8a53-4ef6-bbf1-5701ca88e75b", "comment": "Malware payload (RedLineStealer)", "value": "6d5575992077f1ff000c2a77ce312b5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668877705, "uuid": "3b0c9247-8bf7-4f27-9825-7568b76ee71a", "comment": "Malware payload (RedLineStealer)", "value": "c3c9d57b69a22007ac8f0d953dd65a969ce5cd5b28bf32f01348d4c39d04cc97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668877705, "uuid": "ef60eeb0-2b52-49ff-beb1-fcf4889c026b", "comment": "Malware payload (RedLineStealer)", "value": "ccfac87e118b15976f11c6dde7bf4312619bb59a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668877705, "uuid": "a66c28b3-2614-4027-9bc0-f5778649d59e", "comment": "Malware payload (RedLineStealer)", "value": "942208b8946f0603f017ef68e20dd7dbe54a815233f9702c0ba6f69246803dd84d9dcba95445e43dee2f31fcbc890b38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668877705, "uuid": "b652e4ff-73a2-48cd-b381-5327444d5b37", "value": "T1F4349C1374807536F9EDC7F5C89D9E16457FA7E0278022CB1529072946F27FEEAA830A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668877705, "uuid": "7ec56520-363c-42f2-bb9b-7a74d3dec8a1", "value": "19f81fe756f31ae8a7d11110e6e81c7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668877705, "uuid": "cb57693e-be4f-4e35-bfe4-f73734334b0b", "value": "6144:2yfNscRBUewg89TjLctzA1jqb7ZdGv2GkLZmHxYKcTrL:ffNHRKe2TjLctzA1jqb7ZdGvlVmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668877705, "uuid": "0420a5c9-7324-4f37-addc-f4b3bd597d90", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668877705, "uuid": "c50baa91-3258-437a-8acf-903bebaeb7a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668877705, "uuid": "c34d0cef-376a-455b-ad55-818162fd57ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10a028a-684f-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1668892673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668892673, "uuid": "6cbfcf8a-1fc8-47c0-be2b-04dac98b68e5", "comment": "Malware payload (AgentTesla)", "value": "a192512d560035a6f5d02ec30e15c1f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668892673, "uuid": "6c91acdc-d2a6-40ef-b9fc-9e638eb65e67", "comment": "Malware payload (AgentTesla)", "value": "c423a2cd001b0aea90ff3ac2e191d3acde70e7511fa84dd57bd576d729144752", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668892673, "uuid": "8c1f79e4-37dc-4384-88c9-e2e8936bc755", "comment": "Malware payload (AgentTesla)", "value": "7d1337b844f5593e49c8b37c4e30117c1d8529dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668892673, "uuid": "5be0f6d3-452b-44e7-bb98-0332d9de79c5", "comment": "Malware payload (AgentTesla)", "value": "8027487313f0f5187d1075b0feadaa4c422f4a3790968ef1eda03f0a1b4a2373c9b818d77f877b801dd7e5954599c9c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668892673, "uuid": "80455611-51dd-40ee-90bd-cff0ed5199fe", "value": "T1D7451202F7CA85B2C1732E715935A7C9697D3E202F39AB1FB3D4182DAA321506125FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668892673, "uuid": "2173e650-d2cb-4cb3-8374-7da31a0f1782", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668892673, "uuid": "89675ddb-4f90-4378-8a5b-f8fe1f9d868a", "value": "24576:LAOcZXMuxSUp7kgOPFEsKWn/hpgshjLzCXPQMTjbnNSF4:NO3p7uFvKW/hpgYCXYMTnNS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668892673, "uuid": "462a88ca-7132-48b1-86cc-6ec3c20af685", "value": 1178340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668892673, "uuid": "e7e628c4-3756-4772-9992-57eba4091f9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668892673, "uuid": "5e43263a-29f2-4953-82ac-7d76a2fe282a", "value": "Attach Proposal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e5f0c1-67c5-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668833274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833274, "uuid": "68747d08-ed6f-4a83-a901-1d8c33a55540", "comment": "Malware payload (RedLineStealer)", "value": "a81c2a345041a9db83754157e2e1bba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833274, "uuid": "83bfdbea-06f7-4408-b54e-add0b7904f74", "comment": "Malware payload (RedLineStealer)", "value": "c4a4d4a5ac19fdbeb6006a9cada8cf5874f3d54007c298ac0194d093cb27a8df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833274, "uuid": "966fd17b-ddc6-4654-949d-a2791e63c3d3", "comment": "Malware payload (RedLineStealer)", "value": "d5c0ae8b8a71989cde37be05e1cd3e15d8f9231b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833274, "uuid": "7f6520ee-cb74-496a-a132-e74c91e4f76f", "comment": "Malware payload (RedLineStealer)", "value": "41fbcb580f09ef64479823976fe26d393c9440db9d4f31b569ef1982844f4e54e24676f2ba05aa71d0c0ae30a3840e3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833274, "uuid": "f574fac0-3e08-461e-a8cb-a5d31dd2e4c9", "value": "T1E0349D03F1B541AEE1FED0BC0093E390922EA67E6F9C148FDA7E1F795B101D1A172699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833274, "uuid": "bf2be259-e7e1-4a02-bcd1-6d798089da83", "value": "19e0e0a97efc31b1e39a2bb2ebdd6fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833274, "uuid": "2644cd04-ed27-44ef-98a8-f735c694d592", "value": "6144:k4cRM8aDXqQhylCuSWhQzL2pJH+m30CK2W1:URMRDXlyILWhQzAH+m30CK2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668833274, "uuid": "bd393464-ff27-4149-a687-5697c8caf268", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668833274, "uuid": "7632ff30-fa45-41b7-9cda-5835d076523c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833274, "uuid": "e66157c0-9463-4f44-945a-ecb01825611e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5593088d-67bf-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668830699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830699, "uuid": "d1f14e85-5f9a-4f41-a73b-9ac7fcb0e19d", "comment": "Malware payload (Mirai)", "value": "70c11153ab58c415381146beded1c8be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830699, "uuid": "80d28319-c9b5-4e8c-afac-8ec07f1b377d", "comment": "Malware payload (Mirai)", "value": "c4faad3ed6ab7bd7ef6a64546cf47daa84fbc8d298f583e16ce258d777fb044e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830699, "uuid": "5837d847-b134-4347-87c6-006ca88c7f03", "comment": "Malware payload (Mirai)", "value": "c6d641697b333c332328a52501fad9fc2c8b2250", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830699, "uuid": "4c89aede-ac00-40fa-933b-ca1b29220c60", "comment": "Malware payload (Mirai)", "value": "fdb8e73a9e6e2a3e6338ed01f20a0fc2e1d4c17219c138b53b524c36f4edb2d5cb95f7bac2fb23049ae63e6d451d4ca0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830699, "uuid": "2046ab7c-4636-4f96-a21d-9a34c76390ea", "value": "T1EF73C519BF610FB7ECAFCC3749E91B46298C945621943B367934C818F68B25B5AE3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830699, "uuid": "3d221166-a0a7-444c-b2f4-d284c2e91e75", "value": "1536:cJfEFvGQrH19rskjDosdRdTgIROY9lbWZephJT:cqGQrH3rskjDouRVTbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668830699, "uuid": "87373610-c6a1-4a24-851e-97a4a0ae6bba", "value": 78244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668830699, "uuid": "0dc7297c-2db5-4c0f-bced-92e3c807ac33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830699, "uuid": "3129b5ad-c25b-4c0f-af5a-8cd308930e80", "value": "70c11153ab58c415381146beded1c8be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f90ce54-6857-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668896026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896026, "uuid": "a37970e9-c368-4cf6-a173-27110e4dc474", "comment": "Malware payload (Mirai)", "value": "209baadf11d1a89353d9c7381dad7a6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896026, "uuid": "986ad93b-e2c3-4fdf-b90d-b2c220d13c7a", "comment": "Malware payload (Mirai)", "value": "c61105e0c0bc15bfa8312f376c60edccb46ae8e47ab9b7fe83827135902f8645", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896026, "uuid": "3152bfd6-0815-45e1-a024-be8b65fb1f2b", "comment": "Malware payload (Mirai)", "value": "ee4233c07513daf405777d93c4bbb9729fa4ac2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896026, "uuid": "1c89c89f-ba22-4094-b0e5-d7e8143228a7", "comment": "Malware payload (Mirai)", "value": "d4ac8a14b900990574dec6195cf24334505fca771c1dcedd3c58f63a7f337ca99e06fad9f9c6363bddda6e74d8a85afe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896026, "uuid": "0ce97f46-8e46-4375-894a-d81816c02fae", "value": "T1CA82CF30119B75F5DBE10431EAAECEC6971A0BF9D1FC36D316586B78C94640611FC2CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896026, "uuid": "5059acd6-aae2-466b-9c9c-baa92e464669", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa5ewhymdGUop5h5lU:6/V0P6+kom0tVAoNvm+to13s3UoznlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668896026, "uuid": "bb6bf4f5-455a-4b2a-86ec-1681c6246477", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668896026, "uuid": "f698059b-b96d-49cb-ae1c-26f2e076d6f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896026, "uuid": "daf022a6-cef6-4dee-aa0d-3668d7e04e52", "value": "209baadf11d1a89353d9c7381dad7a6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888de393-6830-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1668879317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879317, "uuid": "7b312876-360d-4e13-9611-16c5797bdce5", "comment": "Malware payload (RecordBreaker)", "value": "869ae3c13547fba52f597b17234ae4e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879317, "uuid": "592f4d44-2bfb-426f-8b68-dfeb3c90db13", "comment": "Malware payload (RecordBreaker)", "value": "c71ff322802000e11c6581974731531d0cbab6c13d6250b3ddd91c9527dd6db1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879317, "uuid": "6a9d1d44-e280-4e20-ae38-38e81a796376", "comment": "Malware payload (RecordBreaker)", "value": "2ce70c06af7a3c066036d9d3dc1a8a887f2ada40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879317, "uuid": "a7ce60da-8036-4423-aaeb-590dde2d196a", "comment": "Malware payload (RecordBreaker)", "value": "477a22e005b6e6c0d8d31cb7c37c69e284fec290f8ccad073022c9b7d9601dd9bbf56f5fa57837304fe1d06da327f611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879317, "uuid": "85928255-4edb-4d3d-b35a-f22d4a5cbc4b", "value": "T13424AD207580F1B3C7761CF044E6CB359B297021476992DBBB9D5AEA7E1C2F1A2363C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879317, "uuid": "3abae85d-6f4a-40af-9d5f-2f5aff8d48f1", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879317, "uuid": "0a467527-ee2c-411d-80e1-8be5718c09ba", "value": "3072:CDKW1LgppLRHMY0TBfJvjcTp5XuyW9ER98FnlsMSE1mzu:CDKW1Lgbdl0TBBvjc/uhEjuXSE1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879317, "uuid": "c5973ab9-9071-4f35-a56e-f8303f5a0cdf", "value": 228498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879317, "uuid": "63d112f9-44aa-49cb-bc54-a3b6f4f27ca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879317, "uuid": "514b7c3c-39be-4068-b042-773449479b4b", "value": "869ae3c13547fba52f597b17234ae4e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a70c5c-679d-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668816047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816047, "uuid": "2e83d424-e192-4bca-afd6-2abbbb8728de", "comment": "Malware payload (GCleaner)", "value": "ac39296cce725ae49e28f4b3f4e12b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816047, "uuid": "283b91d2-a659-464d-a1d2-554e0e8c9236", "comment": "Malware payload (GCleaner)", "value": "c74997763d3bd99e53a05ef1f0e9d294364762e3dc9c93356a6fe1733685279d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816047, "uuid": "abe8846a-4931-4698-9067-240563a78202", "comment": "Malware payload (GCleaner)", "value": "2a22c3257c8fc0d0fbf4986e1da0e137788d2f0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816047, "uuid": "79686c35-529f-4ded-b20b-8df115a6ae32", "comment": "Malware payload (GCleaner)", "value": "247585524643a0190f8f7f3e17330d656f261a277a514594a692657a214a9007fb6ae4fd413074027e8bb3c7028d2b00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816047, "uuid": "1944595a-288c-4b39-b316-f1fd0d730e1f", "value": "T1C2A53363B2D3957CF2208C75090F42BC9B69B4F1193D072876E98CCDA77BA41598ABF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816047, "uuid": "f9a76bfd-c9f5-4db7-a31d-d3e2699703e3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816047, "uuid": "e9269014-9b4d-4d84-8570-67b5440821e7", "value": "49152:q2CMNK+GFARXpfBV/6CrQl8cAH88Z/rOIChxBD+x2a/7lIyHfRx7Pq2:rC6K+G0BkCM38ZAhxpaNlZPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668816047, "uuid": "71d4f66c-e681-4fae-b061-425c79f1dc65", "value": 2237595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668816047, "uuid": "d880f53d-8ed3-43ab-9d10-f1ae1501e4a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816047, "uuid": "acb63fb1-822b-4e24-bb48-d323bf6efe42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c2d8d6-6844-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668888038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888038, "uuid": "23d7eb2d-42c9-480f-b7c5-1cb0529d5f45", "comment": "Malware payload", "value": "d0460cb38b1eb0b657cf0e3806b7e9ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888038, "uuid": "ec30ba46-3874-4451-9fd0-835f1aef7acf", "comment": "Malware payload", "value": "c7b0510d65efb70ed7fcfadf2852388c01f7846d23d2ea77fbd3e984441ea29f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888038, "uuid": "03f2c26b-1a81-410b-8532-e0c79adc11f2", "comment": "Malware payload", "value": "bd825959c12db8fab0d57d50eb3e76d09065f1e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888038, "uuid": "e0ffd5dd-d00a-41e8-805e-287dc2adac80", "comment": "Malware payload", "value": "428281919ade203888e2c557560ec194861959a893cc751e743939d3dee9e68842cf115e27b375dbfa788dedc9b233f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888038, "uuid": "8b653445-b2ee-4d4f-87d5-44fc355bcacb", "value": "T106B5EF516A06D2A5C82F1DB4E56034F88DBA3DA2E82EC27BF3827C5DFE7D7938019451", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888038, "uuid": "ac1429e5-638b-45c5-9de7-d7d0c3f37c6f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888038, "uuid": "bf7c6500-791d-4426-ba3a-64d00e170e97", "value": "49152:q2LtopohFirtK80IryXfh/502pA7JujSOExVxXLMnUxVkBaFwnm:ra8StK80ImvhnA95nxVJgnUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668888038, "uuid": "7218e9bc-2ad3-4b30-a9d1-604fc59cddc1", "value": 2353782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668888038, "uuid": "4398527a-eb22-4695-9dae-a7d2b10d20f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888038, "uuid": "ebe16ccd-6ac0-488b-bd9b-612f8a43393a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9592b789-67e8-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668848415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668848415, "uuid": "7b178173-a9dd-465f-88fa-bf109b836cc9", "comment": "Malware payload (RedLineStealer)", "value": "7054cbce93ad714d17ea77594dff0d70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668848415, "uuid": "0b423d59-1b82-46a2-a4ee-97752250495f", "comment": "Malware payload (RedLineStealer)", "value": "c89b2294bcca45ff92145bc40a31e03cfb4a4c312b893e8ab3c6c292be794ea3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668848415, "uuid": "75b96da6-b6a7-4e17-9b16-c1843020a812", "comment": "Malware payload (RedLineStealer)", "value": "db1e99bfb6a8f307ea7d6365ff5e0fe64585313b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668848415, "uuid": "13ce82b1-41c7-4183-b578-e29fe0b7fbf8", "comment": "Malware payload (RedLineStealer)", "value": "0da79c1cd90a230a7075f9d03fa61c04bf2ba4d3148517be2f865ca185cdca32f61378d43c4960803e73a5c13a4ab0ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668848415, "uuid": "cdc95751-2e67-40e0-bf13-223e5d8d607a", "value": "T1D1355B2AEB0625F4DA275775865EEF779B18BA048032EE3FFF4BDE08A0334163849551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668848415, "uuid": "779d3849-21fb-4215-a497-4c0504d6cbfe", "value": "4718c85fe28e792412bf1679bc40c971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668848415, "uuid": "ded8ad18-dda2-415a-b079-65eed0ce2a90", "value": "24576:y6kfHY0Yp7xiey1MIzWQ2oPV7O+D7kNEzyCmGUf3E:y6kZnlEizMBf3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668848415, "uuid": "0f05d364-c152-4421-b786-6b6bfca77ca0", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668848415, "uuid": "1446ece3-be1d-4407-a72d-2a8bdacd0133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668848415, "uuid": "f144fe75-9b05-4697-a978-e0f3bbaceb1c", "value": "7054cbce93ad714d17ea77594dff0d70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fafefe43-67e1-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668845579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668845579, "uuid": "72495691-b9b1-42d3-a753-0eeab3fc650c", "comment": "Malware payload (RedLineStealer)", "value": "d3fe981491e9a41c8ba01699412dcfff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668845579, "uuid": "ede9f93e-a26a-4fc8-8d14-2d178a395fa3", "comment": "Malware payload (RedLineStealer)", "value": "c8bf9f62050fd5ea2b05756d42aa309b142fda4109b2bba7d7d0b0bb8e2db289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668845579, "uuid": "db10ae19-8108-47dd-ac74-0a1e76839977", "comment": "Malware payload (RedLineStealer)", "value": "715686b17987be74d9d63468eafe368a67b1143e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668845579, "uuid": "073ef350-c5e6-4d4d-9b07-e8dbf4115fbd", "comment": "Malware payload (RedLineStealer)", "value": "0d8d4176d2da9f4e115de5d77b81071001cf546e8e84af9e0d0329fcae32411eb9506c44330625f8788c0c370f8a75ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668845579, "uuid": "99aa6b6d-6c7e-40c3-9b09-9ca92620550e", "value": "T149A4F03576B0C4F2F5618634C425DBA469B9F8603520D6073618FBFF3E30A9D6A6E236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668845579, "uuid": "62ce4b73-d180-4990-b180-4e7831390590", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668845579, "uuid": "923e4d4e-fd10-4622-af6d-0235c530d288", "value": "6144:ia+1umAzbCMnOr6FvZUPTGNgRDpeJCdE/7FHwc8lNv29Ct1vhJmu/NGHfjpPnFw8:k1umqWCvZUCar8CuxHO2gLj/NkxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668845579, "uuid": "3bc7ca5d-341a-4506-82ce-91823d7130b5", "value": 493504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668845579, "uuid": "3d7ac6f8-4cc4-4195-8541-4f7a6fcd9b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668845579, "uuid": "1c3ed374-3971-4e8e-9ac8-376a5393cc15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fab41b8-67ea-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668849103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849103, "uuid": "5295e6a9-33d3-438b-87e4-14a17f8437cc", "comment": "Malware payload (Amadey)", "value": "66e40e069f2e68d2eb62b1ec1f259945", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849103, "uuid": "123db5ef-5d31-4453-a3ca-e24d4f1fb852", "comment": "Malware payload (Amadey)", "value": "c9878b985b5fd3a1ae4326b141c3a003572c8884ae41184b163f27b83c5ecc78", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849103, "uuid": "77dfe3a3-8fbe-4c8c-8b44-1cb92beb8b8c", "comment": "Malware payload (Amadey)", "value": "533592ee6fb2f4941de3bba17f0dd91573ed7ad2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849103, "uuid": "11a9d8a6-50b6-41b9-93b9-04ac4f821ebe", "comment": "Malware payload (Amadey)", "value": "fda1c7cd75ec5b41c3f05482ec7f23d41ee95f3cd141527071d2405e3d085ef6b12016e6bf2a362b69002f6d318b86e1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849103, "uuid": "2057c055-1a2e-4d62-8f87-ce1d56fed3e0", "value": "T1B584CF34F2B0D4A2E1614770C4E9CBA556ADFC113814EA633214FB7F2E30A9D566E27D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849103, "uuid": "b0e98f7d-3a96-43cf-9217-d47f86f7b12f", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849103, "uuid": "7d2f3b65-86c8-4c6c-923d-1424823c4ff4", "value": "6144:We4sf+kzloiUMrI1wdfSA/YWdtPPYICjpPnFwCLLObfwB:W4f+An0AYWdOxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668849103, "uuid": "d251e390-6de9-437f-8399-a38b09e03e78", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668849103, "uuid": "e19fe047-ffdb-43f8-8fe1-65e7eb150094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849103, "uuid": "1e53db8b-0297-4d21-b9e6-0340fbda5b80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15dc58ed-6847-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668889003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889003, "uuid": "9da71719-d748-460e-a208-a0ffd2f93f4c", "comment": "Malware payload", "value": "d9739b0d12b5920683f2787c861d3d94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889003, "uuid": "60d23f7f-ce27-45bf-8269-400d239d3990", "comment": "Malware payload", "value": "c9c3b15533e8ec8cdc00ad597e12d9f424c409d0ea398884efc620604603f852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889003, "uuid": "4ffafcbf-b7b0-4480-90f9-61d13874dc3e", "comment": "Malware payload", "value": "15fe3862d1f4f31c6c0ceebd9e3d0cd85b96ca6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889003, "uuid": "37b98da2-678b-493f-baeb-daf86852d4ab", "comment": "Malware payload", "value": "d481a70ee24b14fb6cb9f5e3e637ec9f4852ebd3553c944bd912ee75a490fa97282fcbd7ef9f7216d3fd200c01f77ed7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889003, "uuid": "d21384bf-07c1-482e-a897-c2be54c5a7a5", "value": "T10164BD10FFC0C465C47DC570BA25CBE81679ACB2BA28D91377746A5F6EF02A18E72231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889003, "uuid": "9854c731-8604-4a57-9a48-8e1ef6ce5512", "value": "3a28fc6cbd66b78dccc28e56534d2c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889003, "uuid": "4c9586fa-a49c-43d5-ac7b-b10e0c7ec6af", "value": "6144:nnvWVg5gcffPWSq9YDmNfhVVPE+O1voXc:nv+g5gc3G96+DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668889003, "uuid": "2048ce45-8551-43c2-9659-e113a9c67388", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668889003, "uuid": "20f4615f-31d0-4314-a079-991b7261e887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889003, "uuid": "5878d461-7655-482f-b0c1-ddf2cddec64f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52160f1b-6800-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858610, "uuid": "21b4006d-0b72-45bc-9fc3-78356b947ead", "comment": "Malware payload (Mirai)", "value": "8f58b8c94d755f85c663f343ad1f325a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858610, "uuid": "b32aeb2c-f08a-4910-a4d9-18c9718e454e", "comment": "Malware payload (Mirai)", "value": "c9de6403d3a32d59d89e0a5374913ce920f3acd82de01452ec069deb7c973755", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858610, "uuid": "834ade8e-72db-4fb4-a5ff-004d6b8c41d9", "comment": "Malware payload (Mirai)", "value": "23e4e2b923dfecbcf52eb7f46a022d1c32fb1dad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858610, "uuid": "6e6c72ef-e623-4fe3-b200-fe050c47b00e", "comment": "Malware payload (Mirai)", "value": "a7d1d0e04d99abfb7fa5e40cb844ddadf9021ae031b651e54f0a606cedff74efd89d33ea1cf0fb001112f6b357af00b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858610, "uuid": "761ef226-e435-4797-be2e-625f72220b09", "value": "T10DC2D130A6AD2CB5C7600573F7B856C5BE430FBDE6EE3C9011404BBB394190569EA9D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858610, "uuid": "fad99e14-1ebb-4bff-b0d9-b114829bc102", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEh/cLUthymdGUop5hZ:A7soTAZ3alkXLvFh8nNE6LUts3Uozj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858610, "uuid": "9121931d-c6dc-4d39-9d76-e8f55efbb4ae", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858610, "uuid": "34819058-e1c8-4a2e-9268-06877aa24cec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858610, "uuid": "4839aa76-5bab-4ebf-acca-db7601030cef", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3d1acf-6847-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668889017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889017, "uuid": "93444a3c-7022-4285-8968-df4965817336", "comment": "Malware payload", "value": "c1ba3fdb3577c50ed45cc976fd3b6418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889017, "uuid": "38afebee-1780-4285-be8d-3b4a47b3eefb", "comment": "Malware payload", "value": "ca240b4fd7c8b8dc492d92070641e46fd4dd125a7e9d394d7d1bba7e83cabfca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889017, "uuid": "ea04a4bf-db97-4763-b406-e04de0ded1ca", "comment": "Malware payload", "value": "51a11c1df96f9d6cfc7edc303d2c9ac99f7e64a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668889017, "uuid": "bf239f56-7496-4833-b645-290125479c26", "comment": "Malware