{ "Event": { "published": true, "date": "2021-08-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-08-28", "timestamp": 1630195381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "28cb75ee-fc2f-48e6-a2aa-547469965386", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ad75a4-07a0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630114781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630114781, "uuid": "ff549be9-0211-4cec-9587-a39633233d25", "comment": "Malware payload (Smoke Loader)", "value": "44d37c9388b94993bc0925284e83bcfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630114781, "uuid": "436e08f5-ca68-4af4-bde7-13cd2b4a6518", "comment": "Malware payload (Smoke Loader)", "value": "01b1d4710fa2b00fad627e58c0637755cf56a61015236efbd52a1748c05a75a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630114781, "uuid": "3be83f78-abf5-42a1-8e69-42ca98facdc8", "comment": "Malware payload (Smoke Loader)", "value": "8f164f22689f55430f7a6428cf1a8c0f1e7a738d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630114781, "uuid": "df468098-20f1-4ef1-a2cd-3fbe0ded3dcb", "comment": "Malware payload (Smoke Loader)", "value": "c4b2f52bffb5852f619348ce46baade9b25656dedb9326656f443fbfc33715f4ac895b627f32a74cede3649634cfc1fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630114781, "uuid": "e3dc7638-f235-4dd5-a983-a77c0aa8c8a6", "value": "T11EE39E0236B1C573C6C2187148699EA1263FFD319B75C5CB3788576F3E612E09A2E29F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630114781, "uuid": "3437f168-d2f2-4908-9f95-6b12640824ad", "value": "d3c9c233147536fd2cb825c3f3ce75bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630114781, "uuid": "b63799e9-5634-4489-82fc-567c2517787a", "value": "1536:GitUtSJsIkn+eUOkm1mhp4dGt3u6LQNB9tbMy5kJGYIwT/E4sjk5/Npj6T61mD:+8483uuQTMy5kU4sI5/DuT61m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630114781, "uuid": "0531e883-536b-4d4a-82f2-516efbf7e6d2", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630114781, "uuid": "c0f64ce8-f430-4635-9e0d-598b14a4ff13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630114781, "uuid": "7eb22ca8-941c-4a1e-834e-471be47441cf", "value": "44d37c9388b94993bc0925284e83bcfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16547a52-082c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630174598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174598, "uuid": "de797d6c-0ddf-4f1c-bdc5-70ba78c8d6e6", "comment": "Malware payload (CobaltStrike)", "value": "56991f905987297e06680f71ef6e6ba7", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174598, "uuid": "4924f7ec-f31a-4614-af0d-cb53f8a1fff7", "comment": "Malware payload (CobaltStrike)", "value": "02f75d4641e481bae5dc9470b8da3b700616bc57573fb2eedf468677836cd956", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174598, "uuid": "4cf8a086-1d83-43db-b29d-34bc3c40574d", "comment": "Malware payload (CobaltStrike)", "value": "45714f4bc04f078b269738cefbf1912d556f858f", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174598, "uuid": "07ae64bc-0eea-4b81-8f6f-e6c8a8651dbc", "comment": "Malware payload (CobaltStrike)", "value": "528014f38ad5afc06222a12f4adc456e836674ccc5cac8219f9d45f1f71c01b8409d0f2384421c4008b30046175914af", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174598, "uuid": "64d8393d-b775-4d43-a5bf-3f8666f23de6", "value": "T111248D713581F472E49A0475665BC7724EB9FC321AB198C7AFD44EA98F32282D739307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174598, "uuid": "f85c329e-9466-471c-b432-90450c774a24", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174598, "uuid": "52e7fe6f-bb74-4939-962a-b7ab6999076f", "value": "3072:dnT2RRXuwcN3OQXB8CITr9VV2ILe126JyTuBdjdUo/Z5AQj:dwXupN1x8CgBbRLDTuLjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630174598, "uuid": "56fb396a-7639-4d6b-be30-db4810d3d1db", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630174598, "uuid": "de2dd74a-a8b3-4471-a723-03243bc00603", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174598, "uuid": "179068db-ac1f-44d4-b52d-ff248852747c", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d51412-07d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630135547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630135547, "uuid": "73902424-0303-4f50-91c9-745590a0cb9d", "comment": "Malware payload (RedLineStealer)", "value": "84224064f8554bcea55de014d6d8538f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630135547, "uuid": "390d49d4-750c-4df2-ac67-7d21e98fac53", "comment": "Malware payload (RedLineStealer)", "value": "03cc15c743e103a3597c54ca13