payload", "value": "864bd1386809941f6212ccd8172d7105b74a502c86e7e78ec1a7fed7e13d6f4fe130e75d15a9399fae3023407f1be4ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889017, "uuid": "0d08d362-6fbf-440a-b1a8-d1157638fcb2", "value": "T1B165BE18B37AC0A5D752887EAD630A316A741F791F79DCCB87D5B7620C10FA48CB25B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889017, "uuid": "91052d9b-2d27-4c87-9ae1-221cca896362", "value": "b2dd0861dcc82a259d1c8907d9c316e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889017, "uuid": "ac79c2d0-a6c2-4272-a77e-ed76587a4f73", "value": "24576:qUtxooQw3J58cYLStZ2c+Gyq9ijQcikFfnoZeYOPTOJ7Jb:roWNbPdZcieoMOJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668889017, "uuid": "b7d0f6ee-c34c-4b4b-855d-8013361a91cd", "value": 1432008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668889017, "uuid": "a2ba84ca-7b79-4e02-bb14-8bb086137448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668889017, "uuid": "9ee79a16-f8ed-4c02-95b4-05165af76225", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8401afb6-685c-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668898207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898207, "uuid": "31cbd785-bb1f-4c22-841c-284a79dcb9b4", "comment": "Malware payload (Mirai)", "value": "cb83d29ee02149c38956e6671ed15d42", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898207, "uuid": "e3dbfa30-d05b-41b4-81b6-de9fafe52b63", "comment": "Malware payload (Mirai)", "value": "ca7244473203142df59ed166c275f1d574a5e6af5c0a36a06037a5660690cc0a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898207, "uuid": "f3a8572a-f39a-4528-9520-5ddee63ad8ec", "comment": "Malware payload (Mirai)", "value": "2a9637185e3e8d28775802b8f4dfad6e7d552d9c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898207, "uuid": "5dbc4c7e-a278-4e65-9f38-c3dc1ef3269a", "comment": "Malware payload (Mirai)", "value": "f144f467f49510ae9b432a401639446d122a99f435b848b6643f0c7d95e0a44b48bcd1b892e9f9b9fb2d46de0efe10d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898207, "uuid": "739edbc3-6b7e-474c-821f-48ae22009d4b", "value": "T19413F2A3789DBF0AC7F21439D5B94D847AF64FBDC2F6B23111478680AAC190B0A7E745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898207, "uuid": "1b6d158f-a14d-48e5-b52e-7be160fd7738", "value": "768:M+o6gseWyX4qWdAYLbYRzj5Dnj60EUaLkY72N46WSTE5bwFQ0dVxRrs3Uoz76:+2yXxWyu0RzlDnjpaQYSNt3ECNdVxRWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668898207, "uuid": "5cc09e8e-9011-4c9f-83bb-802bce30b2c1", "value": 43004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668898207, "uuid": "75ba79cf-df43-475a-87f8-f7fb08b190b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898207, "uuid": "c2f00ae2-bab1-4b46-abf8-07d96dd729ae", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf2d9d2-6813-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668867027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867027, "uuid": "804b03b4-aba6-4b38-be5c-8fc22ce65514", "comment": "Malware payload (Mirai)", "value": "eb424378e2da52894cb90d2cb7199002", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867027, "uuid": "b252c8eb-7da1-42e2-b3fc-92b8ad1b5dad", "comment": "Malware payload (Mirai)", "value": "cb8216a3130ce1424b1cdafff55f8757e98a19bf5112ef91c680f7d19dd9acc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867027, "uuid": "6f18b805-4d92-4cad-be3e-6e608c89b91c", "comment": "Malware payload (Mirai)", "value": "335ce24a0dd85556cc580b53d52242b838c5d877", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867027, "uuid": "c6c3b25c-2102-4800-8992-3fbd53a693d6", "comment": "Malware payload (Mirai)", "value": "d973eb2b1d86b158963f374ab572045b4cc726cd1452e2348630d1806001be8d633d85bbf7248a446db258294062265f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867027, "uuid": "17465869-e67c-4c94-8dd7-8749b94b69c6", "value": "T10713F1E4CAB198C587B083BABD3F4A271F91187D105B74496DB6C51C0BE368C6F78B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867027, "uuid": "0120b780-992e-461d-9c02-ff53b0fb6211", "value": "768:Cytod6/lD5vJ+C55XvMVOBmZfBbTli/R6ThkIT3W5b0s116ERT/vQqN9q3UELK:csvJJ5Ve48fNlmUm5gs116EdHgLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668867027, "uuid": "e165d3c5-5034-408e-9843-f9b8846f37a4", "value": 43628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668867027, "uuid": "0981eede-2c00-475f-835f-8ea7a0f68f0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867027, "uuid": "276e59f7-00ec-46dd-9691-48a72040131b", "value": "eb424378e2da52894cb90d2cb7199002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085eeb51-67a2-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668818114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818114, "uuid": "287ef338-b67a-4df0-a48b-9b5cfdd1d49a", "comment": "Malware payload (RedLineStealer)", "value": "e678498c3cf9b42f69907a728c56339d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818114, "uuid": "6e13f84a-5f61-4d83-a5e9-f493872a783f", "comment": "Malware payload (RedLineStealer)", "value": "cbf9b5fd0f1fbd2b41c923287845fd459d141f64ded5aa1620d1d5780b24b0c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818114, "uuid": "5e5b519f-7952-40bf-83c1-c4c43bdfc848", "comment": "Malware payload (RedLineStealer)", "value": "392b6923814d25a6b8a3dbd69bf1b5c6b5a986b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668818114, "uuid": "41defcbe-ee07-40cd-bec6-52ccfa65a1b9", "comment": "Malware payload (RedLineStealer)", "value": "7d3b2ec850c2cb93666c0ca857de8c0d84fa71ee33a2aa6771d03d52c4c6ea35521e0d123aadbee0d78ee1f999d2e2e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818114, "uuid": "e68c712a-9507-42f5-8406-5808502f3c65", "value": "T11184BE107790FE72C5C30171882DEBB56E69AC515F259AF373A8EF9F2E302C0A5B2255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818114, "uuid": "1dffa6c6-ab95-4c09-9205-9bfc5b27b451", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818114, "uuid": "38df17aa-efd8-4786-ab83-7fd7ac52d512", "value": "6144:K5IYHzCFaEipo9g7SjKpYkTw7h+3oQ9gOU+fzYBb6:zY+6+q7SjZkcU9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668818114, "uuid": "28524df4-ef0d-4277-85a4-76fea79bfb4b", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668818114, "uuid": "d44e8e03-bac3-411d-9916-33868dc041bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668818114, "uuid": "e98a4cce-7c4f-4895-a35c-c2721a0ffb40", "value": "e678498c3cf9b42f69907a728c56339d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2b64b6-685b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668897714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668897714, "uuid": "5e53ac96-ffd3-4dd7-bb1d-3a0d70d5dd2e", "comment": "Malware payload", "value": "0053886879fb6697ee25b8dcd9ea3724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668897714, "uuid": "6ea61035-b1bc-4fbf-8027-5d3a64cffa8a", "comment": "Malware payload", "value": "cc8321982633efd133f144be8c2d287462dc8faf858fceccc7f4722544b3a749", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668897714, "uuid": "5737c26a-44dd-404d-9979-24e176b71a08", "comment": "Malware payload", "value": "181a9fc30b8f83fd356860ebcf00b28fdad1f774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668897714, "uuid": "c2f0700d-6bf6-4b6a-bb52-518d557fd317", "comment": "Malware payload", "value": "257bdf7fd30388f36287d97f1f9b3fbf60ccc980d5517f78b5407f54e886cf7b8be1591808ceb1667a526e6a6fdc3362", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668897714, "uuid": "23dd33ee-64b6-492b-b1b8-1ce41d31a0e6", "value": "T146B4E011FFD0D0A6D6BCC530BB15DBA95A79B9E06920D5033774AA9E2DF02924E33336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668897714, "uuid": "7112c101-4e6f-471c-aed8-0fa15afaf6c8", "value": "9fabaf303efb2031ad569e397ab31c33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668897714, "uuid": "529f349f-28a8-4047-8a8d-095fef7e8a2c", "value": "6144:jdrTSUA7pEo/Dxs+lV3PuPX1rTC7v0YLs7nIFsOCZhVV4E+O13oXc:jFTSU7oLu+/81rTC7x6nIF60DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668897714, "uuid": "426fd74c-5045-4495-8be0-567a14d8dc6e", "value": 494528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668897714, "uuid": "df593585-c12a-40bf-a7d6-7f716d2d8a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668897714, "uuid": "c0bf284a-ab3d-4664-bcbd-80b00a68e6e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80379bdf-6806-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668861264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861264, "uuid": "122ca5f4-005a-46ca-8ed0-4deef49ec560", "comment": "Malware payload (Mirai)", "value": "3af1ae24d7811ce4c30496a66d13c516", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861264, "uuid": "3aed474f-4e27-4304-9cc7-007857c76dcf", "comment": "Malware payload (Mirai)", "value": "cce12fa343ddf318106f8f5b1533596a9dfde388fe3572f8fc60d955b5b2497e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861264, "uuid": "fde16a7a-dd38-4681-89de-45c41cdeff49", "comment": "Malware payload (Mirai)", "value": "9f9612031ca467d7145189d1bd4675eaaf52a434", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861264, "uuid": "dab62a86-a321-48d9-9bd1-96f5c9304cdd", "comment": "Malware payload (Mirai)", "value": "58a360801a268e2cd2df04a77b9b688d395c3945a629d39857dde51c8ba9a3034e81cc2ab8741f7ffd706a5d0e2f3de4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861264, "uuid": "8c9c1f68-73c1-404c-a96d-97a5f05dcfef", "value": "T1B3535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861264, "uuid": "1689c789-2bf5-42eb-b33a-ef3abfd94a9c", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8E:N1GjR8EVGOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668861264, "uuid": "6d8e101a-a898-4662-9394-eb7382ee2cb2", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668861264, "uuid": "0b274b4c-0d37-40e6-b710-de6e7e121529", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861264, "uuid": "3a7f795b-45e1-4f86-9a17-7d7c00dfaebe", "value": "3af1ae24d7811ce4c30496a66d13c516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8baa355-67d7-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668841253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841253, "uuid": "27901ec1-c15d-4c81-adc3-df83fef0d7f1", "comment": "Malware payload (GCleaner)", "value": "0c5008436076fc239891159597432ee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841253, "uuid": "828ac809-c641-4880-846c-95c34bd68ec1", "comment": "Malware payload (GCleaner)", "value": "cdc71edb8f095d64c362b0b8c1a667f134af4781b36dcf4595728e79cc30bdca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841253, "uuid": "35a8d79f-fd18-4296-81d8-12ad8280d02a", "comment": "Malware payload (GCleaner)", "value": "d9dfb255f1b4422a1c9a18b93e2e7bb32b2c0a0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841253, "uuid": "43b8c356-2999-4380-b82f-047fece100c8", "comment": "Malware payload (GCleaner)", "value": "93565f5c1019ab6e4c33b59f73f123abd51db4e4aa5f4f041d2b9f6904abbc6cec9d1e240d1910ccfd26fcb70aee2c31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841253, "uuid": "accdb593-7a88-4099-92b9-8686e0033eb1", "value": "T11EB5F0506A56C295C82F2EF4E55475F848BA3DA2E82EC27BF7963C8DFE3C3979409500", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841253, "uuid": "e92f8192-adea-4ae4-959a-77b10130b0fd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841253, "uuid": "5338b07b-0119-433c-a58e-b9a1e4efa6ad", "value": "49152:q2DR72W8rWTWhV1gpSsukx4ReAvALps/+CX7ds0pCIUxVkBaFwnm:rDxB8rWCV8xIig+CX7LphUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668841253, "uuid": "49f71a3a-76d6-4d8c-8564-a8af2361e58f", "value": 2353552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668841253, "uuid": "c934fc39-3aca-4b95-8418-9338039734c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841253, "uuid": "bf819e6f-a2b8-4579-81a6-970d08b0b222", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff1e0e6-6800-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "1acd6740-6d9f-4f20-ba3f-f7985539a0d2", "comment": "Malware payload (Mirai)", "value": "5e858a1593f4b228ff2c11659b2b422d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "4c7b9167-b327-4797-8e32-e149778fdc06", "comment": "Malware payload (Mirai)", "value": "cdc82b592492bf7438a14e019a808b3486b5d944d10a19632f75bba2f94499a7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "624f3413-4f16-4a6d-a15c-57276cd97d68", "comment": "Malware payload (Mirai)", "value": "76d21324699c415d939098d79a4f09e884954277", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858606, "uuid": "8247ce67-3c9c-4b1a-982e-6a1ed2e02bc6", "comment": "Malware payload (Mirai)", "value": "2ebe077d5033c57a2f2c16ce9bc318b698356d2d2c21936c06b24e816f2ca276480c19ebf8e731479a516e2383332f7a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858606, "uuid": "6c4e0cb8-f8da-4f71-b406-67e7e9e82477", "value": "T1D2C32B46FB818B13C4D5177ABAAF42493333E76493DB330699185FB43F8669E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858606, "uuid": "bbec36aa-80e0-413a-ba60-c46702307ba8", "value": "3072:FfqRWhNVJxwPgyPbQQS5peiN3BEqRfc3rM/9ftBM:RqRWRJxwP5UQS5pei9BDfc7M/97M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858606, "uuid": "c37618f0-edef-4466-bcf6-9c65bb160596", "value": 124473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858606, "uuid": "2c3a4e5b-da77-4548-8ec9-bb6d79814f3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858606, "uuid": "6d2125a4-6ce9-4134-8f30-e3f88096fe80", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1580a8-67d9-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668841876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841876, "uuid": "fa41f76d-751e-440a-98aa-85f0421e8d69", "comment": "Malware payload", "value": "25651840e02bf97a96704dc51ed5734c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841876, "uuid": "1025d3dd-c224-48da-a2c3-29e44a4d8134", "comment": "Malware payload", "value": "ce113a662533f41f9c28897fa3171d35506127f2bfa036dbf882d104dcca9dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841876, "uuid": "aad0f716-8d10-45f3-bf7e-8d80df1013d2", "comment": "Malware payload", "value": "3060bebf5f9a78a89f0096f0515d30faacd8efed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841876, "uuid": "4425a7b1-87b6-475f-899f-08550c252e22", "comment": "Malware payload", "value": "4c403d7ae813ea37e628ed99118e2ba483e08a2bd1566f286481b4cab0add818393ec6f2bda78e063eba1f6c3077dcef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841876, "uuid": "4567cb60-7b9a-421e-b3fa-12fb7657ea3c", "value": "T11474DF32B9D05436E977593005B4D3E2983EEAB1B8409A5777CC5D2C1ABE3F1C620AB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841876, "uuid": "53e1f8b0-e3b7-4850-a22e-8a1a5789fd0f", "value": "b0146a56b9b57c502315499a5493c29d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841876, "uuid": "5249a6a9-e6b7-4a0e-96e4-40bea0f78973", "value": "6144:EYC+cN0PQ3Le9nELX+sOH/YPfz3i+VCH6nGqufzgx40FhIP5Q:EYC6PQuEqsOAHzjV+6nHWzgx25Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668841876, "uuid": "f6e06896-e3eb-4e00-b42b-19c9ffbdbd6e", "value": 363368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668841876, "uuid": "8d6e04e0-4ea2-45ca-a829-f198bf12c60c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841876, "uuid": "5f5daf6c-2899-436a-ac01-a138ffc26ac6", "value": "25651840e02bf97a96704dc51ed5734c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f62639-67e0-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668844871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844871, "uuid": "35700245-82cb-43d3-b733-1cd6786e3650", "comment": "Malware payload (Amadey)", "value": "38030cc27e9455e345e809b9b7dc134f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844871, "uuid": "902cb4cd-8f42-4296-909a-55f519a3fc84", "comment": "Malware payload (Amadey)", "value": "ce20bcbc991052870ab008dcdeaeae84dd817ca0e6bd40a0065909bb57598ab0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844871, "uuid": "2d407b6e-06c6-432e-89da-d217aa5af48f", "comment": "Malware payload (Amadey)", "value": "b015daa2be11b496a3a5cd6df05c6c6107394c01", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844871, "uuid": "4ac4771f-a31a-4b74-ba46-a80ddfa95597", "comment": "Malware payload (Amadey)", "value": "c27acb0df4296fadb4c43cbb8f4e2fb23203ef1e5bb150e6a44e98c53454c2bb548d9dac747ed0a5a2f57ca133d8fc2b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844871, "uuid": "0e29f2a0-5e8c-4d04-bfaa-8c5b6bb25a0b", "value": "T13584CF3472B1C4A3E5664274C8A5CBE466B8F8217924F6037314FB7F2E30A9C766E275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844871, "uuid": "82ae8c53-6751-4a6b-8b4c-00f731ea657e", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844871, "uuid": "c5cbf2b8-c974-4aa6-af2c-f68803f4d911", "value": "6144:aGbFwezLGKDn58u2FhDIgbj0KBdCeu1hLCjpPnFwCLLObfwB:ZFwQDDleCsj36eghLExqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668844871, "uuid": "a4a1a772-c735-4601-bdd4-6bea426ee501", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668844871, "uuid": "47ac0d98-72eb-483b-88d6-1dcbc711cb71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844871, "uuid": "d65fa763-8651-435f-b000-08758e3142ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f343e41-6829-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668876349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876349, "uuid": "4dfb00eb-9ea7-48ac-bcdd-873898ecfa66", "comment": "Malware payload (GCleaner)", "value": "790260dbdc60a99b2f2d5c0186f3c0d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876349, "uuid": "01f260bf-fe2d-4747-be24-92d4620d1c3f", "comment": "Malware payload (GCleaner)", "value": "ce4b7c0fd905078e0d38a7204e52c26a8654f052b1562a543725e58049b61c28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876349, "uuid": "273f5f18-c724-4744-8f9b-2416b561d764", "comment": "Malware payload (GCleaner)", "value": "5bd6e9069095e996c2898af1bd7f6ef8633198c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876349, "uuid": "7cd11e87-7d5a-47cb-896b-e4808893c72d", "comment": "Malware payload (GCleaner)", "value": "196e67047c7c2ed01c81328f3bc327c51b7575beb7af8106158ae46c9e0e1e48e49f6194cfead36c437f5ffeccecc2fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876349, "uuid": "30722e89-32a5-447c-b8f9-1f465b35ed20", "value": "T1B6B5F0412A96C291C92F2DF0E65474F849BA3DA2E82EC23BF7917C5DFE7D3A38519401", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876349, "uuid": "e7194236-29b1-4679-9042-8664e4ca59b0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876349, "uuid": "ab98af43-647c-48d4-8dea-15df7d2b976d", "value": "49152:q2WhqAZLjc/2Y4G1LijZu7Y8Ii8RQZCPz7F7Dg+LMUxVkBaFwnm:rW1jcIZgCJrtg+LMUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668876349, "uuid": "97620593-6bd0-4858-bfe6-96f4a57363ad", "value": 2333193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668876349, "uuid": "d238593a-4b3f-48f5-b8ab-d75f9cbc7b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876349, "uuid": "c767ee19-c7af-419c-91de-a61b3df43062", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef85632c-67f7-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668855009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855009, "uuid": "fb763356-6b67-4ff9-9233-e2d807604de6", "comment": "Malware payload (Mirai)", "value": "c37586f732ac81cd2be4fba13cec21e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855009, "uuid": "f37ab741-53ac-48f8-8570-72c6160b8e8b", "comment": "Malware payload (Mirai)", "value": "ce6df6316ab77889d544b1c7a6cfb0547901c2c2d7e1f23af9c64b57ebb5ac0d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855009, "uuid": "6d47e184-bb44-49f8-9f7d-01cce2a4e73c", "comment": "Malware payload (Mirai)", "value": "9daf175ac6d38ce7a04e951269ba8766a433e03a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855009, "uuid": "09fbb63c-0a56-4b8b-b7b2-ce58d783dff3", "comment": "Malware payload (Mirai)", "value": "1e10d694784171667ea7236821bbafe26afddd1b0e9ef73dad25f1b0145c6488fa1700230c8e5586578879be68417574", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855009, "uuid": "a4e99911-6c30-446b-a48d-d3737c50eb23", "value": "T139A2D11572632D65F3DD1C3DC9AA8317B9671BFCC0F6327679401660C90D24A3E39B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855009, "uuid": "c6ecb8fd-bd3a-473f-b858-98b8aba6e90d", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjcyhymdGUop5he:vvQn4j+ZO5fKAlxYys3Uoz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668855009, "uuid": "4eb56cc8-29ba-458f-ae3d-1aaa6ec9243f", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668855009, "uuid": "f0f1643a-1f78-4ee3-96c9-4eac0b41c822", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855009, "uuid": "89e9c322-9ed1-4d19-a66e-80b125f7336c", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1f593b-67fe-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668858013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858013, "uuid": "7a148c60-ad79-4e34-b3ed-b179a5601de6", "comment": "Malware payload (Amadey)", "value": "4ed41c24a1a7b4652c91599eee41b43a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858013, "uuid": "ffb304f1-3c71-4030-90bb-23cbae10e9f1", "comment": "Malware payload (Amadey)", "value": "ce947d83cd0544fa022c2c0ba0390ad7a0c9251c9a6e8c7917e1231b6581d075", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858013, "uuid": "1bd65be1-ccdb-4e72-94a1-721e1406a78a", "comment": "Malware payload (Amadey)", "value": "e219ca22394f0aa6c8a7e316638c8ef8f9cb0f9b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858013, "uuid": "f1663189-495f-4f7f-9289-8e04ddb57153", "comment": "Malware payload (Amadey)", "value": "a13ac9e3cd497c1fe88c410f4c719159cb56d9afe54b75eea29ce300178ef4875aaf29df0cb8d0299f83b443de8d45b6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858013, "uuid": "bca5924f-595a-4776-94c4-708057abf9f9", "value": "T18684DF747BB0C4B2E1620671C829FBE469B8E8217420DA433714FB7F6E30A9D566E275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858013, "uuid": "71210ceb-0ab1-446e-ab79-45b3927a0588", "value": "045163335c785d665aeb43938f4d94be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858013, "uuid": "e56dc831-5374-47a5-a1e1-76495358e9de", "value": "6144:CrUTjV7q603SiCXb1wkteiEA0JU5n7TajpPnFwCLLObfwB:nTo64tGb1wkd5n7TMxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858013, "uuid": "2594971d-c82f-4bc0-befd-2a96b6e05c94", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858013, "uuid": "b2b1295c-4e23-45c8-ad2b-44119674cce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858013, "uuid": "9ab4712e-19b1-4787-88c9-cb71743740b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4ead26-67a4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668819085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668819085, "uuid": "85953d37-fb79-4717-8a53-5eaa868bb0a1", "comment": "Malware payload", "value": "ecd507a6e8f8f1733e36989cf38d0d70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668819085, "uuid": "255b7ead-2b65-48a8-897e-91dc8e28474f", "comment": "Malware payload", "value": "cf40cf351e3a511e295e83aa676eea756f07d605036631738d78872a388ed33e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668819085, "uuid": "54069b82-aa63-4b9e-bac4-0d00bc25dd08", "comment": "Malware payload", "value": "8ac00263b5a21121b832da5d94bf0c960b53d67e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668819085, "uuid": "4274a2a4-068f-4abd-ae41-b8bba40f93f6", "comment": "Malware payload", "value": "016b90eaf080db28a4199fe9742390474ed44ff57ca985e8eb0b313dfe87e6a332c28a71d3f4af2956ba2ae86f9208fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668819085, "uuid": "fb305095-f0fc-4137-a8c5-abd6ab2e35d0", "value": "T16BA5B5A0EEEB40F5EA035870546BB23F5B3027098738DEDBDBA01E42D577AE31936519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668819085, "uuid": "40916211-74c9-4c48-b316-aad79e092e8b", "value": "49152:rB3pvIEnEFeJAzS3Z1vAaE5FKY/t7mWcz64tVD2uCLfP5/xfKopX8Lh1eFP:lZAxD23ZVWczxVCN/FGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668819085, "uuid": "b9b149ac-38d1-4edb-8cc3-b401c1b3b414", "value": 2187264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668819085, "uuid": "b77922cf-d92e-4088-ae8f-61890dff1495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668819085, "uuid": "4f62d4cb-3d7d-49e0-bae7-ce6492e6f155", "value": "SecuriteInfo.com.Trojan.Cometer.5589.19043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b631a9d8-6831-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1668879823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879823, "uuid": "957681fe-f817-4f98-a123-b3c76d7b9ea7", "comment": "Malware payload (ArkeiStealer)", "value": "f46063253ff38e6b2452bf4410c5fec0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879823, "uuid": "db263583-ac94-4ec6-8ee7-e99fef06cc21", "comment": "Malware payload (ArkeiStealer)", "value": "d0a4986cea15c050dee854ccd21cff84179a950a70faec28526c7aebd25a0970", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879823, "uuid": "5c38bf7e-d0d0-4926-a968-711562dcccbc", "comment": "Malware payload (ArkeiStealer)", "value": "c2444e21cc72bfc1cd74197e327323eb2e3e3815", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879823, "uuid": "7e045d7a-d9c0-4da0-8456-cc7b014c93bc", "comment": "Malware payload (ArkeiStealer)", "value": "7642e84af0223f41bba1bdb70ead96a046792a91c4834678cebc5bb471e6e6081970a3d124a4497cce6a3a3d05594e0d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879823, "uuid": "75fd7abe-dd6e-47d9-8287-ed4c5aced1f8", "value": "T16F741212B002A073FC7B44F94BB61B9CCB6EF481974951E7A7CC899E4B15BE1BA35206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879823, "uuid": "3a0309f2-5edd-4d1a-aecc-3411052045da", "value": "4f9045b9a37dfeb5655e25a12fd7684d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879823, "uuid": "b6626a6e-087e-4bab-bfcc-f1fa16aa5260", "value": "6144:mYCc3GK5cRKFKT0Am1GaDgj9cBtrttZbzT1+Iq0UMNpBfO/6kjDt/JwrkgdxEy:mA3GKiRzTLQWKBtrzdpx/u6kBJwvjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879823, "uuid": "aa29e038-faa2-4ce6-a86b-65863463a6cf", "value": 341006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879823, "uuid": "494531ab-70be-4d11-9bbd-d2c3798d28fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879823, "uuid": "cb26ff4e-e1e6-4d8e-b337-7bfa8518ed28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bd3667-685c-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668898293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898293, "uuid": "55da9302-2b3c-4175-93b2-3e3854ebc1d4", "comment": "Malware payload (Mirai)", "value": "5955e0dc7119678f0770fe6d5617a784", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898293, "uuid": "d269c19f-ddb5-4f79-a3dd-df2168e8582a", "comment": "Malware payload (Mirai)", "value": "d142aef12f8711b1248dc8b9db009faabeed6bb6ee1b19552ab68dd3401c6cfd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898293, "uuid": "f1cc6622-5ead-46b6-8420-2db39e1fa8f1", "comment": "Malware payload (Mirai)", "value": "db2374f0f89a2b913b09d51deaa1f16cad7929f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898293, "uuid": "3bd160c9-8efb-4268-b17d-0b1d4208c277", "comment": "Malware payload (Mirai)", "value": "407e3822b9ddd24294ff37533939396f244ac9ed911678a58b4e5732d269719c492005e07b6c2c98512fc7acdfe7ffb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898293, "uuid": "3e347ce2-b681-48b3-be93-394ad4ed411b", "value": "T19123E11C2FE4B7D6C6AA7478455C81A586C5A280330B8F4493256DDE71A4CBFFD8F0AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898293, "uuid": "6e483d71-26bb-401d-a3c8-23bc69da29be", "value": "768:psjL36Yz70rE0H71suF+GoxXSB9d0rbzexB2CSxXd0LdzWJ:psjLKFVxFX9CrOCCS9duM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668898293, "uuid": "9e328442-7e1d-4397-ab4d-c6ecde8a0447", "value": 45664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668898293, "uuid": "82bd1eeb-2878-48c5-b443-f8eca63e7b82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898293, "uuid": "2ba60bd7-f57f-48ef-94dc-b305d882ba8a", "value": "5955e0dc7119678f0770fe6d5617a784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70cd096-67de-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668844257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844257, "uuid": "4126e3cc-3db2-4099-a256-bbe72669d483", "comment": "Malware payload (Smoke Loader)", "value": "e39940d2afc29d4e68ff73b48b335c4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844257, "uuid": "d14ee354-1a5d-479e-9404-b7d2a7a421ec", "comment": "Malware payload (Smoke Loader)", "value": "d1ba949b2ecb15b48da6a161abbaaca9151bce1a3675d895ae431b806b203600", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844257, "uuid": "eccea2f2-275e-450c-b390-8021e7e81a48", "comment": "Malware payload (Smoke Loader)", "value": "cb4c8aad22be0a78ecd1349889cb75271b963206", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668844257, "uuid": "f9984eef-fee3-442e-bf7b-ae647fb06dd4", "comment": "Malware payload (Smoke Loader)", "value": "7b5f9ca96b7bfc4fcddaf49d75794e1831b75961032a25fb3b8d3664eb47816d78ed5398ad920f5ae3cb359023482fc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844257, "uuid": "2b81b4a9-14e8-43c0-97c0-d01ff9de349f", "value": "T11C74CF3472B0C4B2E1754674C825CBE459B9ECA13614DA037654FBFF2E30A9C9A6E239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844257, "uuid": "9b0c4d29-29c5-4548-93ce-c13a945fa464", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844257, "uuid": "0ed01e81-dc54-4a4d-b2f3-30ed87d17836", "value": "6144:Iy5VSYzHKW06hvok9d6bdDjpPnFwCLLObfwB:dVSqcOd6bRxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668844257, "uuid": "2bfdeb6e-3bcb-4b00-b5c0-085aaf00c57f", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668844257, "uuid": "5a995544-9fc5-45db-a795-505e86405f5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668844257, "uuid": "9b6f7d50-4529-4306-b99d-5c79edb763bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a590d4da-6821-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668872923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872923, "uuid": "5e034a81-1ec8-40cb-b8a2-9b0835b297a2", "comment": "Malware payload (Smoke Loader)", "value": "90c6cec047b67f012f0608f9b606d9b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872923, "uuid": "4396d53c-dfb4-4924-a13e-4d0f2d28473f", "comment": "Malware payload (Smoke Loader)", "value": "d2a8f19aa676c66f5ad9b2e617c0759f3f8051f2ad4e9828d7ff4831a038cfc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872923, "uuid": "806e8646-e37f-4ee8-b660-d8f90b65e1b2", "comment": "Malware payload (Smoke Loader)", "value": "b8f8615940bac0bc0409630ee486a9b72d0412da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668872923, "uuid": "abcfd738-8c59-4e18-9f29-6683f28c0b0c", "comment": "Malware payload (Smoke Loader)", "value": "03d101a8f5fc9ee51001364a00313e561a32d62e3345c2f36417806a4bca45c0cf90fe8efb06f0794d4ea1564a3fa78b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872923, "uuid": "33fe81c7-8dac-4520-817e-3d02983a1b47", "value": "T1B674BE10FFC0C4E5E27DC570BA25CFE85AF9ACA16911D91373F46B5E2EB02918E62235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872923, "uuid": "6ff76dba-a45d-4798-a9bf-fa5e0da67d16", "value": "063e5449636b8762744e9ce9f5564a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872923, "uuid": "c7039c26-d30b-4372-85eb-1cde803d5a3a", "value": "6144:sw0F+OZyN7k010FtVcZ8GpCAhVVPE+O1voXc:UFhPU0FtY8GptDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668872923, "uuid": "92a56b5c-5513-4f1d-b4a1-e3cc8b0c2e27", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668872923, "uuid": "7b8b1c4f-01a3-4d5c-864d-801b3093786c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668872923, "uuid": "979bdb96-f483-40ad-85eb-086303e62a0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d09860-6806-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668861272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861272, "uuid": "4e542fdc-2f0c-42f4-ac24-23c756ac8118", "comment": "Malware payload (Mirai)", "value": "2b7c8a2bbd9223925578beb1dd7b45e5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861272, "uuid": "680a9f11-4b17-43c5-9dfc-bde43e0f2307", "comment": "Malware payload (Mirai)", "value": "d2b925919c0e40908b823798fc1fda499e1c184710a107acd5cef972b9bc1cfb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861272, "uuid": "58b55530-f1af-4a6a-9ad7-a1b242f3c0fd", "comment": "Malware payload (Mirai)", "value": "55f63af2bf44b58e253b5e06857978f7d8880e59", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861272, "uuid": "91a770fe-8afa-4cf1-8f06-f39e76de26f9", "comment": "Malware payload (Mirai)", "value": "19cbe777c965839222d61f0b22baea339e47b66548b8afaaa928f123b030a407a9d881e1b9aeab9bb65f14075a0b5a36", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861272, "uuid": "27e85cae-c2d3-4c3d-8630-b1678762a41a", "value": "T173D2D0A994E7E5B8D0ABA5B5003D46D4FC76B227D1191BB70CE8646ADF070D84E30EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861272, "uuid": "5270ab2c-eac5-44cd-b98b-b835fe3b43d8", "value": "768:NYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBfaOSx0se:NYJdJZiy1aBnQfTqBfaxte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668861272, "uuid": "f01fb0eb-a684-4cd7-adc4-c9da7c67192b", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668861272, "uuid": "88f7ba8c-d772-489d-97f1-49a248b35648", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861272, "uuid": "4ed0c19a-f8f2-4864-9e07-8d2e067d6c8c", "value": "2b7c8a2bbd9223925578beb1dd7b45e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f838c31-6806-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668861317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861317, "uuid": "521deb08-9050-4779-8e2f-9dde80a9a9b0", "comment": "Malware payload (Mirai)", "value": "8d239cfae3e3c5f000b31e9ea7e5eac0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861317, "uuid": "f07bcb6b-e057-422e-8109-04a28ab374a6", "comment": "Malware payload (Mirai)", "value": "d34f3a805f8b08d2a624d9b349494b08b9942f29671446d3cf269030a753c7b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861317, "uuid": "9d28840e-97a3-4616-b10f-4a576e049758", "comment": "Malware payload (Mirai)", "value": "d433dce4acf2b8ef02d33f6b2752280fc68eca29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668861317, "uuid": "7c334eda-bca1-44d7-887b-d921f6647743", "comment": "Malware payload (Mirai)", "value": "6be0ff2b12f47403637a0de6e2db4e354bcdbee7ae42a171a93dec8a27017289844f8be29ce7dd60c7b3b55dce529c1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861317, "uuid": "76526f29-790f-4db2-bd91-11c94853d91b", "value": "T1DBB2D0E487915616C2B0B479E2BC8FA26B3B15F0D2F62527162092FCDA4549633FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861317, "uuid": "726436b1-cf6c-45ea-96d1-75ece60c3baa", "value": "384:4C9KXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BNs6upFthymdGUop5hu7g:4C9KQFH0rs3zWoDDRsjt7LB9U+ByDtsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668861317, "uuid": "afb34db3-8b66-47a9-906a-5528f0cc1ab2", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668861317, "uuid": "7afe059f-6d2c-4834-92ce-1e42b099b93f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668861317, "uuid": "8f83eaf6-31cd-4141-89f7-c9c6ebd86336", "value": "8d239cfae3e3c5f000b31e9ea7e5eac0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1242702-67ca-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668835684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835684, "uuid": "bad9c33a-8af2-4740-badc-3c6ba5c48b13", "comment": "Malware payload (Mirai)", "value": "ad1a0e8e6c81c8bc2cf954b6d9c49e3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835684, "uuid": "1fc2e571-f4f0-452d-aaba-bea04a90b1dd", "comment": "Malware payload (Mirai)", "value": "d369baf3e27c79098c0370956536cde692f17738cca821451fa8e61551a144e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835684, "uuid": "8d35f313-fd39-4934-963f-e74e2d1ff86d", "comment": "Malware payload (Mirai)", "value": "01859cdd0da4a1749d1fd1f544a69f6db15d8d6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835684, "uuid": "2c1052a8-42a8-4094-8f98-1b53735fe7b6", "comment": "Malware payload (Mirai)", "value": "7606f50b22a47b7e0d283038dbe923a32a06cbdb97339b78ba44af5074f9cf40c95b1a38e239d2e410b1b9233e1d280d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835684, "uuid": "4c24b9df-7d8b-4e57-bd5f-6483ca854317", "value": "T118330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835684, "uuid": "61df03d6-d081-400f-8f12-46c370686213", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGL:r/hqaJMcjeqK806MHdMfQXoHuCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668835684, "uuid": "850d6f5b-362a-453f-890e-4057e80b1238", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668835684, "uuid": "7c297adf-abea-47e2-a3e9-8c2f75776d7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835684, "uuid": "3bf37e3c-4b11-4f87-a549-de371b4cc6d9", "value": "ad1a0e8e6c81c8bc2cf954b6d9c49e3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac77ebf6-67d9-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668842011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842011, "uuid": "27cc0823-57a9-43a2-b5fa-e91e7393d3da", "comment": "Malware payload", "value": "006f8cd7706b816095c54a3043a0a22e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842011, "uuid": "8a90a3cf-d159-4f56-ac41-a03f462b9558", "comment": "Malware payload", "value": "d46c819f9629bd9b1d8eb63fd21ddb68ad7973b43db38928e2f2b9073f24a761", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842011, "uuid": "2a771956-1c7a-418c-a2c0-42535b96a451", "comment": "Malware payload", "value": "ecf994d70e9cfc06b7d788e486241e822a70966b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842011, "uuid": "856a2af8-e740-4e43-80ae-7340d0cfe4f3", "comment": "Malware payload", "value": "47397c90a50d81cf8d6bb77d411d2dc8dbb09ff9495e711e3d494256d61ccd4f7680b3a2d0a1dde36f52d58115e63ee7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842011, "uuid": "343970cf-5d18-45c7-9c2d-11c0a019d79c", "value": "T14BD1833AC6E89B62421F0EECB57451DEA424C750A3537E21570F8D66EFD0620CE7E593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842011, "uuid": "a160b649-4d5e-4833-b78b-23c7dc459e83", "value": "96:JEtSXZlm3ZTDP35I/vykzpzPXJPD3Rlfo1pS9NEhUq9DzsUrb5Sk927C6BkQIC:JEfTKDPxTRZN2DzRqCMk7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668842011, "uuid": "efcafd8d-b7ab-463b-90aa-60f29934ac75", "value": 6376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668842011, "uuid": "1309ebe5-faa1-43dd-8d57-2846d17c9c50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842011, "uuid": "1c66ffaf-12ba-403a-afc5-141fb3ec71dc", "value": "LKakZgCuoghgZkjEd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7243f2fe-67d9-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668841914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841914, "uuid": "2a298bdf-fd5e-4526-b0e9-9cb9c9325d3d", "comment": "Malware payload", "value": "722395af45f480324d02224aac42b627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841914, "uuid": "d7d46068-8134-4745-a848-5bef52355c3d", "comment": "Malware payload", "value": "d4aa4e2919521f861933491197e59c37a9a574480f8b83f7a1fa82ddae3ca2b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841914, "uuid": "cc195e92-efad-471c-acb5-4708365caa71", "comment": "Malware payload", "value": "6a054616ef5af2201ceada2b3085ac5890ba8799", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668841914, "uuid": "4ee3e867-6ac9-4a3d-b44f-0da7fe8dd503", "comment": "Malware payload", "value": "0e4f36bc623203287f7a1c01a302a99348a03d7bd48fe135a12ac64758031d5ab0306c24be48a4ff906434033e88177a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841914, "uuid": "de64d033-a8a4-4332-9540-b234c3501a4b", "value": "T11CA52359E6D98971DC7A2BB04DAB078307323D205E79527A7F9658060CB3688FC3B367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841914, "uuid": "6a6c79fc-2754-462b-bbd4-48c0dc0f0765", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841914, "uuid": "a9fde1e0-8573-4c1f-96d2-a981cc9f7c3f", "value": "49152:oCSZUt1b8xKrw4NSHbCXvDtP+Um6SZdfXM:wuHGT4NSHbChmUFSZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668841914, "uuid": "fca01a1b-276e-420e-ae3e-161250a0fd32", "value": 2204672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668841914, "uuid": "2984b4fd-f49b-4d66-aa4a-0a576b9d1d23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668841914, "uuid": "dd77e3a4-ae29-44c7-a954-58ca67b74f8b", "value": "722395af45f480324d02224aac42b627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ee2ec1-67bf-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668830746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830746, "uuid": "08c9deda-6370-466f-97d9-345111224cc5", "comment": "Malware payload (Mirai)", "value": "894a9cab35b4043802324465316f91d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830746, "uuid": "3d098544-87a5-4b51-abb1-1f6a6f5887b0", "comment": "Malware payload (Mirai)", "value": "d51e95b6a81637435ee6168620531b511b8cba151e94626b9787c875c279bc31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830746, "uuid": "66cccd11-78c6-463b-812f-92c49f63cb4c", "comment": "Malware payload (Mirai)", "value": "e9c03c03d16bff2e31ac55242c49b6de7f78f27b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830746, "uuid": "6f278005-5936-418b-98d8-866c4be3b74e", "comment": "Malware payload (Mirai)", "value": "39d2fce6d105b7abff36cf7edb41615020e23f4b4d39171d935c0dcf5e7030b3cd4e7fac1a755e030c7748ca28bb505a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830746, "uuid": "89ab97af-3ce9-4f67-b6de-16024a05f140", "value": "T147336B65E8294D64C14E01B4B82C8D3E1FE3E4C5A6823DB26ADEC671144FADCB904FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830746, "uuid": "2fc9d6df-7401-481f-a517-1233abe298bf", "value": "1536:3a+BiFCYXjD2/FuhF/KbwBx/TURAYEYCF:3pioYXOt4RjyAYEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668830746, "uuid": "6d986b45-0295-454e-bc3d-129c896e9e54", "value": 54668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668830746, "uuid": "2510a38d-65db-437d-8dfc-d518e78a780e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830746, "uuid": "d6f26b00-13e4-4b8f-b4d0-c4afb33ebebb", "value": "894a9cab35b4043802324465316f91d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a62b34-6825-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668874472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668874472, "uuid": "412ab4d0-f977-4d03-9ec9-3288af4394c4", "comment": "Malware payload", "value": "dacd4a9e4b815cfe670890bb1baf9fe2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668874472, "uuid": "f1cbee65-985e-4d76-883f-49cfff0fc495", "comment": "Malware payload", "value": "d5b9355eb3583f16c7dff8f217802b0c1533c378ba2f5c778bfbf38cccb625f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668874472, "uuid": "f0d37118-6fe4-4fb8-a650-fcf2358a4fb5", "comment": "Malware payload", "value": "0621e57f7d240bb88320a6f58caac0fa3bdd7d25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668874472, "uuid": "6656020f-b499-4060-ac93-ff70d667c823", "comment": "Malware payload", "value": "47383b1e6cc597a29fefd4185ee0bb08c7cb7a876dc9d57749e67eefb0e2b533bd553424cd509541d18a206c83187bd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668874472, "uuid": "1c2ecb12-6903-4f89-b1a8-550e0b0adda4", "value": "T1DF7633127FA5D9B9C84E8532C7D62FC36137E7480B22DA5327949E8C2F3D8E5C11AA1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668874472, "uuid": "2b14808b-ed83-435e-927a-93affaa6941e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668874472, "uuid": "b933e934-0d69-4756-bc79-60297118b613", "value": "196608:91Omst5cgF82Fz2jULCuDU1ARdoG9OG8lNX:3ORwP2FKsC4RRK2GNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668874472, "uuid": "2c5f106c-536b-430d-b87a-0a479ce07851", "value": 7648361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668874472, "uuid": "2e3cc4cf-744f-4f64-b543-2a3eb1a61fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668874472, "uuid": "bf1f947a-ecdf-4bf3-a335-6bc228508e44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575948de-67c8-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668834567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668834567, "uuid": "60ab5afe-aa5b-42d1-bb1f-f3aed7fd3876", "comment": "Malware payload", "value": "bc16458578608c5397b64e75a0ad39f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668834567, "uuid": "e4032ca6-6599-4590-9430-ec1a084f52dc", "comment": "Malware payload", "value": "d5e64883c89a0e1d5c1a7c0b4d9e1333bdca715be9def76483a46a424963c1f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668834567, "uuid": "abae0896-c06b-4277-9e7a-ee255e01baf1", "comment": "Malware payload", "value": "6c6e7567eb79c985dbfa8719c49c490558aeebd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668834567, "uuid": "5ba99664-7ec3-41c1-b209-2ee9ed9997f3", "comment": "Malware payload", "value": "8c383a37d2b21a5024c469a73d8230f9d6043e3c76a7b82da3d14db46be9b3f4ca56d6a920771c55760109901c69150c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668834567, "uuid": "73a0c684-75b2-4c59-8839-4a45af54c178", "value": "T167763361B8FC8831DF61A2B769343B56B7F9DA391870C433638998091BBD451D81B2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668834567, "uuid": "30449db5-7793-4690-9a02-f958ab82dcd5", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668834567, "uuid": "902a7f1c-5871-4bcb-8f71-4b72ff343336", "value": "196608:91OonS87KTM7wLYeAuhM3w+OjM8nOry25gaOQyTP2r:3OonSKVOag+iMAsngaZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668834567, "uuid": "e262031c-6f5e-480c-9edf-5613d9e66568", "value": 7648559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668834567, "uuid": "7e6bb367-ab1b-45dd-beac-09798de2f0f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668834567, "uuid": "7a0d4fee-2614-4af7-ae60-44e46a4dea22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bfb2f0-681d-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668871318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668871318, "uuid": "cb7396a3-eb25-4864-8def-ef2cdf45b145", "comment": "Malware payload (RedLineStealer)", "value": "91e0e1506ae78aa35eb712c6df7e49b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668871318, "uuid": "718cd169-20d3-436a-a688-fe02fd5f9fd1", "comment": "Malware payload (RedLineStealer)", "value": "d7b731af07c7cd86b2d25c314ef0bff43e3c935daddc6d6d60a2efb8c3fa91c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668871318, "uuid": "20095815-ed99-4102-acaf-c5dba29eb887", "comment": "Malware payload (RedLineStealer)", "value": "ad3f92ea2cedade84df73b39d39b7fda29c64f33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668871318, "uuid": "0827c0d8-60d5-4b28-8ae9-a2a4da54fabf", "comment": "Malware payload (RedLineStealer)", "value": "33e8463423453c0335dd4f838025da4d4dd2cd7bd3e58b6cc98ee1596489768bf33199acf85d1fc1e4b7621b22df6ff9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668871318, "uuid": "0a7ff17e-4a3f-4520-9dfe-226bf26a0cf8", "value": "T1DAB4F000FEC0C476C5BDC570BA25D7E9967ABDF23920D91337346B9E2DB02918E62236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668871318, "uuid": "be6981df-9a4e-4ebd-b77d-5a88398daed1", "value": "063e5449636b8762744e9ce9f5564a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668871318, "uuid": "7ac41bbb-a5c3-4ace-b3ed-33e13714d06f", "value": "6144:mAU2J4L1H24CvX1IMmzIg1Pg7lDuWqrgl5gz0rz656BYschVVPE+O1voXc:a2JGEK38kPau9rUKQyvDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668871318, "uuid": "eb633cce-b6f2-4c78-be07-dda4dacc7c84", "value": 495552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668871318, "uuid": "75b04105-9f2e-4686-a8bc-32e08bb56fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668871318, "uuid": "741b1234-5c98-44eb-9792-d263703beaa2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f8ef5c-67da-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1668842240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842240, "uuid": "0c3dcd5c-1781-4c26-889d-78bae4761e9c", "comment": "Malware payload (Formbook)", "value": "ac32cc059f2945493d3c4b33fffd583f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842240, "uuid": "16539f82-919b-4f3d-b1c4-81f0a8113f18", "comment": "Malware payload (Formbook)", "value": "d7c2f69689d1a1e95671fefa4ee708f62d29f078443bb31259ce2100bf5c37f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842240, "uuid": "2b3be284-4b64-48ba-a672-f57c0c37b6b6", "comment": "Malware payload (Formbook)", "value": "fd8557882fe16402378b4c35c92265f7d765640e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842240, "uuid": "46c85e51-c9e6-4543-ba0b-b279e1e4b07e", "comment": "Malware payload (Formbook)", "value": "4a93a15b39704c6d7812d99471777e70c9f755d21b6b52ad985cece2e2528edf44236d6f892c967dc644a2daf5a76a88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842240, "uuid": "770e91d0-2de7-4ea2-ab3e-95fc3a4e51e0", "value": "T1F4842368A1E22C8BD993903205B35779C33FDF511989A64787F22FB76871140EE6F193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842240, "uuid": "1711028b-3bbd-46a6-977f-5e8b7e42defa", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842240, "uuid": "f0d3cea7-0774-495c-9249-c35cd021fcff", "value": "6144:MEa0NSc0uW744Db5XPmUeMDxMDUPRLQ7qMw9w354kCzXy0T7lR8Fw5DjVgK6sxN6:XcuW74KbBmXe1QP3qNX7HDjRVuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668842240, "uuid": "6e28a07e-90f9-4a72-9f15-d13ba34d8ed5", "value": 386897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668842240, "uuid": "432966b8-8008-4e4d-b5ae-0f2fc49d0ed2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842240, "uuid": "679f8e8d-7b50-4c41-bd24-b4a01ea4f186", "value": "ac32cc059f2945493d3c4b33fffd583f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8345b448-685c-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668898206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898206, "uuid": "d672ed59-ab76-41fa-8ed8-3179b4e4b70f", "comment": "Malware payload (Mirai)", "value": "3b3c6c819ed5c675cf337abcc390690a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898206, "uuid": "70f6abed-8cc1-462f-8072-cbd8659d45c0", "comment": "Malware payload (Mirai)", "value": "d7d50366947c933b75cc118fe94c1ccba732178a725434115469b1cce9df4e3e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898206, "uuid": "1ac0d4c3-400f-49c0-8c54-a2356ee992a4", "comment": "Malware payload (Mirai)", "value": "1e3302c47b9c70b8c4734ea5fbc5a6cec99c89ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668898206, "uuid": "86df5b5b-4c84-456d-96ba-d6dbee9773eb", "comment": "Malware payload (Mirai)", "value": "fdb6424e6959090a536f4950646769da2bf984a4696ca3ce2a371a7d5b5e69d55238f932744ca4b6ef305510b62278d6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898206, "uuid": "04ea2597-d153-4f01-8e9a-b7906abe25e1", "value": "T13F03F121988B46D4E7BD8074A5E95B090CCD9819F872DCB543E8472AF8E0778FE34B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898206, "uuid": "c48976e1-50d0-46a1-bfb3-81c14a10a103", "value": "768:jUDwykzUN/VJZl4KmbG9dP5l9UEPn/OG9uSDRdA6mJMZnbcuyD7UHQRjO:oDRkzA/VJZrykVUQ/ZkbJMZnouy8HyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668898206, "uuid": "29724812-3d84-4f22-9152-5019328bad43", "value": 40352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668898206, "uuid": "7bd4e6a0-ee98-43a3-aa2b-87baa1ce2b0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668898206, "uuid": "4a4513b2-f96b-4eee-90b7-71da86254e59", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2628010c-67c5-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668833196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833196, "uuid": "773c22ad-0a5f-4c65-983d-98e14463e577", "comment": "Malware payload (GCleaner)", "value": "b5e6f246863b1f0e9e88ccd8cae3506a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833196, "uuid": "956a7749-c60b-433f-9ac6-3f582693914d", "comment": "Malware payload (GCleaner)", "value": "d81f81e8a036e6b091b96bbc86c064ace1b6d6219cff38375fa1ecb4e0e2b547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833196, "uuid": "68f021fa-94e2-4bd6-811f-169c05efb7eb", "comment": "Malware payload (GCleaner)", "value": "aa5ca14dc939447ad86d74b7e139424284ea7dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833196, "uuid": "8e9d5fbb-d4df-4210-9006-54881cccc6ad", "comment": "Malware payload (GCleaner)", "value": "b5563fb04642b87d91601e9cd871a3d27da3505b0e0bd435f11e50db740f853f9b1dc0cdcbd52d7d4a745f1cb390a658", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833196, "uuid": "b89daffb-a2f9-400d-b1ea-617b72089064", "value": "T1D2B5E0416A56C291C82F2DF0E56474F80EBA3DA2E92E827BF7963C1DFE7D3679019401", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833196, "uuid": "396645ac-b70e-4e75-be09-27cadbd6ac3a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833196, "uuid": "7b4c1265-d76d-43b7-8d80-57ea71e02427", "value": "49152:q2mGviIpCA/rfHfSbEeY6yG4+XKMP89++u5wO88beUxVkBaFwnm:rmTA7HB1GNBP89swueUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668833196, "uuid": "c71b0077-a6b8-4c1a-9bbe-459506b8743f", "value": 2334254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668833196, "uuid": "49e387f3-d03f-4d59-97f1-916127afc0ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833196, "uuid": "5f43f7c4-fab8-402b-8c54-7304b5cd7239", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69dd464c-6837-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1668882272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882272, "uuid": "395b961e-5fec-4ff6-ba05-57b585199606", "comment": "Malware payload (RemcosRAT)", "value": "adb940fdb9891fd32699e4d8cdad2725", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882272, "uuid": "ede33740-e834-4034-bd83-1e998e77c706", "comment": "Malware payload (RemcosRAT)", "value": "d9737abe95686b73b24bab3b431da3d9a774393f8a228265eb7d4bd6b0f992dd", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882272, "uuid": "070f937a-233c-4c6c-b176-cb7581f169bc", "comment": "Malware payload (RemcosRAT)", "value": "366cedfe4e9280a0b699d13c87df5c70eec4773e", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882272, "uuid": "74195155-524e-494b-8cca-0945acf51d49", "comment": "Malware payload (RemcosRAT)", "value": "ebd25366a759e923cf78bd739e55192b4cfcbcb9753fa7e4c0f0e3f6574934ade2b65c64c8a4c4163d9f2324482af7d2", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882272, "uuid": "5b4e43c2-ecd1-4c09-b14b-d472d2086e7f", "value": "T1D135DF2B7AEE0BD2C19D09309E65F79C17F08E1A6014EF912CD5E2E186B5A451BF307E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882272, "uuid": "967e6469-4677-43c5-bf5c-59104b48793f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882272, "uuid": "2bee6764-9bb0-4aad-8924-3a60d43075a9", "value": "24576:8vNsqXeEHsOzj4j85M1hUQDAxzJX4vz5:OBXtsOzj4jGM1aK4FX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668882272, "uuid": "9db8446d-c2b1-4801-8a1f-1a92bbd1f33b", "value": 1153536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668882272, "uuid": "c1469107-68b9-4ac3-98ef-c7f63b17a487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882272, "uuid": "cd94f53a-5d28-416f-bff4-601fc948ba06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d419bd-6828-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668875660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875660, "uuid": "503ea1f1-090f-4f7d-aff0-4320f061bcfa", "comment": "Malware payload (RedLineStealer)", "value": "9f8ec4270f0e915ce6623d9b7f5439b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875660, "uuid": "663bfbc9-e19d-4082-ab02-9923cb278281", "comment": "Malware payload (RedLineStealer)", "value": "d99b7f70d1451c0ac595420b2fe983ecda625c47575ee4a24e786dc440626a55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875660, "uuid": "c50984a4-9361-4644-97a3-f669ea510196", "comment": "Malware payload (RedLineStealer)", "value": "2054076b11f90eed567f4227179b5d906a55dc9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875660, "uuid": "138359de-2b43-4e4e-9dc1-67dcab36739c", "comment": "Malware payload (RedLineStealer)", "value": "c023a1f380988e9d3b68fbf0c45ef98ad52ba994877016c67ba7c6f93ac3bbf57ac66786b64691f81804537cb8c187b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875660, "uuid": "7a5d454e-7c2c-4efd-882f-0a44e0ef5169", "value": "T173349C1374807536E5ECC7F9C89D9E16457FA7E1278422CB152C072946F27FEEAA830A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875660, "uuid": "afa8b384-4e9e-4081-91e7-de3f8faa8e5e", "value": "19f81fe756f31ae8a7d11110e6e81c7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875660, "uuid": "66899fc6-bb06-4f2c-b441-2bb32e3043c1", "value": "6144:u208XSOBUewg89TjLctzA1jqb7ZdGv2GkLZmHxYKcTrL:H08COKe2TjLctzA1jqb7ZdGvlVmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668875660, "uuid": "c10992ba-93d9-42e1-8c01-a83d221d4c07", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668875660, "uuid": "4d848f18-8a8d-4afd-8fb6-02481e5f0984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875660, "uuid": "8b1aae2f-0978-460f-abe0-16d7549afc9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebaeb82-6801-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668859222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859222, "uuid": "a1a0d3d3-5be0-43e1-9b4c-12ba5f1d825f", "comment": "Malware payload (Mirai)", "value": "96154a95772fd46c89326940ea6e195e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859222, "uuid": "51c5ff47-ec80-4f5c-9b04-01b61e50ac32", "comment": "Malware payload (Mirai)", "value": "d9c71ac3b92dce0772947fda8834b0eadf956314e656ad6ad5f380536c6562dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859222, "uuid": "8a6152f9-7a17-454f-9b7c-1f44826a93ec", "comment": "Malware payload (Mirai)", "value": "a411c6307c98ff1a32673c44c851445901e29423", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859222, "uuid": "98f9de2d-d01a-4d8e-a701-dbeac1197b70", "comment": "Malware payload (Mirai)", "value": "3f993311c8fa991aa8ba7dfeb236ea5796e1777c7ecab70d17fee156bfe0eba06de64f89eeebeff37294581e0c8e99d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859222, "uuid": "e4197819-f278-4981-9211-83eaab4e4426", "value": "T116D2F131864650A0D0B42EB87D7CCA41312F427C9297B5AA7A04F5F7A4BA40B79B43E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859222, "uuid": "46e5f68f-4a81-4088-89a3-5165afca354b", "value": "768:scVw+IsW6nWk52vFmk9mtc6uu2vkwvefoGPcks3UozmIc:twuhnb2vF79mltQvegGyzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859222, "uuid": "cf0268eb-0dc6-4e94-a49a-f87c9bd10b16", "value": 29568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859222, "uuid": "4b778b8e-94e2-471f-b1e7-e0cf50153f71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859222, "uuid": "472d65aa-4089-4703-aac5-52adb4b5cd7e", "value": "96154a95772fd46c89326940ea6e195e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edca1e0e-67f7-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668855006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855006, "uuid": "5f23f2a3-2141-4694-89b0-9e89084ee275", "comment": "Malware payload (Mirai)", "value": "3cdea50f9d9219c1698d1b9f4b0df2e0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855006, "uuid": "747307a2-ead1-4714-a70f-830e5e29ed55", "comment": "Malware payload (Mirai)", "value": "da981fbe83b0b96f892c429feea6fee217c4f1cf56898e4cb56cab995217f6e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855006, "uuid": "5e473c2d-60dc-408d-babc-8d2b156895e3", "comment": "Malware payload (Mirai)", "value": "95c9310c67371cf3eb978ac10accff8ffe6ed958", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855006, "uuid": "643c8d97-09b1-4441-a6bf-796fbd9faf6a", "comment": "Malware payload (Mirai)", "value": "bc045cd8c4c57df55477a4f2ad3e71f07b337cd627dd6b3da5fd15a55c6db8806b3559326a9bec1a0c2e14ea9951dd3e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855006, "uuid": "ee77358f-aee6-4d33-8c87-e629fc50abb5", "value": "T12B33F12CE538F048CED00D3DFE2E57DB7E5E5BF280BBB6725A60046451EA643289F625", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855006, "uuid": "b957e16e-afd9-4d35-8d63-8df4943292e6", "value": "1536:ltJHtI7P92Q2Y7GUOpL+Ws0ndFcEqs6BH:PHIIQH7GUOpL+Ws4FcFDBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668855006, "uuid": "59e929ad-7826-436d-b9be-005aefda93ed", "value": 54412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668855006, "uuid": "aa3737dd-9f9e-497d-bcb7-9f4d127ca3d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855006, "uuid": "18e46c75-015a-4d8e-bece-434bd2b63e83", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e19b25f-6831-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668879729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879729, "uuid": "774c10bf-20f6-4a8f-836b-a0549035642c", "comment": "Malware payload (RedLineStealer)", "value": "1d1dcd53c83c9d8e2f15b4c528cd6c61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879729, "uuid": "c591709f-ed99-4995-8f61-43bba1e31de5", "comment": "Malware payload (RedLineStealer)", "value": "db266ea1e5adb4a44965e8becef1d1ad7b41ba48d45afeff56aa2f229e16f165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879729, "uuid": "dd86d5ee-d50b-4227-b340-917471ca1160", "comment": "Malware payload (RedLineStealer)", "value": "a89071b0bb6ed9cea83ecf690cda3f1384923bd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879729, "uuid": "88ecff10-30a7-44eb-b69d-11dc2ec945f6", "comment": "Malware payload (RedLineStealer)", "value": "412dca71dfdd299e10128d6c228e32ebb931b6c24b7be125f20d178bae7a1064b107dcac5278cdd3b413209be481f123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879729, "uuid": "baefcac8-e5d3-4930-84d6-ebec51498c32", "value": "T1A3A4E011FE80C065C97DC470BA16DBEA1A79ADF03825D9177334AB9E2DF02D18E26336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879729, "uuid": "8275bc64-d39a-4fe5-8b1e-d40903f4252d", "value": "3a28fc6cbd66b78dccc28e56534d2c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879729, "uuid": "1a11faaa-260e-403d-af08-3307a9b9c465", "value": "6144:6suRzo9JOwRVARIrAHrVGLly4aGKWGiz+50bkUJl41XBdlHhVVPE+O1voXc:6skUPOIA2rircZZucA0AUj41DDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879729, "uuid": "9814dbce-6109-4133-9d5c-4848a129ba1e", "value": 481216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879729, "uuid": "6996406f-3417-4510-becd-23b5a5c13c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879729, "uuid": "94c59c42-99b4-49fa-9884-64c22b3ec86a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8f2391-67e5-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668847029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847029, "uuid": "d85d18dc-ce28-4f40-8d3a-97669effc333", "comment": "Malware payload (Mirai)", "value": "f4a6548069f8146a8d87f65748b461e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847029, "uuid": "7080d474-f30b-45df-b499-2b12989af775", "comment": "Malware payload (Mirai)", "value": "db341e05272f8a654e935c63503531222d360c17cf9097018d354086331865a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847029, "uuid": "d24a2f37-eb2c-4e5c-b896-dc88aaf56e63", "comment": "Malware payload (Mirai)", "value": "5855d12ddc00c3b10d97f72fe490beefcb19ab72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847029, "uuid": "41108181-6443-4fbc-b04c-5f9d057a1ce2", "comment": "Malware payload (Mirai)", "value": "cdeae480b7f84021b5ddd59338215b7a229447afec86f9f1493b1186ec22163c26e02ab3ec9ffee9c91d6a93ffb22453", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847029, "uuid": "854abb53-7b29-4ffc-baaa-8b0680d551ca", "value": "T1E4338DA685BDEDA8D1444AB4BE258A349753E00086E33EFBC74486958043EFCF65E7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847029, "uuid": "b7146129-a73a-4677-b7c7-25dcf787e54d", "value": "768:taPmVwtpHLEaTa4ue8xoE1qfZj2HPyWfs3IM76Uy/qoCZoexjCqAK:ta+VwtZEAZj2H7fs3V76D/qo5ajCqAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668847029, "uuid": "99ca24d1-6f35-4fb8-9726-98d3657d38bf", "value": 52004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668847029, "uuid": "72d82d1d-5b3a-4407-a3c1-15a3dda2d998", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847029, "uuid": "8bf7b4ea-3e0d-4f56-8895-99f8d049a1de", "value": "f4a6548069f8146a8d87f65748b461e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598eb0a4-6815-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668867642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867642, "uuid": "bdee0e4e-5e4d-465e-b798-8f1954f66da3", "comment": "Malware payload (Amadey)", "value": "6ea4621004c49156e520046e286b2775", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867642, "uuid": "4f35ff75-473f-4797-97e0-15ac692b7282", "comment": "Malware payload (Amadey)", "value": "db6aa9267f7151707dcc4e06e90377c64890fc03d7f0d6aece0e874dc15af1a3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867642, "uuid": "1c559ed3-8059-4136-8314-4fc0aa467981", "comment": "Malware payload (Amadey)", "value": "58ff431e440a74db83bb22bc05255cda9b4f6d6d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867642, "uuid": "5cd8e6c6-6b0b-4e05-bd67-2cb0180a774f", "comment": "Malware payload (Amadey)", "value": "75482f1928d90bb43ee44e793379febcc222ab5031ea6eaabcba87c4c1792105509eef6b991aae3b54aefd755ae3a9b2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867642, "uuid": "d812ab19-be28-4d5c-a2ea-651ae6d731c6", "value": "T1A484CF3472B0D4F1ED611671C435CAE06AB9E8217924C9437719FB6F2E30B9C966E23A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867642, "uuid": "545b6d85-fae6-486c-9322-16b83159c4b6", "value": "063e5449636b8762744e9ce9f5564a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867642, "uuid": "0d55bd35-2cef-415b-af52-5e6606ffc49b", "value": "6144:HTNEoyuqc8XmzRTUnUr5QtjpPnFwCLLObfwB:JEo/P8XmBUK5MxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668867642, "uuid": "a13f05c0-9c63-4a80-94bf-455084107950", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668867642, "uuid": "7c314483-6098-4e6b-8dc8-930e38539974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867642, "uuid": "e910866a-a3eb-4fca-b268-6a6bce4c9355", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058c64f5-67ed-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668850321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850321, "uuid": "c43c57cb-a79f-4cf7-9a56-76de8e805200", "comment": "Malware payload (Mirai)", "value": "72fd66013b40eacb1a2181a5f4e50117", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850321, "uuid": "de8a62df-5d61-4e95-93f2-56b504fc0b95", "comment": "Malware payload (Mirai)", "value": "dd2e1062e7cc6c542026887b13fc905cdf3da7c013c6d9fd77216e62543e811f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850321, "uuid": "4c00b261-52a9-4b4b-a83a-355b8ba18eb8", "comment": "Malware payload (Mirai)", "value": "515120fd284c55fd2551f94c4e6f10e07919536a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850321, "uuid": "1bd808dd-0cc6-4145-9480-d6d7d9d2bab4", "comment": "Malware payload (Mirai)", "value": "98ca99479ebbb850bde6337fdd67d3e39b67234a365ba02a104be263ec04b1e20506f70265ba01a14403964ca118d341", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850321, "uuid": "fb26199a-1eef-44f6-a42a-a2a7b98f387f", "value": "T15E532825AD792E26C0D4A57E21F7C314F2E6220E26B8C55E3CB21E4EFF04B4065577BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850321, "uuid": "2ed2087a-e1fb-4480-a423-0309bed5d87e", "value": "768:tco/Jmsq9Es2qmjNpgWckk0b6Wsrh/J1OpMdewDj79bO+jyOH9:tcQJmsSEs2qmjNmWc9a6vrhWk/p9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668850321, "uuid": "9c956393-b601-40c4-97f6-72fe21f663e1", "value": 60780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668850321, "uuid": "6adb269d-0296-4089-8fc2-8ab3864985a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850321, "uuid": "7a8d62ff-7fd2-48de-8ec9-baf7d85a372b", "value": "72fd66013b40eacb1a2181a5f4e50117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedb1baa-6831-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668879838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879838, "uuid": "631fb0d6-b62d-4773-a1c2-de7cfcfdc5f0", "comment": "Malware payload", "value": "400a26226efb786460f2ed6c23b38071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879838, "uuid": "fbde37d0-5c13-472b-a981-c756169904d9", "comment": "Malware payload", "value": "dd48b654a29ffa4f76904123aeb256369e77d202f7d21773999c2258078ae947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879838, "uuid": "f9f296ca-9466-478b-ac03-9f5e4c849de1", "comment": "Malware payload", "value": "37043155b49ab15e894bbd280c319a6e09c4d500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879838, "uuid": "674651d8-4674-4e21-936b-a75ba69c76bc", "comment": "Malware payload", "value": "5ed5181705723b1680efbeea283f7544a356075c1de27f6e0f05752d7febcdc30b8d60de405b4c5ed9492750f00f6397", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879838, "uuid": "89beed7d-47e4-4f46-bef4-316009792576", "value": "T124351200FEE18079E0BDC6307655C3E99678ACA16665D72763782B4E3DF23809F62376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879838, "uuid": "ff131d4d-0211-4b2c-9414-8b27c43fcfe1", "value": "3a28fc6cbd66b78dccc28e56534d2c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879838, "uuid": "06409309-79bd-4dab-b02e-dcace71872d0", "value": "24576:ih4KxyHBE6Kbk5CvlZyemuXAhmbHBoR7MQUxqIW:mEhd0lWIBaTU49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879838, "uuid": "ad7b630a-d549-4630-8c23-0c6ffa362cae", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879838, "uuid": "33a77e04-6181-4b25-b506-b5357d843f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879838, "uuid": "f67ac260-11eb-41b6-9458-fafa4404f604", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3bfe3b8-679e-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668816737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816737, "uuid": "7adf2fe8-ee31-4c94-b7b2-4441eb58ea3a", "comment": "Malware payload (RedLineStealer)", "value": "cf3f7d2c71a5e3cc0d82e56b2726b80e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816737, "uuid": "f9cfcede-ec73-40d0-b994-edb68c2aa72e", "comment": "Malware payload (RedLineStealer)", "value": "de5a55573afe040af55517efbd83afc4c686e8c707fbec6ccdf8cdfdf39077dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816737, "uuid": "9e69d5d2-f7ca-416a-be7a-aa91815979ce", "comment": "Malware payload (RedLineStealer)", "value": "2a4ca49a0c7585c761d2a1fd68db5d99850c7042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816737, "uuid": "60c04500-79ba-424f-b7d8-40a6ce85bde6", "comment": "Malware payload (RedLineStealer)", "value": "a616c4bec51538a56934051403ce5146b4237bdd4bcf7f989a2c07b7faf4f9fcbdac9e0610086b9d73f3792db512c940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816737, "uuid": "95eaec4e-d98a-4036-a057-8f3934911d7b", "value": "T157A4E0117685FD32C6C14471496AE7F66D3AACA02F2596C736B8FF9F3D302C266B2205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816737, "uuid": "ef502c3b-697a-4ae1-a102-0c288942858f", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816737, "uuid": "dc657b0d-0145-4027-8c77-febb98a6642b", "value": "6144:X6Tcgz74X6VPuNs9aeQqE5OAcKNoIrX8hF/9zLe5ZDqB4l1FCjuVW0v/Lh+3oQ9T:wcqn2AD6cKaIrMT9zLeKCjy9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668816737, "uuid": "f5a00dea-7e89-43bc-b92d-29cab351d4b3", "value": 492992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668816737, "uuid": "2a469609-43d9-4e0a-a255-9865727ebf07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816737, "uuid": "a4cfda9d-2552-41f3-81e7-bffc1dbd6d85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851575bb-67e4-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668846670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668846670, "uuid": "956229e8-9733-49e6-8d39-b98b1b315cc6", "comment": "Malware payload (Amadey)", "value": "758af8037bff45306da3578c43d0acf5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668846670, "uuid": "0df4256d-cd48-461a-94a3-e98d4c98dfaa", "comment": "Malware payload (Amadey)", "value": "de81f61fe339a778df931844bf1ec6c6074687976e76313c9c1a1c322dc25bb5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668846670, "uuid": "70bedda0-b32e-4ce5-9bca-a5108dff0436", "comment": "Malware payload (Amadey)", "value": "a6343741291754aed839cdd99c231ab6bd8ad309", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668846670, "uuid": "6c0337d7-d338-4ef7-a4b4-f1bb1a428eb1", "comment": "Malware payload (Amadey)", "value": "8cc5b90f4b6cb5339f954dba6b1cb3eb77737aa2ca237e5d6d079800c34d9c3f3942443b32b31eaf191447c0cb116300", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668846670, "uuid": "23b2b2a5-98a5-406a-8da7-3f77d45fa2a4", "value": "T12B84DF3473B0D6F2E1654270E829CBA46AB8E8253514DA037314FB7F2E34B9C566E277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668846670, "uuid": "361f5bc0-3a5a-4638-bff1-a338f1a9bad4", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668846670, "uuid": "49aa6fa2-a024-446b-85f2-0af961e16412", "value": "6144:a86AVezrmHJ9zYeb5aaII0cdIUkQ42uadY4LZ7aJjpPnFwCLLObfwB:aAVwY9z3c2DkQ4wY4LZ7axxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668846670, "uuid": "020d0bdf-8999-4aa8-99f2-48fc3b1cc007", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668846670, "uuid": "8ea12c38-aace-467e-894f-d7b477fa86eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668846670, "uuid": "d79e4bf1-9c92-4a68-b649-f05c31136250", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f47230-6829-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668876231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876231, "uuid": "b4814c61-b097-4d84-93d8-f88ac36ca5e0", "comment": "Malware payload (Mirai)", "value": "90120dc1e3ad7e0c2e98a1a3660dcc8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876231, "uuid": "9806bf77-2064-440f-800f-680939f9a998", "comment": "Malware payload (Mirai)", "value": "debe4e8c610751150654cc3e11ee4bf947a4cc431e596fd8a1c7a725aaab8b48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876231, "uuid": "ee56941c-ba13-43c6-b4e1-f3f3bcb88ded", "comment": "Malware payload (Mirai)", "value": "ead4f560a3aabd43230997e3fd2e815324bfa886", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876231, "uuid": "18d50358-195e-4ad8-9c40-661c2ff6f591", "comment": "Malware payload (Mirai)", "value": "c12dcd9514f8c2d882100086f316986f9ff111a7a66225257882930c325dd1781d85d0b024d4729a0d6a9d53714dba0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876231, "uuid": "300d5d67-13ad-4e91-b0b4-6414c2b7efd6", "value": "T18EC2D0B9C1AD0FC1DEAF7CB01E49E9F297E04FCD12B4E8916441C752BE46412A616BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876231, "uuid": "316bcc9e-d98b-4f9d-b792-68fb8a761a94", "value": "768:Gpw/IXWDL3mP5ADO+O5A5Vu70wUt4uVcqgw09Vd:VIvm8A5Vu70tt4u+qgw09Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668876231, "uuid": "34faabd2-fdc3-414b-aaf8-50bd29d8c880", "value": 27080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668876231, "uuid": "ee73fb1f-3741-4552-b8d4-b2a5bc4c7ce1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876231, "uuid": "2b2535d3-a07c-4487-a881-33a9f9788a44", "value": "90120dc1e3ad7e0c2e98a1a3660dcc8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022da903-67cb-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668835713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835713, "uuid": "8d621177-3a45-4513-965c-417c9d4fab0d", "comment": "Malware payload (Mirai)", "value": "28c70b86edbdc022389eb1ed90c3b2a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835713, "uuid": "a9d9a117-4b40-42ae-bf4d-88208d9f241c", "comment": "Malware payload (Mirai)", "value": "df8145a0d071f8e4153d4e947550a534b08d347515ec01f6278a04ba9c63581a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835713, "uuid": "0105b7a2-7563-40f4-8d32-8f64f8683290", "comment": "Malware payload (Mirai)", "value": "0fc0ec75a1b391c5b252bb8c735fd51a1d0d64b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668835713, "uuid": "345a2547-688b-45f7-bf9e-c63d910ee7b2", "comment": "Malware payload (Mirai)", "value": "ac5d2b42ad7ddc898ed52c9c8695bcbaf7c06d6285be5d04275f58d5d46330843ef7a5255597820cb5c62b95f49d6ed6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835713, "uuid": "3b9526c5-6905-476a-9613-5d05d3d07543", "value": "T1C1336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835713, "uuid": "269ea985-e4f0-46a6-a07d-53c4013a0c3e", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668835713, "uuid": "23bb55a9-5d34-426d-897a-58803f63c731", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668835713, "uuid": "4638c7e2-cea0-4fd4-a13a-0f684a6bba9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668835713, "uuid": "649bc0de-d41e-4e0a-8cf9-a68db9709696", "value": "28c70b86edbdc022389eb1ed90c3b2a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691ce49e-67e5-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668847052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847052, "uuid": "cbabeff3-130f-4281-8344-d5ee68c2e81f", "comment": "Malware payload (Mirai)", "value": "5b925742a874274ae7a49a0bfd21d65d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847052, "uuid": "4fc64b74-7126-42eb-9278-ddb9ec2b2b81", "comment": "Malware payload (Mirai)", "value": "df9709ed74c1f19d1858d0f401dd142efe94e67f38bd8332db9790e2432a7e52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847052, "uuid": "dfcc416f-85de-4f3c-b8a8-ccd516652e86", "comment": "Malware payload (Mirai)", "value": "56cd423114e993b76a70339f8197160a13cc5460", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847052, "uuid": "c760e798-56b2-45cb-80ac-c84353f63c90", "comment": "Malware payload (Mirai)", "value": "9c1d8144faa384b292fffc955870afce9133f9d4defebaa6955fed9364c4a324f0a26445db5fb4acaaba3d1a579a40ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847052, "uuid": "e583d9d0-8a6d-4460-b81a-b59c0e75c541", "value": "T1A0B2D075E14FFF96E7BFAE325C44D28097B08B49667A9B0464C7E74287234269200CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847052, "uuid": "2f78539b-34f6-4934-8245-48211fe2997c", "value": "384:CWDFM8EL3k6mraCyiIfL002l9w0lUz2R2s2LN4AINS8T4w7NMB/a8umM4uVcqgwG:hM8EDklrsJAZl9f5nUN4zvTEar14uVcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668847052, "uuid": "c3ebc65b-dad9-40b0-af94-93ef592a0620", "value": 24072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668847052, "uuid": "2e8eaeae-6dfc-469c-8bcc-ef613ba43010", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847052, "uuid": "e10cc303-983c-479f-afda-0394afea516c", "value": "5b925742a874274ae7a49a0bfd21d65d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e06bb2-6809-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668862594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862594, "uuid": "06aaa0d7-2d5c-4729-9810-a804375eceba", "comment": "Malware payload (Amadey)", "value": "729d548db52c7ed5bd8926eb96ba4e66", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862594, "uuid": "4eabef22-7295-4af3-b18f-29341c2a2107", "comment": "Malware payload (Amadey)", "value": "e1416251b87c037b2e17cb048d531b742b26dd133811018ab0aad06521b5d168", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862594, "uuid": "3467aa85-26f1-4fe6-a7b0-b7abec239dd9", "comment": "Malware payload (Amadey)", "value": "07882d4afee4b55986b6b5bfb0cc4b0ec432fd2d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862594, "uuid": "0709ce92-15bd-4bba-b775-dd326ba43f72", "comment": "Malware payload (Amadey)", "value": "7cee035582b8da0ee7e517b7f1a964add060f5338d498a9ad1dd0048b511f1a5b7afa8e9f8c08325592130ca4b3b4130", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862594, "uuid": "160e89ed-0ec7-47b3-a261-c475e029f9ee", "value": "T16384CF3472B0D4B1E4A10670C825C7A16ABDECA17A14D9433315FBBF6D30A9C5E6E27B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862594, "uuid": "d6853e35-a1aa-4221-9ec0-edb880c1547b", "value": "063e5449636b8762744e9ce9f5564a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862594, "uuid": "5d6b1d0e-e27d-4b7c-ae5d-af8ae532daa6", "value": "6144:EsLQGmjYDjke1SrhnFqHEjpPnFwCLLObfwB:vQGggzUr2ixqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668862594, "uuid": "4d7d795c-7a8d-4a04-9044-826b2be07894", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668862594, "uuid": "936cd983-3a7f-4d80-aba3-11f1bfe3ccd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862594, "uuid": "d8715381-4b87-45e4-8a08-73c0f0daf706", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e760f2-67cc-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668836150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836150, "uuid": "c47756b1-7029-4e13-93ef-c828a7264af9", "comment": "Malware payload (Amadey)", "value": "d3d34af2cc86fa4bd32c458d32666f54", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836150, "uuid": "0c835cd2-0b11-4b90-81e6-196d571c0039", "comment": "Malware payload (Amadey)", "value": "e1506399917601c3cd5b1056a73afb4bf9bb9504e2384ad6b8b40f677d31223d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836150, "uuid": "127c941c-ac34-4e29-805f-7b64435aec73", "comment": "Malware payload (Amadey)", "value": "6d83ba3b3e004382585b2cd0b8c31197cb38dee4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836150, "uuid": "9dfc77eb-39e5-4117-b2d1-5e01702608e8", "comment": "Malware payload (Amadey)", "value": "e21d1546bd359e537db934978e9a4cd83074a3ceedafc23153608ad897a00f9124ca7e8ed26960d4bae70783e27fc305", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836150, "uuid": "6e3d4afb-5b61-4e4f-b96a-0a14b6902b44", "value": "T17E84BE113680FD7AC4D105718C2DBBB66E69AC515F25C9C776B8FE5F2E302C0AAB2345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836150, "uuid": "402e6c8b-897c-482d-95f3-fb9ff48dff90", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836150, "uuid": "08582c54-ae5b-4daf-b1a9-a66e9a68f38e", "value": "6144:RrBw1GzFi95VCJN685LE08WIyynIYwiCGUFTm/h+3oQ9gOU+fzYBb6:Q1uAaOYr8ryynfrCG6j9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668836150, "uuid": "70173b36-bc61-4d02-a916-1f2f50445674", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668836150, "uuid": "16806d3c-d03d-493a-922a-29ce6508e17d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836150, "uuid": "31e1bb33-c89d-4cf9-9f1b-a2d1891f9bc9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc43c8a9-6821-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668873015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873015, "uuid": "4a6b9ea5-da5a-4ca1-9c31-289c1b04f570", "comment": "Malware payload (RedLineStealer)", "value": "9cb3297969b8f56c2050790b93b76e6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873015, "uuid": "e00d20c1-1ff0-412d-a5c6-09f6a61e5e04", "comment": "Malware payload (RedLineStealer)", "value": "e1a5acda061debd043c819156a00f5e7a904a4a2c2a7bd9f888ca6fece353be0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873015, "uuid": "f690520d-26e2-4007-9060-22ad781678e0", "comment": "Malware payload (RedLineStealer)", "value": "ea8e87ce993830a49e4f85ab7e4de73bf943d253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668873015, "uuid": "bb017b91-2784-4278-9165-2c6a01aec301", "comment": "Malware payload (RedLineStealer)", "value": "afa9b3697854d87f50f78d2abe5f97050f6fe29511ce56359cb67344c757a1d6985df67913eb28fb207d3bb02790b137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873015, "uuid": "cc8b0bed-edd5-4bdb-a58b-1cba9f4d4a3d", "value": "T19E25C4412AE74514F2B75A399AB9B5E15A3EBC325F31C9DF1380150F0BB2A919D32B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873015, "uuid": "ca9e4fe6-bb58-4634-9663-e256bd85df9c", "value": "a69f39c56b9d95f96644047e2bebce5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873015, "uuid": "4194b542-9b6b-4d07-aa57-96c6d8e2d13c", "value": "12288:6244z7IMA+1tZHQ8QBceQ5LmLkrsQpXek7bZh/RFLPru6A:91z8jstQBceQ5LTrNprbZh7Pru6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668873015, "uuid": "06593079-3211-458d-ba0e-015ac8372d01", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668873015, "uuid": "df2ace8c-98bf-48b3-9820-09ce3cbec76b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668873015, "uuid": "0750aec7-c5ca-4803-ac8e-c99bdef61949", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f004db7-67e5-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668847089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847089, "uuid": "d108c429-7e28-49f1-93b1-f8f83f18c94d", "comment": "Malware payload (Mirai)", "value": "3c94a7c6af6d01d4bcdb72a67726a12d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847089, "uuid": "27b98537-e1e4-48d3-a80f-bc2bb2ba23c8", "comment": "Malware payload (Mirai)", "value": "e20720d331cee75176d0df926da0039db331a7ce2f5152c1808be84458b83fb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847089, "uuid": "459a21d0-4cce-4b2c-a195-2c801dc8c8ed", "comment": "Malware payload (Mirai)", "value": "dc609ee86f8d789950f8a4712101a8dab2aca80f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847089, "uuid": "23f295f1-c774-4530-a770-8903637eeba7", "comment": "Malware payload (Mirai)", "value": "7fcb95c082b00aa5118d01b452f0694b389095bbdb16bb2aafb7546b0a76601a9834f12dacb6ab437af84c83d23b4c5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847089, "uuid": "655ec559-900b-4daa-88c3-c8e4417e59f5", "value": "T1FA230232CA33C153835A0437CFFB828235164BFAE227AC770D625A6857874E25EE9C07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847089, "uuid": "5e1a2b32-cf13-40e4-9cf3-6af1c698475f", "value": "768:9bXdinLvIOvgebDVI0rnsjr9k82uKEgG5XppENvaxp99q3UEL7Jw4haO+m4Tgt0G:PiLvTzba0Yjr9k8gA5povzLrUV9uv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668847089, "uuid": "1110117e-db68-44d5-9093-b3047989550a", "value": 48840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668847089, "uuid": "3a0748ba-7298-4f0f-9bca-2ef8cdbbb8a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847089, "uuid": "582594a5-6040-4da8-95be-064361ab49f1", "value": "3c94a7c6af6d01d4bcdb72a67726a12d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a73f070-685a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668897225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668897225, "uuid": "e8a12546-a353-4076-a61d-648dcd96e87f", "comment": "Malware payload", "value": "10e25ab360d996dcce232dd900fc596e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668897225, "uuid": "38907bdb-af7f-4f79-8786-da09b6f861b3", "comment": "Malware payload", "value": "e4b61eae1312d12f69bb9eeb8209ae5d985ec96efee87fd14c857ab82697255d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668897225, "uuid": "68d3f160-34d4-44fe-8172-40ba3541edc9", "comment": "Malware payload", "value": "3f68bb0eae1a1d02add2301c4de5b440f7ed48e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668897225, "uuid": "ad932459-597e-4dae-8a54-f3e593c5e726", "comment": "Malware payload", "value": "06b5f57ba49242c419f5150a2d0d4f676fa394898d91778d558017fb01ccfb99b83041fe59c0c8121d92dffe9bc3e019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668897225, "uuid": "cae8286d-2747-490c-9217-9b49ffb2d273", "value": "T10E8512E9B284AA39F1340D79161749B40A3B8CB7CC231ED16CB831FF057F5469D927AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668897225, "uuid": "75f5d7e3-e6e8-4982-8dd2-882b68c39e78", "value": "2e8a848e9e955c5288d866a12f7e26aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668897225, "uuid": "de4dd53e-1d36-4512-b3a0-b158baa233a1", "value": "49152:X3aNybImK124OALVoaIZuhEAOcXMylbqUXQwG:X3aNybFl7AJ1bhAUXQwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668897225, "uuid": "8b83a141-8e4a-44c4-a1ba-595e3ae95e19", "value": 1818112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668897225, "uuid": "78834e8f-e2e9-4805-9f08-698ae19b91b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668897225, "uuid": "9deb7f9e-4553-42c4-adf6-d1796ea965a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4acd34-67a7-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668820298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668820298, "uuid": "620d2ff9-26aa-472b-9a66-3d7aa89e786a", "comment": "Malware payload (Amadey)", "value": "7c4daa8ea7dbe7b442357fadf650799e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668820298, "uuid": "e59b7fd8-3915-4419-bb1a-b2cd01df32ba", "comment": "Malware payload (Amadey)", "value": "e54e3b0dabcdbccbed231cc29a534a3f1320cd11cc06d2fcf81af8f0bbf41ffb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668820298, "uuid": "20518dbe-4655-439f-8322-01e761804b6e", "comment": "Malware payload (Amadey)", "value": "f3a0a2082ffd04a6eaf2c86d278b9dcbce5981d8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668820298, "uuid": "22eba640-86fc-48d5-a3cc-859356b4d72d", "comment": "Malware payload (Amadey)", "value": "5349ba18d197a353bf320372dcb9991ad94d86fbe41535a8b0e1a05b27206dbae67e98f11df67b974006a9ab88a2b88f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668820298, "uuid": "289731a0-69d6-4c2e-8640-8e2633aebad8", "value": "T17184BE1176A4FE73C5C10631582DABF5BD69AC112F3689C733B4EF5E2E302D0A5B225A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668820298, "uuid": "bf3f4e5f-edf2-4e48-99e7-3df8d280ce7a", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668820298, "uuid": "f1c3f1fc-bf4e-4327-ac07-cc8f96d86d8d", "value": "6144:2Gmcg+zrUlacNj8Z0R1D/bnp5zXjG1kJ7mh+3oQ9gOU+fzYBb6:lgQyL2Zs1D/bn1T9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668820298, "uuid": "2f5b4065-007b-4202-ba08-8030b990b1c3", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668820298, "uuid": "93001302-438f-42f6-a39a-7ae30b36666b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668820298, "uuid": "4c4c764c-df9a-48b1-a887-beebd691696a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcc3dca-67a1-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1668817750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817750, "uuid": "5a2656b8-cf87-43fb-87bf-ae2a27320a14", "comment": "Malware payload (AgentTesla)", "value": "acf31edccee4a8deb3af409ef0c51e96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817750, "uuid": "128b8528-fd57-44e9-b810-93f1baa4e218", "comment": "Malware payload (AgentTesla)", "value": "e629a5f355d361bca1edc2752724039d18741df432e39b8b4f50aa0e09f8b363", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817750, "uuid": "caa3501c-6412-41e7-b7a7-6a21d0486e7e", "comment": "Malware payload (AgentTesla)", "value": "baa327dbabe6f078c2cc82d7b702d30e9bbb4cc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668817750, "uuid": "d584a9ca-28e3-4b34-922d-3723866490d7", "comment": "Malware payload (AgentTesla)", "value": "8842733ad3c9b1c8acef858600f3f51d175ba7bf0cc770ddfe3956112b02851f01229a730eb456f98697c6d3d26174c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817750, "uuid": "3b55802b-6962-4b22-84d9-410a4b6a6888", "value": "T1FED4236127BA441478270ED6FFE9FED02660DF66CA466D46E5A1F2B44DFB2F03316018", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817750, "uuid": "c6b69e34-e2cd-4f7f-9bc2-6cdc046b0334", "value": "12288:hRm2PFS/fKAH/8GdKftDkeKfxYcNe3HHsUv+UAr4pe1:7+KeEGAtDkVxYLcVT0ps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668817750, "uuid": "997de130-fa3e-4151-8ccf-8687f41518a3", "value": 615356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668817750, "uuid": "ebf3e611-b316-4b44-b413-eaa15f2fb02c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668817750, "uuid": "f8ef4748-82cd-4f7f-a2ea-81e6889a931f", "value": "commercial invoice-AD1-2001028L.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c77a68-6858-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668896269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896269, "uuid": "14274403-3822-4e24-8411-f883eb91281c", "comment": "Malware payload", "value": "dab2d8d3059e83fc4da432ce68dfb9e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896269, "uuid": "78a70c7f-2466-4d2f-aa48-908cac9c4b0f", "comment": "Malware payload", "value": "e650bbb8f871f0cb6675f9973ef34c20995234592d27f95dd6944da317fd2163", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896269, "uuid": "8af1888c-7f63-42f0-88a7-4063fa1ec138", "comment": "Malware payload", "value": "7144b25475054079872c6d053278ddf05c6f346f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896269, "uuid": "62883a93-d09b-4c14-ad14-da82dc687dda", "comment": "Malware payload", "value": "6ea607381174585effad7264e97309b3dbaba431b3e82c06e3bfb3de48e8ba6ad0126d074bec4de37e13de9a173cade7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896269, "uuid": "c31beae6-16bd-46d3-b16b-ace152c1e109", "value": "T1618512E9B284AA39F0340D79161749B50A3B8CB7CC231ED16CB831FF057F5469D927AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896269, "uuid": "a7999097-4729-4612-be8f-1f69364a3f18", "value": "2e8a848e9e955c5288d866a12f7e26aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896269, "uuid": "00d2c23d-7c78-4513-ae05-14e0f4b008cd", "value": "49152:83aNybImK124OALVoaIZuhEAOcXMylbqUXQwGA:83aNybFl7AJ1bhAUXQwGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668896269, "uuid": "af535ab3-e687-4366-b8aa-a96b40eae890", "value": 1824392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668896269, "uuid": "145343ed-d491-40e5-a39c-bf69689f557d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896269, "uuid": "c5db4f89-dbcb-4032-89be-84b8926090ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59204ac2-67a9-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668821256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821256, "uuid": "e12729f4-c3e0-45fd-834b-0cbb5ce92c2f", "comment": "Malware payload (Smoke Loader)", "value": "6c83d014bf1701d5cbad9e129e10c0cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821256, "uuid": "45f66197-8bd0-41b4-ba7f-e52350f983d3", "comment": "Malware payload (Smoke Loader)", "value": "e660a454ad2b259a9f32b2360e2663abc922cd5d7ab6960d378f6c2395577d36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821256, "uuid": "c5d88cf5-cb95-41fc-9314-bafdbc34304e", "comment": "Malware payload (Smoke Loader)", "value": "77155fa57d6f394102f0f551801ca3d6d699defd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821256, "uuid": "d2399bf7-a5b0-4468-8a03-3c0b00591841", "comment": "Malware payload (Smoke Loader)", "value": "686180590691ae34fae17d8f71d56b10a026592c714562dbd008d9dc9f6697e87d40c530d6fa8b23accef53f550fca77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821256, "uuid": "b5f54102-9056-47bf-a251-507636d14f42", "value": "T1B874BE1472E5FEB2C5C10171982DEBF5AE2ABC615F158AC733B4EEAF2E301C065B6245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821256, "uuid": "f47c091b-2d46-4f87-9e57-f20ab2ab46e2", "value": "8142040a53314e160a775160afa04a18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821256, "uuid": "197e9052-7586-48fe-93ae-701a88f3d12d", "value": "6144:UAQ+oznAaMoHWV0mTAh+3oQ9gOU+fzYBb6:y+6lm9gT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668821256, "uuid": "545b16e4-5473-4172-b061-987b2588f4d5", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668821256, "uuid": "204cf141-f3fe-4d06-a750-b78c7734264c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821256, "uuid": "2a77b9c1-5754-410b-81b5-52cd70f43bc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115de7e6-67ef-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668851200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851200, "uuid": "f1625807-54f1-4248-bbd4-882c5303299a", "comment": "Malware payload (GCleaner)", "value": "4013f50615ad8dccfb33aba3db7fd11e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851200, "uuid": "7ca9411b-c9e9-4c49-9d99-85d0b15b14db", "comment": "Malware payload (GCleaner)", "value": "e742385af67f4e5c3bc7e0aa7350d58038427681135e34ba100d1e73d40582a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851200, "uuid": "9cc275b6-5496-4da9-aa72-31588f036c91", "comment": "Malware payload (GCleaner)", "value": "02271ce6d7bb49c781b7770adad8610883fcdc51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668851200, "uuid": "f2658511-622e-4be9-b4ba-dc29613ab233", "comment": "Malware payload (GCleaner)", "value": "9220c7ac1ec3dc88a27f246eca036d43da1a53a851709aa3ff70068f90cc307de2e7b6f37696dea4e7f6b11f2a724c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851200, "uuid": "49719142-4c48-43b4-b832-980480c7a84d", "value": "T149B5F0116A42E290C92F2DF4E56475FA4DB63DA2E82EC22BF7967C1DFE7C3978009441", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851200, "uuid": "8df408f6-3f99-4a56-afc8-e60fa678852a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851200, "uuid": "7e7f304e-43bc-45a0-9794-fdd65203ab6b", "value": "49152:q2uBUC6bx8sSIEnC07f4elNAAlVP9VWxFpihBZtr0UxVkBaFwnm:ruBd6bWsOj4ejlVfWxFpihB4UxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668851200, "uuid": "3dcf7110-ea1d-4956-b049-a30448fc9232", "value": 2365245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668851200, "uuid": "f8eaa736-edd4-496e-b05c-01ba508255b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668851200, "uuid": "1811933d-1ec0-4c71-a265-39f33682136b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37221af-6853-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668894395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894395, "uuid": "f94e7c78-163c-4396-8572-79202f515bc1", "comment": "Malware payload", "value": "0792dcca69ef67975b5a57aeec85ba7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894395, "uuid": "f0d2af63-e142-42de-a226-a08d2d4d9c29", "comment": "Malware payload", "value": "e7a51fd8c2e3ebe32af6863e5a58721495203bd86c329d72ded84b666dffc6e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894395, "uuid": "a3561f59-65db-4e2f-821e-8bae63854a03", "comment": "Malware payload", "value": "aeb3e69f97a9fd94b7ef67f309001a701542b7be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894395, "uuid": "37a521f0-fab7-4820-9ff2-34e63a690ab6", "comment": "Malware payload", "value": "861c41bb494bf32967943a5fc584a392f16d6a856e59142d605a159a84c2e91f7d2e6de2f9b9543207d6ac8a202d8dce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894395, "uuid": "b0503fd4-8147-46ff-971b-b975e6007ea6", "value": "T12CB5E0116A56D291C82F1DF4E56434F88DBA3DA2E82E827BF3923C0EFE7D3979059450", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894395, "uuid": "62b0083f-dd0c-4326-a8d7-66f804d07996", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894395, "uuid": "a1934a13-5a5d-443d-98e3-59a55fce58d4", "value": "49152:q2CrBFSuXgdugcYUyHfwClcYJ7k3v03GfD4UxVkBaFwnm:rC9FSuXgkiU0CYWKGfsUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668894395, "uuid": "68074ab2-e2fd-4025-a9e6-3dbd38df8052", "value": 2366303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668894395, "uuid": "3eda1927-d1f9-4bb7-8424-17a5c61dfbec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894395, "uuid": "3cd43fd5-ce97-4da4-b012-7a5c57ef9867", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e7c09a-67b1-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1668824579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824579, "uuid": "9817763e-bc57-4656-bcf9-18683393d76e", "comment": "Malware payload (Formbook)", "value": "f053457492f033766966011df7763fe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824579, "uuid": "4d443371-f0c6-4e42-ac15-7d75d858f172", "comment": "Malware payload (Formbook)", "value": "e7af05d6e7ec4ea68d42fdcd19bbfabb3c3e7dd2609582d87d5a9f5b387ac792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824579, "uuid": "5831473b-5e08-4d8f-bf60-6e5f5889c5b2", "comment": "Malware payload (Formbook)", "value": "4ddf3aa471f22d926c2a89ae1323a18de64001b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824579, "uuid": "c2336e12-cec6-4838-a3db-94f2fc07aa56", "comment": "Malware payload (Formbook)", "value": "61cdb1dc6e957b200358c85de5c1faf67c3f2ba21ebdba9acc62a65a1b9a8f20d6a0cbec136d5bce126658cfd11b6800", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824579, "uuid": "735bc671-16f7-447e-acea-01e319c9f52d", "value": "T1E75423535AE26473C677527116BAE733CBF727300576D64B8BA0EFE8783A3835982442", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824579, "uuid": "6b4bb656-bd1a-465d-879b-6cd619c42e60", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824579, "uuid": "0cb6782a-1a46-4d25-afec-567aad51f30d", "value": "6144:MEa0NDexk045zYFvNbVUTYQkNxSHSTpOGvWaTZtUDaX7:XTjcvNbyTYQoxGSVOkRTDUDaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668824579, "uuid": "302819e3-5802-4e8a-aaa8-54d5db194718", "value": 289317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668824579, "uuid": "c9eafd56-ce1a-49b6-b2b0-e1936a1f4c4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824579, "uuid": "308c7b63-d2ac-4512-b7e3-ef14974d3325", "value": "Files.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d709cfcb-67c5-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1668833493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833493, "uuid": "7f33c862-ee62-46c9-95e3-e17cad89d33f", "comment": "Malware payload (CoinMiner)", "value": "ccea3f09b7b6502c898b03564718ea54", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833493, "uuid": "a1cdb124-8251-42bb-a8c3-f8289525dceb", "comment": "Malware payload (CoinMiner)", "value": "e871eaface7a5ec475a1fc46de2db3e184459b5b5c5c6229741999a8bf62528b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833493, "uuid": "4ceea2fd-0460-48fe-91e9-1d89adbb81ba", "comment": "Malware payload (CoinMiner)", "value": "7133e0ee2ef3933d5722f0e34fbdaaac668147c5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668833493, "uuid": "563ee429-4036-40ae-a136-630c79b75e06", "comment": "Malware payload (CoinMiner)", "value": "f4ab08a340d776c8afb0f1375d4be8dbb59bfe32e8e10d99cd8f925fceb5d4b4dec0403f7f26c448ff92ddfef17ff3eb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833493, "uuid": "cf973827-511d-40d1-abf5-7e0491b2fafa", "value": "T175658C53F34086E3C4181031A91762931AB0EC476E9FA75F37A8736DAEB3B817B52758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833493, "uuid": "f787a2f1-e5de-4e73-a655-06c5ca61eb2c", "value": "50c93f5e03b8b24f794249b0b2e1a45f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833493, "uuid": "992d7991-a090-4f3d-8505-d355706c5570", "value": "24576:p1dKk4UEmmBmZZVnuUh9L5vzZ2syJtt37J7QgC2K5zDjN4H:5v4UE3BmZZBhx5vz4syJpxCli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668833493, "uuid": "d6f23aac-88a0-4922-97fe-025efb1ac2ad", "value": 1541896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668833493, "uuid": "ac3fde45-7215-42a9-a55a-e218d795d0b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668833493, "uuid": "b9217aba-d7b4-4fc2-9bc9-74139fd180ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fc624b-6857-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668896033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896033, "uuid": "e451d42f-5845-4a6c-83ef-3fee1ca65ed8", "comment": "Malware payload (Mirai)", "value": "076e7c92268d099f8c77fccc12984ec1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896033, "uuid": "e0f2c4bf-bc25-42bb-85e4-ecef91833384", "comment": "Malware payload (Mirai)", "value": "e945c838dfb999a4bb545f1c2219410ccd2e5d5fd866b23bc411c274e096f62b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896033, "uuid": "f347e89b-c2c2-4f03-b72f-e482b7ae7a0a", "comment": "Malware payload (Mirai)", "value": "e7407950518abac5eb2c991124c0027fdf6c70bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668896033, "uuid": "d167f555-1c9f-405d-bade-8efb603e49d8", "comment": "Malware payload (Mirai)", "value": "8097fdb9f18836c84477f98fa225038d5ec98942c061c76cbc7e19b7446825e676e4d4b07d929fb605b8523e671a417c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896033, "uuid": "e5414ef2-b1d1-4b0c-913c-0ad740b95f49", "value": "T136336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896033, "uuid": "2a1e4242-0a06-471e-a4a7-2c00a8de8bad", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668896033, "uuid": "af6c2e88-67d2-4dd4-a1c7-b4a518851808", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668896033, "uuid": "93712c66-d316-443e-93ff-abe8bdb17d8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668896033, "uuid": "80fea5f7-3825-4fca-856d-163011ec277d", "value": "076e7c92268d099f8c77fccc12984ec1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768b0ee7-67ee-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668850940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850940, "uuid": "bdc5f8b4-d2ef-4703-954b-fb237dee4560", "comment": "Malware payload (RedLineStealer)", "value": "4c65e21c95c6950a9ac6732f9f42867f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850940, "uuid": "6305f73e-fd5f-4ec8-a195-225f438233ed", "comment": "Malware payload (RedLineStealer)", "value": "e98edce318f2ee5d241b87ca9305f8ed72cc8eb5a21757d8430c4152d0a47c87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850940, "uuid": "b21c4822-564a-4a89-92d2-927bd4044a78", "comment": "Malware payload (RedLineStealer)", "value": "7b5898647d0c46033513a3585a5db8093ec7d6fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850940, "uuid": "a8eb2878-0c5c-4680-b06e-a01141261189", "comment": "Malware payload (RedLineStealer)", "value": "eb568a56213c69876b930cdc12924750467db7c6ce4e3d0ba6b22533a82649154f544dfc7fbc18397bd004b3fa434a14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850940, "uuid": "9906d2a3-7172-4c49-bf2f-45dfbffe35a3", "value": "T160A4F13076B0C4A2E5B14670C465CBE169B9F8513520DA073724FBBF6D30B9E5ABE239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850940, "uuid": "f8112fb8-7de1-4eee-a3b0-e19e6ffd40f1", "value": "045163335c785d665aeb43938f4d94be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850940, "uuid": "63b6ceaf-0c07-4540-9f90-b990eae79669", "value": "6144:9g8IFZcHOQzFq9dfYp9NlQTUYdwOU/Pwp4vsP7Os7tjpPnFwCLLObfwB:jIG9ZidUNU1dbERvG3xqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668850940, "uuid": "12b4eaea-d07b-42c0-b5f6-2a9e17b744e0", "value": 492992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668850940, "uuid": "5ff491b2-a984-4930-8cff-5f90fd245873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850940, "uuid": "98b76926-005e-453d-afa1-41a5a96b04b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50d65c4-6844-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668888009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888009, "uuid": "6d9262b9-0286-4965-b6ab-b0a6de0dff82", "comment": "Malware payload (Mirai)", "value": "cef4bacf92ba45c7b57e9eb60577b4b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888009, "uuid": "e9956380-2a1d-4da9-ad17-59c2b2b9e5e9", "comment": "Malware payload (Mirai)", "value": "ec318c3044b9fe343b213055b30dc85f30fe0efccae83e2ca0394881c4ec86c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888009, "uuid": "a1d94c39-6090-4e14-8381-a29ae40c594e", "comment": "Malware payload (Mirai)", "value": "86c8405c67f1336d5f5417a71536fc2231088426", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668888009, "uuid": "ad8c3391-3b67-445a-9fc0-b9b0a34d93d2", "comment": "Malware payload (Mirai)", "value": "80a3223d8a42cf0228878d5b643218f591f0a1a93c15b0fc76e8fbbcec34282d6cd94918b1f91f117e8937463bce3a53", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888009, "uuid": "8402172a-4b36-4058-9301-8f66466ad0ee", "value": "T1D7D2E19C034244DBF9A958BE0BE60BD23D594B24A4135C0F6767EE878D265F93087988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888009, "uuid": "ec740b68-6a00-4af1-8b2b-b117f6b013b2", "value": "768:hnid93kikN/Ksw1L7iPTk3o5OsaC6t2JgGlzDpbuR1JA:h+938NCswOu0OsayVJuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668888009, "uuid": "47f3f9bb-e42a-4e40-9587-a43d9cb4f14f", "value": 30884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668888009, "uuid": "9f65700b-dd51-4d35-8eeb-a8c1d0af4990", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668888009, "uuid": "fd1d3ce1-b5c2-4f40-96f2-e12756f22bbc", "value": "xd.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb482b8-680a-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668862842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862842, "uuid": "7d51187d-1ee4-41cc-bb23-7d7a01db92eb", "comment": "Malware payload (GCleaner)", "value": "0529b5976bb296764d469f0e65b536b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862842, "uuid": "6e055d9c-69a4-4a59-9993-3300718dff8e", "comment": "Malware payload (GCleaner)", "value": "ed1840bd6435159e02db7b851f6dca2434403b850bea774fc7a36b3194004301", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862842, "uuid": "917cc2b3-7675-4d10-93ca-e30a38525d9c", "comment": "Malware payload (GCleaner)", "value": "0cedfa22d302fde720eb7c290c8fdb74705903e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862842, "uuid": "c5e7ad01-2d36-440d-835c-5400778811d7", "comment": "Malware payload (GCleaner)", "value": "f77fc5526480214a462627fafc275e23e157e04b1987054c12331c11a3d7ce80d40593b5f74d772001a6bf652b293084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862842, "uuid": "aa4e9de7-8fe2-4734-a5e2-c7542974b7bc", "value": "T19EC5F0116A92D295C82F2EF0EA5174F859B63D62E86EC23BF3927C4DFE3C3939419510", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862842, "uuid": "28560151-10dd-4dd8-bc4c-d509f36060b1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862842, "uuid": "3fdd8193-c608-4c14-869f-ef6ba818974f", "value": "49152:q2MCibF1H8b2L09YfJi9ykvM78wtzg5pR/7dThpuWC8CKCvuUxVkBaFwnm:r5OcbEsYfJi5MQwtzopR/7dXCvuUxVkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668862842, "uuid": "bcead124-8beb-47c4-962c-22433283a709", "value": 2530989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668862842, "uuid": "c821b287-dffa-4427-b63c-f692c85c1fba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862842, "uuid": "43fd4e0b-3e78-451a-839e-d5eef88bd65b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc26476a-6831-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1668879887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879887, "uuid": "b362e172-2889-4cac-a478-c33b56fc70bc", "comment": "Malware payload (Smoke Loader)", "value": "f774f0e9c2c72ade10254a36543ff082", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879887, "uuid": "36d07e88-3479-4cfb-a93f-b497032d3788", "comment": "Malware payload (Smoke Loader)", "value": "ed78c59e18d09f5b3e9a8524b597c122078d5f6447e875d5d6831a584ed0e85d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879887, "uuid": "b7db69df-7f4d-4fd7-9b58-d600b8c74ff8", "comment": "Malware payload (Smoke Loader)", "value": "77a631ff6e63ba8efdcdc32c334d8caf31f878e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668879887, "uuid": "c303881e-fad0-4ec0-bab7-237ada38109a", "comment": "Malware payload (Smoke Loader)", "value": "5df7777ed0615903be5dc2467623d25bd8ce470364cc16225bc5d22c60658544c0fb680bdd8e8aa9714e1902889b6962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879887, "uuid": "29d56194-1f34-496e-9820-a0d8312ee372", "value": "T1A964BE10FED8D2A5C4FDC0727A1EFBE59639ACA1B915D55333742A5E2EF02908E62331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879887, "uuid": "d0f0e582-5cf4-435b-84ed-f6d2471c4e75", "value": "3a28fc6cbd66b78dccc28e56534d2c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879887, "uuid": "73e66ed8-367a-48d2-b091-12fdfe769b2a", "value": "3072:e3O6p83pHYYq1v6JrADbT+F8YgdKI05HCvuyxE+PEG7lOmV25lKE1miUO1a1e4d9:f4uJZ0AHG5hVVPE+O1voXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668879887, "uuid": "e50ac094-21df-4bdd-a0b5-1a2f1905f94f", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668879887, "uuid": "c0d659e1-fb16-45dd-8404-26462a314447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668879887, "uuid": "a5d6f415-25cc-43d4-a592-077a8f3a4e41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3048bbf-6808-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668862209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862209, "uuid": "8f0b3544-ecc8-437c-b772-3658b295e3ee", "comment": "Malware payload (Mirai)", "value": "a986bca42fb46b8ca06d7b4a2fdba75d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862209, "uuid": "1bd71265-ea0c-4747-b3ad-41c2539dd448", "comment": "Malware payload (Mirai)", "value": "ee71dba59b7b777f3e88b403e1018c38c4a3c3bed00bf67f6278bbcbf69bfb67", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862209, "uuid": "afc634ef-ed94-4b1e-b07b-2175b40be870", "comment": "Malware payload (Mirai)", "value": "1cfc1cc73fced6b27caebed3d46230ee50c031da", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668862209, "uuid": "f5663d38-434d-4bff-ac94-b2583e133fe2", "comment": "Malware payload (Mirai)", "value": "1eb4c84d597cb702eae6ff3e3b8c1f524c2d733d5907e19078f02c3a1ca32df8a121c5512c05fd4c1175d99db6133d80", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862209, "uuid": "fdb55119-ef9f-4f07-91d6-8cf470dea95a", "value": "T119E2E139B007FE51D1704E38ED15BD4D136D03B402EA3E723A9992B87686817E7F98E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862209, "uuid": "03818310-44f8-40bc-800b-b8a00798df3d", "value": "768:y8+muBl8e1Wua65V28927LQNimHQeQooFs3UozB:yEWl8eLu89WQgKzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668862209, "uuid": "55c05f74-9277-4c2f-9593-176178065aee", "value": 31484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668862209, "uuid": "235e7fc9-28a5-46ee-b9bd-bc1dcd5bf9af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668862209, "uuid": "c1a75551-3f6a-4c15-ab1a-d7a5a4abfd74", "value": "dark.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23635cd-67fd-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668857510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668857510, "uuid": "401eff96-19cb-4376-8b71-078190930032", "comment": "Malware payload (GCleaner)", "value": "6017982bcfd74997499875b7715a7fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668857510, "uuid": "4698ae87-67e8-428f-8de9-ac777ba33ffe", "comment": "Malware payload (GCleaner)", "value": "eef849079d6474d635764710046001118f04a1a4b97254c5ad541e460407b1bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668857510, "uuid": "568ccb33-c618-440e-b42d-bb2dd3159fe4", "comment": "Malware payload (GCleaner)", "value": "50d0ac00cc31d41e522caf8ee8253fdc27406751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668857510, "uuid": "0d817208-2972-430d-afea-917b404b5d29", "comment": "Malware payload (GCleaner)", "value": "1fb81ead167867cdcf0634c616be4fd86fe9bf97ba47e6a1d0ec55bd071c72d2c51c27e3033067486305fc1cffce2598", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668857510, "uuid": "d2e786bc-3987-45e4-bc4b-859de4e3ea97", "value": "T170C5F0516A46D295C92F1EF0E65434F84CB63DA2E86E827BF7963C4DFEBC3938019901", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668857510, "uuid": "91744f9a-4b68-46d5-9187-0def7dc5e509", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668857510, "uuid": "1b109d0c-ea40-4bc0-97bd-565a7f188088", "value": "49152:q24XZHMcuzRgfWX4a7Fje+7BHfmeo3m+/40B0sMSUxVkBaFwnm:r4XZLoz4qIuBOLVZ0vSUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668857510, "uuid": "942834f2-8fed-4cb1-980e-645cb4de7374", "value": 2519422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668857510, "uuid": "ecd572a4-4c6c-401a-a512-b92666edb058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668857510, "uuid": "516ccea0-afe4-4d8f-8d70-c4d8bd95d7d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2f9737-6843-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668887405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887405, "uuid": "06db46c6-9a12-4fff-b76f-46d8fb50a05b", "comment": "Malware payload (Mirai)", "value": "3357e7c21a02556d6a685caeb0c3f841", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887405, "uuid": "85f7e1b6-350f-412f-ae3e-21196f8907b1", "comment": "Malware payload (Mirai)", "value": "ef2721bb67ff3dd79d4da3a2164a36d6a0b2beac5d326932b8bcbf020c0f51ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887405, "uuid": "36704713-94e6-42b4-b470-0f318f7c625b", "comment": "Malware payload (Mirai)", "value": "35e3d729a5a468edc6f425ebe4921bc7db72ade3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668887405, "uuid": "31c0cdfd-185d-4f6a-89d8-048970f87e5e", "comment": "Malware payload (Mirai)", "value": "b7efe9b4020cd1e63bdf14e331da863a8d91796f42cd95979719965868f287a4f3a2f4efa55645295920caabea07ec61", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668887405, "uuid": "f92e637d-1ab1-4a59-8f14-e4f5eac30d9d", "value": "T13392D152FD59BD7EDD5124374F28D8E3A5A1E880D32702045E9AC21B6A9A23E3423BD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668887405, "uuid": "b5803c9f-ea3b-4c00-b959-fef573a78e9a", "value": "384:MuaRban0EDaeVl5W+u0RBaabAso5Nm6xQrY7ptHOkf1fXOW+1I/U9Nm1lK8MkebB:HFn0EDagl5LuoaaW+rwDHT26ys1UkemG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668887405, "uuid": "ad390ed9-06f9-4113-8934-4b0e83f46d3a", "value": 21044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668887405, "uuid": "216cb57c-fa42-40be-b538-89cb2b705cf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668887405, "uuid": "fe95d2ed-2bf6-48ff-b1a8-990b568d229b", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5b3aec-6815-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1668867616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867616, "uuid": "1f77ae02-95fc-4081-9faa-601ff3f38992", "comment": "Malware payload (njrat)", "value": "944f3399199953ba338167dc81761729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867616, "uuid": "a747c0a1-613f-40d7-b796-bb7233713d66", "comment": "Malware payload (njrat)", "value": "efb388384001fa0a90170f7da4d0c8a782f649fbc865098811eb79c261971853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867616, "uuid": "96370189-5b50-4fe7-9565-67f76dcc02ae", "comment": "Malware payload (njrat)", "value": "a56a46cfe2f3f7abc44acc844f9a01f3d0792027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867616, "uuid": "0b5b26d6-d368-406e-ad48-235564b65430", "comment": "Malware payload (njrat)", "value": "3951c598abd45c376c6ed9a87c2514b27fd0e85a5b080390a099f0e33c7048a51f30187b526840d115a8cfb8ed66e6e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867616, "uuid": "6a7e6e8e-b734-4db1-8676-1697d8a9f7f0", "value": "T126C2E66D37B5C271D2EE167E5562EE1142B1E08BE232EB0E0CD998ED4B1B3860B44FD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867616, "uuid": "d6c6738b-e464-4631-bd57-4708cb01afe7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867616, "uuid": "03ec67c2-83a8-405e-abc6-2aee3f82a3fd", "value": "384:HLh2J1dJFKnO4YLJ5zeZsL4E7O4/ChZGPjdx4kM0AQk93vmhm7UMKmIEecKdbXTo:rOJFPleeHU0A/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668867616, "uuid": "d84f19cb-d52a-45ef-ad3b-7177139262ef", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668867616, "uuid": "3877f987-a955-4bc2-9fa5-1a2d852b62fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867616, "uuid": "db551914-3404-4f6b-9cdf-11468635daa5", "value": "EFB388384001FA0A90170F7DA4D0C8A782F649FBC8650.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef976039-67f7-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668855009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855009, "uuid": "ec43eae7-598b-4fff-953f-99f9afdb0afb", "comment": "Malware payload (Mirai)", "value": "caaafaf53ef801c703817263cb135b2f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855009, "uuid": "58e41be5-dfd8-441f-b84f-ddd31c9eef7e", "comment": "Malware payload (Mirai)", "value": "f14da328325181534bd214dbd987b71a7faf830f9a742643b83a60733e89d0f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855009, "uuid": "e3b7e0fa-961e-4188-92ae-ccdcb387f67b", "comment": "Malware payload (Mirai)", "value": "c612d6b340fe4cec6787109617aa65e57252b26b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668855009, "uuid": "6340d502-77bd-4f70-96c3-ab1b9bbbe0e9", "comment": "Malware payload (Mirai)", "value": "a2aaf37fdeda9748462a662b7656b9a18f4437eabc698cd0e55b769ba6765b555c4e958fbcd0f88f4cd68cd272446cfb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855009, "uuid": "4b0bc309-e493-4180-8b53-a211c2ef0a30", "value": "T178D2E1362B941680C7002435FDA9A186138F5FBC90FE79774A655A38F4DA0DD18F37A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855009, "uuid": "49840fc4-bbce-49d9-bdb6-46c876811cbc", "value": "768:D1GUXCRLmWRohvjyMLDbqRWsqGBqCSs3Uozg:DchJqjyMbqxXZPzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668855009, "uuid": "f3accdbe-0617-4161-bcf5-16527ea75364", "value": 30692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668855009, "uuid": "9c1b9004-aaaa-4d2f-8990-84b7fac5166b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668855009, "uuid": "473a1bbb-b880-405c-b076-40b80c621d91", "value": "xd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f7d61a-6800-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668858610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858610, "uuid": "bb2eac0b-9442-48a5-832b-3d498d7a6cd9", "comment": "Malware payload (Mirai)", "value": "aa81e645e3ce2312b7e2b98beecebec5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858610, "uuid": "db5be5b3-5fd3-4726-aa93-6f06bcc871e8", "comment": "Malware payload (Mirai)", "value": "f33d811d60a4104928b9e8a895cfdf52fcf683bc98c694c699b7fcf0e7c7dd4d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858610, "uuid": "6300ba62-2b25-4c62-a669-d584b3121bdf", "comment": "Malware payload (Mirai)", "value": "f830ed736b41d4e177cd3a146f9627bba9623a3d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668858610, "uuid": "115c75c5-7d94-4b0a-99db-dd4271d817cb", "comment": "Malware payload (Mirai)", "value": "297bcf8f9073781949df1f0df175df8c07de05fc0fae2aceb0ef5c79293a84230dfe678839baff1429f1b89d1a7af713", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858610, "uuid": "9fba16cf-0988-477e-b5e7-2f4ce893d71e", "value": "T105A2D01572632D56F3ED1C3DC96AC357B9A70BFC90F5327579016A20C94D24A2E38A8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858610, "uuid": "e8a90028-fbb2-4000-852b-d37db57324c9", "value": "384:YvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjb7whymdGUop5h4k:YvQn4j+ZO5fKAlxDws3UozL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668858610, "uuid": "6456bea9-a136-4e19-bdcd-d1f72f6a97ef", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668858610, "uuid": "5ea9d059-ffae-4eeb-9a64-51c5c2494994", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668858610, "uuid": "b2ba64c3-75a5-445e-80c8-2ab61d83537c", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3fe866-6814-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668867484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867484, "uuid": "9382d2ee-430c-4990-bd43-af9af187c399", "comment": "Malware payload (RedLineStealer)", "value": "a82daf7d0a029863894a42455d0d289f", "object_relation": "md5", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "pw Project2022", "colour": "#4B8B81", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867484, "uuid": "3aaccbf7-7640-4bdf-ac98-1f518b0572b1", "comment": "Malware payload (RedLineStealer)", "value": "f394c11eabe7d48ff42411a00c981ed6e1d136fc685759e34dd52d340c022087", "object_relation": "sha256", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "pw Project2022", "colour": "#4B8B81", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867484, "uuid": "270540b1-0e5b-4330-a604-4faa6d513a8d", "comment": "Malware payload (RedLineStealer)", "value": "5cb066b1d261e7a8b2193222d76d13a13961a8de", "object_relation": "sha1", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "pw Project2022", "colour": "#4B8B81", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668867484, "uuid": "515a1f23-ea4f-44fd-b695-9a6c0b1525e5", "comment": "Malware payload (RedLineStealer)", "value": "866066ea98e40eac35183d7c588fa2215a0f76c94d2e3a24e78887b70a455e73cae9857fad0c8fae740d69010600eba2", "object_relation": "sha3-384", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "pw Project2022", "colour": "#4B8B81", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867484, "uuid": "ff8832c3-84fa-41dc-b701-ad2ecb5bc34f", "value": "T186E3130DECF861C44668FCBDBBC77360E5E91D489237D22D9D85C5DB904B22E7B8A0A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867484, "uuid": "20886f88-3f7d-45a7-86c0-29c1fd94ac15", "value": "3072:YhB1IYWhuLMfry+RfoKBzHqXbsFw1CYt+5p+kyqLX5TrPbcCfL+3L82pDDuC:YhB1ITJrpfoE+wT2LqLJTrzcCyXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668867484, "uuid": "114e7083-013e-4482-8660-1401f39f0bc9", "value": 155997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668867484, "uuid": "baa6229d-e103-4b53-ac3a-d82164c8ab16", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668867484, "uuid": "1692f6fa-9fce-4f9b-abf9-021e5bc95be9", "value": "Projects.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486b27e7-67da-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1668842273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842273, "uuid": "6ca917e9-2870-4a91-a1f1-c0dbbdeaa214", "comment": "Malware payload (AgentTesla)", "value": "4b4f3d0dc0ed69467f74bb73b9584bab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842273, "uuid": "436bc1f8-e51f-492f-ae13-b19ec3cbd63d", "comment": "Malware payload (AgentTesla)", "value": "f4d59861c5958a965d053cc69935c4a1bc80fe2bbc4e6467212d4063e486c049", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842273, "uuid": "1968cfb2-36d5-45c7-be35-73e2acfe76cb", "comment": "Malware payload (AgentTesla)", "value": "e5ae5f1322305ce6c62d4b3204c45cf9ddd60818", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668842273, "uuid": "b1e6d3dd-4a4c-4624-ace8-23e1fd580b4f", "comment": "Malware payload (AgentTesla)", "value": "f55a3fcae7dfffabfecd85f75b0cda104e2a40d61a904f2849544059eb6a931104e2b78894290c89489d74ca993a22af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842273, "uuid": "621b131a-9d10-4ec0-8c07-b685533c1f8c", "value": "T128257BE57897696EE2B8B27D15F0A540DBB38C720EC1AE2841A83DC55C336C3B5719F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842273, "uuid": "afae3af4-f815-4191-a47e-8faa164c88b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842273, "uuid": "213cd8b6-7bb4-4c73-9d46-d029e88d11bf", "value": "24576:ZpjZnbCkIQBnG30YCoOj+dAKJllHu8+Md0uD7bBRelk3Z3jt:ZpjZnbCkIQBn+9IqRBnbvDqmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668842273, "uuid": "55d14b88-2e05-438c-a730-dddeb25feacf", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668842273, "uuid": "e9bb7c1e-3104-45cb-82df-5ada95bb3165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668842273, "uuid": "e7b709db-04ed-4c5d-91af-dc2bb7b313e7", "value": "4b4f3d0dc0ed69467f74bb73b9584bab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42658931-67ee-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668850853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850853, "uuid": "29ec96e5-d555-4b43-b3d5-c2f675b86e32", "comment": "Malware payload (Amadey)", "value": "9892c0758867f6822a6e7b487fb9d850", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850853, "uuid": "3a117fd8-ecd7-4757-97a4-dfd1a8fdca3b", "comment": "Malware payload (Amadey)", "value": "f5736b4cc6cd754e01e9678982d61653021a4cbf40032dfcef578595e7372201", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850853, "uuid": "7b284db3-abd0-41b5-891f-95d95dce5593", "comment": "Malware payload (Amadey)", "value": "13f36f39b48e13a180eb082aed9293cdfde4d5d5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668850853, "uuid": "9356e64b-c4f1-44e0-ba41-c6e2efe13788", "comment": "Malware payload (Amadey)", "value": "2b001ce503d423b13d406d9ce995b3f5c33baa9a01bfa95a4b8735bda228e3d9a7dd7497a15cb447a111506349711612", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850853, "uuid": "558f4399-7f47-4925-81a8-61d8416be01b", "value": "T1B284CF3476B0D4F1E1710670C829CBA555B8F8217824DA673316FB7FAE30A8C57AE279", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850853, "uuid": "ead3ebc0-3549-4661-860d-5471eb77d299", "value": "045163335c785d665aeb43938f4d94be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850853, "uuid": "762e1bd0-3447-4591-9742-0de55cccfa5b", "value": "6144:s7OsnzASC8yU+I1lAy9NVDJjpPnFwCLLObfwB:/sK8yU+I1xNVFxqC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668850853, "uuid": "59d9e015-764c-430d-a72e-df9c5e4bf4c4", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668850853, "uuid": "2dc46018-e61a-46e7-ac2b-8248c639e354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668850853, "uuid": "fae7c255-2c1a-437a-a592-d17fb1b3aeeb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7bede5-6837-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668882198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882198, "uuid": "d4e819ec-108e-472b-9e03-f4e586b5efed", "comment": "Malware payload", "value": "5050021d64976aadaff23620700534e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882198, "uuid": "7291c618-a94e-426c-ac8f-4af4d55d7de6", "comment": "Malware payload", "value": "f597c0353ca05ad13b935ea1da505341678d1981a97808e0fbcefe3a64e7c265", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882198, "uuid": "d8f0c0df-c658-4d83-b942-73c3c824ad7e", "comment": "Malware payload", "value": "edf3509ce8a64634b4c27d2b3fa570ec3dbfbddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668882198, "uuid": "214b6df1-406e-4882-9d8c-21bf9c498407", "comment": "Malware payload", "value": "9cb5962b66222d485be058b604dbb01ac5e5d95f4895430b35a17d9c69e635b7efd8a5e9239b594aaf4fd792208b4dbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882198, "uuid": "be5eb105-9212-419b-bd0e-f6fd76d95639", "value": "T10FA33901B2D18472F0B35E3218B59AB15A2DFD318F649EEF2798125E0F641E19E35EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882198, "uuid": "c5f0601b-3aa7-47a4-a5ba-d39106eed498", "value": "61d37f3a8b5a155487f5b8475e46e132", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882198, "uuid": "18342b3d-332f-4cee-a977-80d91bbb880a", "value": "3072:KYXTE1eEZ7z58oZIGDO3Dy+jBUWFwJhT30:KYXo13G4T30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668882198, "uuid": "4510a39c-8d5b-4702-bae8-15e7e002d31a", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668882198, "uuid": "ee1eb516-db90-48c5-86f3-72c9420de847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668882198, "uuid": "02a9936c-a709-4d75-818c-64b7a1b66465", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5fbea9-6829-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668876210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876210, "uuid": "7b56228a-fa3c-40ea-b9cf-611fc7e8a379", "comment": "Malware payload (Mirai)", "value": "8d453524d9167df97903366139a257bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876210, "uuid": "738260df-8c38-4d57-9526-d065103da767", "comment": "Malware payload (Mirai)", "value": "f5a714b1ad070587d20ef081229532196a5cf96e961a51a13a23b93719763447", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876210, "uuid": "3a9a7125-1560-4b14-8763-844154feefdd", "comment": "Malware payload (Mirai)", "value": "8efd3ddc26e15ceb61dda32457f6dab7cc36c6fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668876210, "uuid": "456bfd3f-7f3b-4a6f-9e5a-37ea698bc5cf", "comment": "Malware payload (Mirai)", "value": "4b7da640f906f3ad0ccb597c43c871506f407d52a8ae54842f7009e8b52549aa527bf310e0d228c95ce41ad665e5297a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876210, "uuid": "487632db-2d05-4bb0-bc7b-f8252d758afc", "value": "T1A0C2E1B3C254FCD3CB710932C9798AC667DABB7CC2B63571050CA6609E460A215FE6C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876210, "uuid": "4dbc8420-d3be-492e-bdb4-7a5e2776ebcc", "value": "768:jopjYvvuQzTptAU7xMnpqn3zdTI3dzz1ZsIVs3Uozo:MpEvvuQzTpb7sk3RUN1ZnYzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668876210, "uuid": "c626be7e-6411-4419-9bee-bb8cf3a8c2c6", "value": 28172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668876210, "uuid": "5551f917-97b8-49d9-a58e-acb573afa92b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668876210, "uuid": "d7a899bd-33b7-430d-8770-6038a15659f3", "value": "8d453524d9167df97903366139a257bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a75884-67ba-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668828628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668828628, "uuid": "4453e388-6a8c-4d0a-94d6-75063f9dfa24", "comment": "Malware payload (GCleaner)", "value": "25af13176a69daccb06b6b8be1604626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668828628, "uuid": "2f2f9c46-6c62-4731-8aab-2e861ef5f999", "comment": "Malware payload (GCleaner)", "value": "f5b7db2cb5db317448d55541e56f7874316d71e376080471e433748261817132", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668828628, "uuid": "df9b8567-ff6f-42ef-a7ff-c089665fce0b", "comment": "Malware payload (GCleaner)", "value": "53a2fdb0ea5e948b316691c2a881a421ecbb2374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668828628, "uuid": "46c01c26-2a21-4a70-af28-5f2defc22e9f", "comment": "Malware payload (GCleaner)", "value": "d92c216d2a20582d6480a144c536f89580a698336311316e9073fe411fa4b255f587ef400487ca8852c82ef6a0c11d94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668828628, "uuid": "700f2e7f-beb2-46dc-a137-c7b98b5edd52", "value": "T1F7C5F0416A66D2A6C82F1DF0E51074F849B63DA2D82EC23BF7967C0DFE3C797901A950", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668828628, "uuid": "d89567fc-8a6b-4dfd-b5a4-4c1c9e97a143", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668828628, "uuid": "ba28c4cc-4ac7-4a56-be9a-955ce6601e01", "value": "49152:q2Ppl9N1o7d+7cFo5hOpzJabCCB+cxnL7j5FFkTVTp6VQRBqUxVkBaFwnm:rPn9Ys4YmCBnxnL7aTVTxBqUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668828628, "uuid": "12101eba-040c-44fa-85f1-e0741e90fcd3", "value": 2530197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668828628, "uuid": "733eb042-2d83-4743-9e99-011982e1f9ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668828628, "uuid": "862be77f-4167-4b22-9e39-30d9ea60db49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69665ac5-67cd-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668836745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836745, "uuid": "8d147769-7f89-40ef-b419-173760141885", "comment": "Malware payload (GCleaner)", "value": "e6fb99eaaad1574e3b21a520abd3579b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836745, "uuid": "a90f6ed2-9b06-4d77-a411-b821ade2bad0", "comment": "Malware payload (GCleaner)", "value": "f5c1eb431759a38d4611b64a40d66369af7e2e45d6b88c1c08318edbc3f07c4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836745, "uuid": "fcc314bd-6f8b-417e-8ec5-8991cdd15ab2", "comment": "Malware payload (GCleaner)", "value": "d613de30c6974fe81e7aafb28c01477ec5eeb395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668836745, "uuid": "71a7f0d7-7743-47ab-bffa-ee1b90a16ec3", "comment": "Malware payload (GCleaner)", "value": "7849a9549b6f9fdab2c981e77cd94584d3e45388c235859678ebf9a2dbba052fd92cb5e0656a2d95bf3b7e8ebb7e8d31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836745, "uuid": "b16d21b5-4b64-4eb9-84d4-7635344d66cc", "value": "T1C4B5F001AA46D296C82F5EF0E65475F949BA3DA2E86EC27BF3967C0DFE7C3439019410", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836745, "uuid": "61f8722d-b965-4141-823d-fc892377ebd0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836745, "uuid": "1c9ee81b-0ac3-4973-9261-c1dde0ea4561", "value": "49152:q2kGH8+odrhruPmRL++zTo3J6ODkb7KT4NUxVkBaFwnm:rkt+q1CPUA4NUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668836745, "uuid": "475afcde-bade-41b0-919e-00312f3d88b6", "value": 2368331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668836745, "uuid": "b442f716-b8c9-4ca3-a998-e05b82451e5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668836745, "uuid": "ec74c6ad-ce57-4817-9d0a-7e26e14b31e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787ffdad-67e5-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668847078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847078, "uuid": "348596d3-7dcb-4348-833b-a000482e4420", "comment": "Malware payload (Mirai)", "value": "315e4fa967d1a788a0fe278c31edc308", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847078, "uuid": "ef8f5282-657f-4200-9634-f8a4457db470", "comment": "Malware payload (Mirai)", "value": "f6078b607814935eeb14de1fd74309ded02874d5d761f3f1f024a94a0ff5b780", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847078, "uuid": "8688c1d8-d359-4110-92da-ca8e30debb37", "comment": "Malware payload (Mirai)", "value": "43d09afb896bf42db34bba2eca76ef356ba40163", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668847078, "uuid": "a985afb7-3c42-4351-8c81-6248b97daa5e", "comment": "Malware payload (Mirai)", "value": "4917cfb188af811a43edb42b4239658acf4df188588de3684609d7df89274dc3246e2e0aace11602a9b379b08a998442", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847078, "uuid": "651bdeea-fb32-430d-82cc-53fb977b33b4", "value": "T1C523F132DF32D5474246083BEEEA451636549B78E176687388531E20874B8F35DF880F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847078, "uuid": "a6ab329c-5d05-4e57-abcc-9af389e60be1", "value": "768:9bXdinLvIOvgebDVI0rnsjr9k82uKEgG5XppENvaxp99q3UELUCc7q6VMWK5bC13:PiLvTzba0Yjr9k8gA5povzLb+NSfUYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668847078, "uuid": "3e27ede7-0ddc-4d3f-8e73-dd323f415606", "value": 48868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668847078, "uuid": "37a11ee7-a6a5-442e-a17b-034e37e6c049", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668847078, "uuid": "9d8d2a51-01ec-47ab-a22d-f0c64048117f", "value": "315e4fa967d1a788a0fe278c31edc308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2136ff3-6840-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668886286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668886286, "uuid": "448e9b9f-833d-4ea6-a21a-4aa0b2c6f457", "comment": "Malware payload (GCleaner)", "value": "7b6366f246c00919bc7323192b8f2d91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668886286, "uuid": "a7b429c8-a86e-466a-9f0c-773b9ccc596f", "comment": "Malware payload (GCleaner)", "value": "f68eb9543c5ae45b5714db5173c2e466111ef8bfd6061fc5536a37d2f8503ab2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668886286, "uuid": "1d193d89-6180-43aa-b9ae-1f69c518f8cc", "comment": "Malware payload (GCleaner)", "value": "7860fe715352cbe59bd1aa77048dcfb035308a60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668886286, "uuid": "fced7b32-52d1-4f20-ac31-8af0b092c4da", "comment": "Malware payload (GCleaner)", "value": "e22c5cf50d3e3187a5fed8cad3ba017dfd396b55961a03cabb9f278d48daf03a451122287964f742c8b02b99184a8585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668886286, "uuid": "f8ae74a9-b3e1-47db-b969-ff9863d0d5b2", "value": "T14BB5EF416A56C292C92F1DF0E55074F949BA3D62E86EC23BF3823C4EFE7D793901A851", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668886286, "uuid": "6520c0c8-b280-4662-b418-b2ebbf0dd886", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668886286, "uuid": "1c795f16-dfe8-48e6-b366-6f24b7c16f98", "value": "49152:q2IAGN6ubKtwrbEXPdjZMJPaR1QzFO46yKQPcLVbHKJoF/CUxVkBaFwnm:rIA6bKt+b2FjZByf6as1KuQUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668886286, "uuid": "550ad4b5-4e44-4c47-b80e-9a4167687ec4", "value": 2345441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668886286, "uuid": "d156d023-5566-43cb-92a6-14e8bc40fc34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668886286, "uuid": "9ebfb3ec-d770-4ee3-a037-75d49e8cd4a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4373a646-682e-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668878342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668878342, "uuid": "c70ef302-2288-4820-8414-96eb58985c48", "comment": "Malware payload (RedLineStealer)", "value": "56623cb7676de41bd87de7169f28f24c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668878342, "uuid": "526db8d5-ab3e-4b2c-832b-045aa56de217", "comment": "Malware payload (RedLineStealer)", "value": "f6e87692e433ad1d832706b4ffb04db9be5324aad182dbaca8771532dbd8ab43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668878342, "uuid": "7e0e834e-2b44-4622-85a3-16e0da9a6caa", "comment": "Malware payload (RedLineStealer)", "value": "76f26b2eeef635c68003402f937908bd1e2a7253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668878342, "uuid": "4a11528d-fb65-489f-a6d0-43b8c9c6d4e3", "comment": "Malware payload (RedLineStealer)", "value": "b6bad8f600c2be180448ea8de48e94d9e1333cf749eef2bb342090a71484de4a5dc52d04461269fb0508ac7702c554c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668878342, "uuid": "3d7064f6-3bf1-4846-9757-bff959a5c9ed", "value": "T199349C1374807536F9ECC7F5C89D9E56457FA7E0278022CB1529072946F27FEEAA830A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668878342, "uuid": "91256677-2498-43c0-84b2-42cab74076a6", "value": "19f81fe756f31ae8a7d11110e6e81c7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668878342, "uuid": "f8481aca-0f2e-4f9c-9505-456b8a92854f", "value": "6144:0yfNscRBUewg89TjLctzA1jqb7ZdGv2GkLZmHxYKcTrL:5fNHRKe2TjLctzA1jqb7ZdGvlVmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668878342, "uuid": "b08c4bbe-3511-4c44-b3e2-efb0fe9793f3", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668878342, "uuid": "3839b119-17d3-4db7-84c3-c905a28f5a62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668878342, "uuid": "a2de8404-179f-48c2-bd58-89616f7ff1ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d829a7-684d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668891760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668891760, "uuid": "a7fae73c-eb96-424e-878e-3536533acfba", "comment": "Malware payload", "value": "cd58f971f7b02ab0863d86aef0a34a8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668891760, "uuid": "4b2f2d8b-867b-41ee-a76b-277ceaded0df", "comment": "Malware payload", "value": "f6fc7e7928b605191749aea5b40e6124531ba6f477b9d163231e2a1582034b53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668891760, "uuid": "5204c588-e7de-4bbb-960e-1d55d298e646", "comment": "Malware payload", "value": "49acf0d42b32866625db91d6532ac326c166b4c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668891760, "uuid": "4cfedbf5-fb43-4cd0-929c-d4106ed7dd8e", "comment": "Malware payload", "value": "d7cbb18b5fc3e4e76f5ba08d7bfd1a4b772e8021eebb40a5cfdd0ddf48c58fc5cae0857e8bdfe69adf8d800ae4227b5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668891760, "uuid": "285e129c-320e-4f8d-bd02-80e69856f628", "value": "T1C2B5F0516A56C291D82F5DF0E95470F849BA3DA2E86EC27BF7963C0EFE3C3878509901", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668891760, "uuid": "2aa83216-bb56-4ebe-9860-2d3bcea4a62c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668891760, "uuid": "760cbdef-1ff7-4463-a0ba-c9253a5531df", "value": "49152:q2cjtUQXMho0x4HGFD6uNbgxrc0qCylsD2UxVkBaFwnm:rQeGwlaHuaG7CsUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668891760, "uuid": "a445b200-9783-4d2a-b47f-c70f3485256a", "value": 2352732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668891760, "uuid": "85a1a1c5-cba8-4cc4-be4c-39facdfb6db7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668891760, "uuid": "cbcb0f8a-a3dc-472d-a07f-b6c083482b7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1f5f9f-67b8-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1668827894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668827894, "uuid": "a116ed82-afb9-44e4-b5df-686db74dacb3", "comment": "Malware payload (Loki)", "value": "a953c5f203ec0678d1a2807fdcd2cf1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668827894, "uuid": "6fa5a635-98d4-47b9-9612-dd30bd923f10", "comment": "Malware payload (Loki)", "value": "f77a4f26ae75cf875a1e22cbab32ba379832dafc70be712dd462b5f33d129e3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668827894, "uuid": "eefd9207-0c7f-4d6c-804f-1570dd0c2d81", "comment": "Malware payload (Loki)", "value": "9f4ddecf735aaff059c43978427507e8fb5d9e61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668827894, "uuid": "51280672-e76c-4bbc-8341-6a607456c3d9", "comment": "Malware payload (Loki)", "value": "2d5204c27d31a4a6b2ead56f83745fa1b3a1010a9e26970d23e45456f90812f233cc1f3f7540c84116ea9125931d3046", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668827894, "uuid": "ed648557-d9d2-450a-a9e3-98ae3898b6a1", "value": "T116E4082DB97CF412EE3AA6B71EF69E4BCC305141121E811A1D2937DEE8358763D8E44B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668827894, "uuid": "d5267c4c-b4a6-4096-85e0-42e79425c95b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668827894, "uuid": "2ac9eb44-d0f8-4fd0-b5fb-96dc5d33c703", "value": "12288:zVITqcSpFKb1st80aSaum2v9Mit+cFvIlrW2BvzS8qL:zVnc4FWmyLSaudv9Mg+cRIIOvzSHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668827894, "uuid": "839279d2-2394-49fc-9e1f-9e600716ccf0", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668827894, "uuid": "76cbf201-957f-492d-a87b-10ab316f77ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668827894, "uuid": "a61b48fa-2778-4919-84a3-ceca7cd49c1f", "value": "876857348651.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199f2a01-67b0-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668824156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824156, "uuid": "45b4540e-1c83-4f09-b77b-327532695c95", "comment": "Malware payload (GCleaner)", "value": "37682791d7627aab0ae5f6c4cac55a22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824156, "uuid": "cbe3cdbd-23c4-49ed-8451-3c2184c6454c", "comment": "Malware payload (GCleaner)", "value": "f7fe966b2f24daa0534d142fde4c0d9cda077676ffb775bb61e260a1c8d01bff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824156, "uuid": "a7ca89f3-52cf-4122-8666-7ce71c496bf7", "comment": "Malware payload (GCleaner)", "value": "f5b891a4e5cef152f7cdd95efaaf85cbf51988ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668824156, "uuid": "06f58b40-88fd-40f1-97c2-88a0a0a01535", "comment": "Malware payload (GCleaner)", "value": "146e386c37b3eebc13bc9bc74a5170585f133e83c9ec0efed71629046dbea2494814f8ad52d775673b72716cda450e5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824156, "uuid": "be01f608-faa5-4dc1-aadc-cf2f2b118d2f", "value": "T12DA5337F6368C477D159CBF4C957A6808BDEA53405341BB6B18E65CE2F60680BEB0BC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824156, "uuid": "5a1d8a97-1eb2-4a0f-8339-50a12d1f65b4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824156, "uuid": "0b6f78bb-ab5f-430f-b4e3-f943207238a8", "value": "49152:q2ZZ2AVnktlcUzEhQ6RjZQmuU5vkbG5TbrfhyHfRx7Pq2:rZMonk80Eu6RVQmuUSbq7fQPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668824156, "uuid": "e7386e55-527d-4cbc-b010-abb937afddcb", "value": 2237507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668824156, "uuid": "6d145dbc-226f-4c76-be5f-8871a9e05d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668824156, "uuid": "0834b3b7-9831-4c12-a97b-d12c0c8cc2ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e7cade-683a-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668883586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883586, "uuid": "288a60f0-2218-4483-9e0d-68dbba787d80", "comment": "Malware payload (GCleaner)", "value": "1124f0e59615a01e3f6563b464b725d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883586, "uuid": "7aeded02-e41a-43e1-a4e0-3d6d84c21899", "comment": "Malware payload (GCleaner)", "value": "f81d857486983de15138e846bbe0de8bf4cd2dd76ebef9136365336a46cbda84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883586, "uuid": "b44e6734-b63d-433c-a80d-84721cea5e25", "comment": "Malware payload (GCleaner)", "value": "807de73aafef0f1e869306dc1ae46d1ca4e5bd13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668883586, "uuid": "9379bbc6-9afb-4173-afa9-f49913a9f3ff", "comment": "Malware payload (GCleaner)", "value": "767deec245826f15de8d69a0124abf1a62a228507b1a6c9a5d3b929c17766f6165cb82e94361d767ab90bed84bf68910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883586, "uuid": "1a698a1d-a2b5-4e9c-b30a-7b1b20dfa7be", "value": "T1D1C500016A46C2A5C82F2DF4E66470F84DB63DA2E86E823BF7923C4DFE7D387445A511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883586, "uuid": "16ebdb23-0b52-4b73-b01e-4c31756cd50e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883586, "uuid": "7e7fe002-d442-4c3d-bc77-1eae81f21ead", "value": "49152:q2z8yNOtFs8WJ2589YUiytW8W4caHwKgAK8UxVkBaFwnm:rzzUtFs85u0ytrW4HHwTT8UxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668883586, "uuid": "8a6cc457-0375-485a-88ab-07b733048de1", "value": 2512366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668883586, "uuid": "dfa18ed7-2f16-45d1-a657-cbc955d9b3ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668883586, "uuid": "c81ac8f7-6a65-4952-ac39-17dff070aa49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2ad68a-679f-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1668816912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816912, "uuid": "db322d7f-324b-4208-bbc7-cd9c9fea8963", "comment": "Malware payload (DCRat)", "value": "396cbc8c176842c1926be920872a1f1e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816912, "uuid": "db49ef69-54d3-427f-8896-1d66a04d1f5c", "comment": "Malware payload (DCRat)", "value": "f9083a7f2d5f8842801a4d991a9b0c7222764cfe9ebb87c5d9d82e1e36f7f88f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816912, "uuid": "5d6dbdd4-8035-4e01-8809-431b9fd88c79", "comment": "Malware payload (DCRat)", "value": "343b335637991e66304d4ac3d0c6b1246d686d35", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668816912, "uuid": "2c95ed5f-03e8-415c-9856-f0a911f4c3b4", "comment": "Malware payload (DCRat)", "value": "8f11490af7abd5106c59d5232ce69aa380d31ef92c496b3a0d54eb897824c6a0969385c24c42a32472c026ee10ba9790", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816912, "uuid": "ceeb23f2-2ec5-4c81-b0be-8da0c853baf9", "value": "T1E7557C027E44CE11F0581633C2EF65484BB4AD516AA6E32B7DBA33BD55127A73C0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816912, "uuid": "241d971d-043c-4ce0-969f-1939dd05fc79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816912, "uuid": "4a58687b-6370-4fb9-bd20-10746425a2cd", "value": "24576:RkCkmlUlVX0QZeiKZ64hLKTTdLbP0kj+bQy9nd:qCkWU0iSRKTRb9ja9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668816912, "uuid": "42e9e5b2-f2fa-45b7-aedb-227ff03c11ec", "value": 1353728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668816912, "uuid": "687a4292-7cc8-474f-907f-b6f0a71b7fc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668816912, "uuid": "0ce81e14-86a9-4226-b6bc-e9b5b7359771", "value": "F9083A7F2D5F8842801A4D991A9B0C7222764CFE9EBB8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119a611b-67ae-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668823283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823283, "uuid": "6352340f-0afb-479e-a3c4-33173d41a7af", "comment": "Malware payload (GCleaner)", "value": "81db7e2d8d65ea5b32ae2cfe4a9e7886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823283, "uuid": "83853f2b-4a14-4e4d-b71b-954e416f59b4", "comment": "Malware payload (GCleaner)", "value": "f9308708d5cb09ac7558ff7a7dadf9607d0f9122118e6ebedf82c1faf2886b85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823283, "uuid": "938d5445-19d2-413f-80bf-cc74c2f6f245", "comment": "Malware payload (GCleaner)", "value": "7e4ac0444b1d5d1ce3ddadc72c1d7a1bca7f9494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668823283, "uuid": "b8f00963-19b6-44d0-a4f5-5245e1c3215a", "comment": "Malware payload (GCleaner)", "value": "16e7c4007cf2db083b32b5d106ff42beea1a82321311b232be22d1311fde88c7df2968f8acabac5c594d75ce4be3b99e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823283, "uuid": "3fe8d216-1ff3-495f-b3f5-8d2a357d1532", "value": "T111A53333A3B0AD74E140C3F0A509E5348296BD92057518FD66DEAA97DE7D7C098AE333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823283, "uuid": "ca050b02-de38-4df1-81a4-39b8486ebb69", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823283, "uuid": "641de937-a67e-466b-8216-a679336daf3f", "value": "49152:q2+a8MtKKy/rVWuJCYgrAUMHBs8Dr5ZuoU/XX8JOyHfRx7Pq2:r+dZ/rVWuJg8U+D+oU/n8lPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668823283, "uuid": "e36c5fa4-2252-4392-8678-2432773ce0d0", "value": 2062540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668823283, "uuid": "25a4a2c5-f013-4a98-b073-1eea759e5792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668823283, "uuid": "1d71d40f-bc59-40de-b51c-5ceb9ff5a1ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bb8a77-67ea-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1668849246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849246, "uuid": "dfd31c1d-c40b-411e-959e-996897b53af7", "comment": "Malware payload (CoinMiner)", "value": "cf334999e7e7e3d701f512277feae704", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849246, "uuid": "78523958-2ce2-48fa-82bc-03bd0c680584", "comment": "Malware payload (CoinMiner)", "value": "f969b1aabff1c1f24279895b95660fc45a241e7bb1158bf3675c87a213f325aa", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849246, "uuid": "d6d79a54-2b05-4e88-b75a-4257fad9c395", "comment": "Malware payload (CoinMiner)", "value": "1cab350bc0b6988a76b70c1aabf66bc56376749a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668849246, "uuid": "a9e6b456-912c-4fa2-acdc-0dbb37b56711", "comment": "Malware payload (CoinMiner)", "value": "ee86b51f2293ef02ff7cafa40b9c2edac875c0bf94b2aebe328ad4d499380a0e023998c06138be392b44c3d76f812d28", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849246, "uuid": "4154dac3-5faf-40fa-9651-6072c36c5565", "value": "T187657C17F34486E3C4181434A91763A21AB0DC876E9FA34B37A8775DAEB3BC17B52394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849246, "uuid": "c8f079f0-75e3-400f-a1f3-c33c57f238e4", "value": "de3f3aee2769c5753d81bb6346b035c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849246, "uuid": "1ca1ed47-bfff-4460-b4bc-efae55453576", "value": "24576:l6ae50LmNbSIa2Nqxt7dz0E2b2Z+2iipHAAFdZfhLNq:kaq0KFNgL1XZxiiplbZJLNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668849246, "uuid": "864b0276-86b5-4704-965d-23a15a68ecd1", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668849246, "uuid": "d99ef7ae-3b49-4c90-b348-36d81a0474cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668849246, "uuid": "35ef84c0-85ac-4b44-9b7d-07ac371377ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cefa25-67bc-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668829649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829649, "uuid": "940021c5-aa5e-4453-94b7-e62ff9607d9b", "comment": "Malware payload", "value": "b4d79d938c59ac9dde8e6694cb592150", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829649, "uuid": "2a6365bb-0268-47ee-930a-5ae034dd38cb", "comment": "Malware payload", "value": "f9bd45c2a8e79aa58718335f095feff5ba66564f5581514ae439ddf2f233341d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829649, "uuid": "5a85d9d6-5cc0-44ec-ae31-2b9a3106a9e3", "comment": "Malware payload", "value": "87f94a89b7f183ce26a81a6ac5094c726046db30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829649, "uuid": "19c41220-0d38-4df6-8735-1b3b88c6d5b3", "comment": "Malware payload", "value": "3d2e33f83627462383cd159785e5139fde6f552a104e0e055252950f907bd7a9493a617efa21e60d7d4dd2a1d239e199", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829649, "uuid": "cb2099d7-3161-4126-8bde-8528ab149bc3", "value": "T13CD4F72DB9BCF411EE3AAAB71EF69E4BCC305141161E811B0D2937DEE8358763D4E44A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829649, "uuid": "ae7050de-e9e9-40e8-adc2-43aaaa6a4280", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829649, "uuid": "a21951f2-0aed-4e5f-9d56-2f9b08e95719", "value": "6144:atbRgxNUu/WCYGQNzHhsFvkXWBQ0k4SfllfbrkKCZQ0rwVll9oQYGxt3Mn3:aNRgcpCYrNzBUlSzhdbOrsCQYGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668829649, "uuid": "51bbd16b-296c-4e37-9f64-6f061afc5d01", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668829649, "uuid": "2bf10394-f084-44b6-a22f-1b37e38712f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829649, "uuid": "6e2cfd0c-d14f-45a0-b65d-dadab3be575d", "value": "b4d79d938c59ac9dde8e6694cb592150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a93b14-6833-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668880446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880446, "uuid": "8e832044-7a6b-4c8c-ab65-fb03a33ca9b3", "comment": "Malware payload", "value": "cd9e4d93aaac36c3642445a3b2282d41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880446, "uuid": "70869b9d-5161-49e2-9070-f95baff39934", "comment": "Malware payload", "value": "fad746a964d2b5fabb051434eaf695e56a6e6b94445832474261990ec2f8a965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880446, "uuid": "361076a1-db53-429b-9ebf-46b32020d4db", "comment": "Malware payload", "value": "0e14c471f675a465e5c88e6d0a9bb68ed563fc10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668880446, "uuid": "2b72c29c-83ca-4e98-af46-b66f11d5acc8", "comment": "Malware payload", "value": "fbadd5e22f7ab94713838320027ae31565d4e0296a7aa088079838b480868829e4fb678be729f7bb1929bccab3b46862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880446, "uuid": "fbe7da19-a22c-49ba-9e84-e1237a55409c", "value": "T1C3A33901B2D18472F0B35E3218B59AB15A2DFD318F649EEF2798125E0F641E19E35EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880446, "uuid": "d8c7ad27-0a7a-42d2-9ff4-4ba84f6057de", "value": "61d37f3a8b5a155487f5b8475e46e132", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880446, "uuid": "5d78d149-43be-4baa-9e29-382e15acb176", "value": "3072:KYXTE1eEZ7z58oZIGDO3Dy+jBUWzwJhT30:KYXo13E4T30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668880446, "uuid": "8c1a8519-27a4-47b6-b793-21c79578b047", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668880446, "uuid": "ca2020c6-3888-430e-aa42-7468a2982ae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668880446, "uuid": "489b8074-702c-464a-91ce-b8c39da374ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f198524-682d-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1668877959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668877959, "uuid": "c6cd8c1b-7392-4b31-9335-e2334b6d19ed", "comment": "Malware payload (RedLineStealer)", "value": "f1585d14f27811097512064cd384521d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668877959, "uuid": "a92f8383-53dd-4ff1-8732-332118fd9b56", "comment": "Malware payload (RedLineStealer)", "value": "fae696911780d0bf4fc2a2a6ddee82b26fca9bfe92a8908051c8945d97ceb4e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668877959, "uuid": "34b7fc4a-8a45-4fbb-a8a3-fda1914424d0", "comment": "Malware payload (RedLineStealer)", "value": "7ef486ec47bb4c0cdd590e00ae5ea1ef1191c80f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668877959, "uuid": "1075cd1a-b758-46ff-ab45-3f67c282c60b", "comment": "Malware payload (RedLineStealer)", "value": "2f8770cc8a1360e7c4c26b12c6fd69c22f218d5d085c600a28dae41f0709cded9d8632232307b9524093e5c1c8941910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668877959, "uuid": "4dd4adaa-9474-4f04-b0ce-26ca5dd832ac", "value": "T12BA4E000FED0D4A2C9BDC570B625C7E95579EDE23920D50777746BAE2EF02828E72236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668877959, "uuid": "0927bcf1-e52d-44d2-bbdd-57a5503c3a55", "value": "35f46893ae897497be39cea0547d1715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668877959, "uuid": "f36fc734-76f3-43f0-af6b-d82cb2593cec", "value": "6144:Z71x/Rob55dkdvxge3cLbaxi88ffJ3Wea5hVVPE+O1voXc/:p1Rndx3cn1fhkDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668877959, "uuid": "b1f4ede7-3d5c-43b0-874a-3cc497b40b58", "value": 488384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668877959, "uuid": "6a3cdebf-6415-4fa6-abcc-19ae70da9a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668877959, "uuid": "31aee50e-ab92-4871-95c6-b6f6254d046a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ec90fe-67a9-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668821280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821280, "uuid": "9b55f4a2-6ed7-4eb0-941a-237a40292f4d", "comment": "Malware payload", "value": "66c8167cc43c07ff9950ffe83d4c3909", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821280, "uuid": "3cebbd8f-08bc-4569-a77f-723faa4c248e", "comment": "Malware payload", "value": "fb614c0498dba41738e366c8d1650c27dbbddefd7b3a3d31c1154059d5cdbb55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821280, "uuid": "d417fe26-dada-4d88-bbb9-ef150d4ea241", "comment": "Malware payload", "value": "8576269c4ddf7bc0d364054532e3c665094bb944", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668821280, "uuid": "0a23a6f9-cc64-4cd7-b0cc-2919ef7ecffa", "comment": "Malware payload", "value": "6bf5f335ccf4079e45c3b6c147a9b32e466b5f78d1a6404d1d090d15bc6eeda5270f835548d9ac55d3d599e3431e5b7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821280, "uuid": "5aeba307-d37f-4bfe-94c3-c56594ae67a8", "value": "T1457633903DD54AF9E0151474D0287AE522F76B234F12BA2B6308890D7CFF89AD61A73F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821280, "uuid": "53f68a73-9e19-4046-ae2e-574ec2cc543e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821280, "uuid": "10944692-1b19-45b7-9d55-aa18a1ee9870", "value": "196608:91OMEkdKRfYiasR9J9OK6DHZ1AhaMDFeWUa3NTK+Cd6SFN:3OMEkQRfHx36D51juFeW7FCHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668821280, "uuid": "3bb72115-45c9-47b3-bf5d-2fc91e690478", "value": 7593831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668821280, "uuid": "5e8b0c53-86af-4348-9fca-7371cc76c773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668821280, "uuid": "968b01c2-0ed9-405e-b648-39b6b2a612d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071b1a8b-682e-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1668878241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668878241, "uuid": "87f956e9-6690-4b88-a57d-5e771e6774fd", "comment": "Malware payload (Amadey)", "value": "53d5562e4aa5a53aacc3abd985ff3f3a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668878241, "uuid": "ea0bbc8d-7651-4eb6-879b-6c406886922e", "comment": "Malware payload (Amadey)", "value": "fb6f042e3be90d8ecd017109fd6c04054716d7e0d20488999bdbcee57af611b3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668878241, "uuid": "d3cd8026-441c-470b-9b32-6cf87ef64936", "comment": "Malware payload (Amadey)", "value": "f4e3248d2d1e48cb2b8a1f6b0c27f27ce80f6635", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668878241, "uuid": "1e65a555-babf-42c0-89ef-710e53f342ad", "comment": "Malware payload (Amadey)", "value": "52738dd2c1bd9cbc51f00f1b5e1f40c2c0e8f1d8c5d6212c1d07576d2c4f0f1844b98b4e30561eba787cd62f7492f1df", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668878241, "uuid": "735a3797-553f-477d-af4e-b63de0f4ba5f", "value": "T10684CE10FEC0D460C4BDCD71BA29C7E8D639BCA16911E91777786B6F2EB03919E62231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668878241, "uuid": "eae64fba-5263-44d6-a133-8a9cfcf7466e", "value": "35f46893ae897497be39cea0547d1715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668878241, "uuid": "850ddf6e-6c17-45cf-bf71-250b4a5d536f", "value": "6144:cwCZ0WpAq0PdFcJB5ZCmtpPLffHVhVVPE+O1voXc/:TCZ0Wp0UZ1tR7PXDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668878241, "uuid": "5e2df978-ca47-4400-9a27-e81d277c9e05", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668878241, "uuid": "aa1b1c60-bf28-494f-8e2e-2718d56c7c37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668878241, "uuid": "3461053c-d8b6-4f48-b9ff-01455b211f4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2f92e1-67bc-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1668829663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829663, "uuid": "58bb4abf-82b7-4918-b771-4c964a595bb8", "comment": "Malware payload (CoinMiner)", "value": "431d25be9ac37250adcb964619eb61e4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829663, "uuid": "5fbdac71-d5e2-4571-9dae-b4ad11f88429", "comment": "Malware payload (CoinMiner)", "value": "fc8104fc4da76a2b556e1bf4e900dc6828fab4cafeaf32b3001e8ba2ff68a200", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829663, "uuid": "94c2fb61-1079-4615-b74f-9470d28d465e", "comment": "Malware payload (CoinMiner)", "value": "c1a5e5b591dcb1f6b13b4e85ffecfb737d8e8a3a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668829663, "uuid": "a9158f9a-a317-42c3-b412-12ec301ce6b8", "comment": "Malware payload (CoinMiner)", "value": "a85586dae757a9707c4960acc3dbaa82cdc202d44e186673746212cee85804d5ce961e017e60810d37e75d5fa64f9e91", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829663, "uuid": "9977b55a-7247-46e2-a414-20f9b82d28cb", "value": "T11EA52365719318AAE08B443BC14DE9F3BFB0330846295D1E1FB3C7999C35A5E2B5827E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829663, "uuid": "4da93c60-5b92-4950-8717-69b1ba92a271", "value": "c24ea937b2b0d62e829e8a8faeff5a8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829663, "uuid": "893ac8dd-7dd4-46e0-93a2-7ac45014666e", "value": "49152:PM0kktnKTY5KJfUaO3dhPBayuYg8tKlkc9RdhBgD:PqLONTN7gVlk6TgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668829663, "uuid": "12bf4528-e0df-4b22-86bb-dd4d17d17f7d", "value": 2158592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668829663, "uuid": "b989929a-da5f-462f-aee9-dff20fd9640c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668829663, "uuid": "00f1302e-fab7-41c9-a8e0-21a15a3128ec", "value": "431d25be9ac37250adcb964619eb61e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6746547e-6827-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668875396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875396, "uuid": "692d664d-03e5-4fd5-8630-bcd3f486f9a0", "comment": "Malware payload (Mirai)", "value": "30673b06437fdc98edbb6631e61b8987", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875396, "uuid": "13643306-8f67-4eb7-a040-16fab55edb12", "comment": "Malware payload (Mirai)", "value": "fd32a63891e036cc6d0ac2ecd46862dc5c165541ab4eb688f24b3ac498b290d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875396, "uuid": "eb6f996b-d29a-411e-832c-45db29db4d32", "comment": "Malware payload (Mirai)", "value": "87dc6d76327d987b35be1ff4068e458153591391", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668875396, "uuid": "3da2a16c-53b6-4ccf-bdd2-00b11e0fa6c9", "comment": "Malware payload (Mirai)", "value": "6dd6a159694b76ee677757ed79fba75d45f92a7193a4847aea42557dac27cd6d20db10ab63979e976bf74e104e9d38e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875396, "uuid": "aa5f0cea-47ff-4d2b-a23c-7520c1f2f444", "value": "T1ABD2D1987AE3F2F7CC998A76794D803A70C630EE11A1537A3309D8074BB5340DA92E4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875396, "uuid": "5817792b-fafc-42de-be2e-d8b13a308065", "value": "384:M/d/PxEDLd2TwURz06lowYcEaqsD9aC4E0L8Q9dMgyiJrmk4fAtAstSfeCdgKrlf:4lxKd21RhxEnsD1XityiJm8t/+xeITO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668875396, "uuid": "db6f0e16-8af8-4cfb-a10e-7c880d1e943f", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668875396, "uuid": "4b1990d9-b7ec-4e3d-8e17-450627576b19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668875396, "uuid": "94e1cc25-dc33-418a-b85a-3facf82bef52", "value": "30673b06437fdc98edbb6631e61b8987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a66249-6854-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1668894606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894606, "uuid": "8f050592-b675-4967-916f-9d923bc91095", "comment": "Malware payload (Mirai)", "value": "2700e12d7634b3522d5c4ed62508c1ac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894606, "uuid": "831e8272-514f-44c4-8e95-64d4276c74a1", "comment": "Malware payload (Mirai)", "value": "fda6aad825c49f0a27da02b965d4fb3287b0b04f85a7c1635f8290768a937a7a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894606, "uuid": "084a016d-ba7a-41ee-bcdf-9b6172ad8794", "comment": "Malware payload (Mirai)", "value": "e10529df7c76cec093ecc553a2e769ccd1aa5fe2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668894606, "uuid": "911fcb9b-d625-4cb6-84e1-acf1473cdc54", "comment": "Malware payload (Mirai)", "value": "0aec1218ade693023b06940070ca9924be740175104514c2fb1694e39b876851b37ed2013e58dbbb5efd964de593fa30", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894606, "uuid": "6a2fbdce-7788-4437-816c-f31ba01ad878", "value": "T18FA2E0217F1DE98FCC37B23887E5E5C692D17D64C29C8A866781C11BBAB37C46824E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894606, "uuid": "ac609c5f-f78b-433c-8694-b80745c51565", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtAvSyi:798o08kxofBE+ZkXaT47C2Epitai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668894606, "uuid": "e6d40d20-9960-404a-89ea-e9e32bb506d9", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668894606, "uuid": "3f491cb5-3af1-47d1-882f-ed4ed7d03fc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668894606, "uuid": "24da2aaa-7757-489c-bc68-0184202f06ec", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0a0250-67bf-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1668830901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830901, "uuid": "7ce14538-3daa-4920-b272-41c524ec5c77", "comment": "Malware payload", "value": "acac788b9068d48ab298079ec65a6e67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830901, "uuid": "cb6b0ea3-8dce-4a06-97a8-34a31cdf0588", "comment": "Malware payload", "value": "fe9b3724e40d790ced11be6c728318e2094cd8f083f9307279c91168ab85e638", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830901, "uuid": "a686e880-c09f-4559-85f2-857c61baf120", "comment": "Malware payload", "value": "6ea1a17294a4bb671a912d5724e779bd98f594d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668830901, "uuid": "47d3b4a7-8bde-4a0d-9dad-7edb0c11eff2", "comment": "Malware payload", "value": "30bc80631d5f9d4453da2799c4dc09a9e7a0ae2b3f0256b23f9e35c145a01d1dac281d7f86491ae4623b53870945a1ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830901, "uuid": "aca79033-540a-45a0-a219-b7834f676d01", "value": "T1F3158AD22081F1A7D76596F5D155F4F609FC3C38EA1C22EB40633E60307EE6AD86A46B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830901, "uuid": "2e8566fa-aeb9-47b6-ab42-08f16f970e0c", "value": "1818e86e01a8cce8b1f337b9457805bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830901, "uuid": "a57d684f-4ef7-4c14-bfed-0c1d8eb2dc13", "value": "3072:RSYXGw6CPL8ps6U3vUAlBlbusYkt2OET73p8zZbni72qlGqG111JvXy0RhPZKwCt:RSYXecod0CTP32hi72qlS11dXY7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668830901, "uuid": "2d735965-4cdb-49d4-a2d7-12265fc2dfb0", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668830901, "uuid": "2ec55978-ca98-4746-940a-8113f9e1e5ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668830901, "uuid": "26c9f149-ecff-4018-ac27-99404714f2dc", "value": "acac788b9068d48ab298079ec65a6e67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0367c9e-6801-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668859278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859278, "uuid": "5815741e-1b4f-467e-8d02-d2a628690ed7", "comment": "Malware payload (GCleaner)", "value": "fb80734a331e2a1b47feb7127345719a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859278, "uuid": "b0fb2e75-ce03-4deb-b0fe-91b157c2bdd5", "comment": "Malware payload (GCleaner)", "value": "ff1cd0a2358a9efd5c1ce028db88eb27fb28187b3cf2a030070dfe3b5e15beec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859278, "uuid": "a7d51dd5-5fc6-425f-aae2-f7b26246a09d", "comment": "Malware payload (GCleaner)", "value": "079fd3a846c9f0b6323c464b7cfc14029de35e5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668859278, "uuid": "acc4cb43-3984-46e1-ac4e-fc8a9599cfbb", "comment": "Malware payload (GCleaner)", "value": "ddaa82967d91fe1bb2dffb76c57e7c6c4dc3c6f56e28fcdfd14a07ad9dc3e97857cc27f9f647a3ca69f0ed7b88746361", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859278, "uuid": "ddc676d3-25dc-4d5d-8c90-c3d843f1da97", "value": "T1CCB5F0116A56C2A5C82F2EF4E51170F94ABA3D62E86EC27BF7923C1DFE7D747801A440", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859278, "uuid": "abb1f4d7-3d62-4a91-b61f-6fba8251ae1a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859278, "uuid": "6d9a5ccd-9042-44ab-904a-cc218fce69cf", "value": "49152:q2BQxohjbDGbMde2/5ICxFfpO94g8odISPYNHUxVkBaFwnm:rBQivfde2CGfmbPIWYJUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668859278, "uuid": "5d32fdd2-12a5-43c3-88f6-22364d771721", "value": 2493832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668859278, "uuid": "65d4ccb5-780e-48ee-9d04-a2bf6d3ece2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668859278, "uuid": "0c4d3b3e-05f6-41ba-8fff-06f187bc5c47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bee7c51-67e8-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1668848426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1668848426, "uuid": "8e30721a-80a8-452e-b05f-b9a33c09e2cc", "comment": "Malware payload (GCleaner)", "value": "bbc6f8376a42d32fb0e9636f7a804b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1668848426, "uuid": "d5b6ecdb-aee5-4214-a5b2-3b5deeff9ae4", "comment": "Malware payload (GCleaner)", "value": "ff6fe673dbf530f7b899be0ef1c5068ae06efc767acd996c97b1aab98e841f73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1668848426, "uuid": "addefe00-4aaf-4ea2-b0b5-b204f521d414", "comment": "Malware payload (GCleaner)", "value": "6013164c4d0bbc5e49c7c30ff69e5baf393932ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1668848426, "uuid": "7fb92141-0969-45d9-bf0b-708c4fffb19b", "comment": "Malware payload (GCleaner)", "value": "e96d52067a6f5b219379f36e9fa08e832584e7c5e77316ee896e0b8f502da6bce04160edb80b2a6b5996be7b79b7db74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1668848426, "uuid": "0905dc60-d67b-4baf-9091-5dc38529b083", "value": "T1BDC5F0516A56D2A2C92F2DF0E61060F94DB67C62E82EC17BF7963C0EFE7D353901A850", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1668848426, "uuid": "cf33ba0d-cf45-490e-89e1-b0eeee4dedfe", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1668848426, "uuid": "377f887b-bf54-4075-a26f-56ab870b99c7", "value": "49152:q2zLCWNk0A7NtM8wsh/6dzwn1I55qoGUjxYnUxVkBaFwnm:rzLCWy0A7NtMM/ZnMtGUjanUxVkB04m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1668848426, "uuid": "1b4c1103-fd3e-4c27-8d9e-641eede9d78e", "value": 2533527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1668848426, "uuid": "e033b08e-d7be-41c8-9586-023ac017a98e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1668848426, "uuid": "ce5b2077-be0e-45da-946c-a15fdcf807c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }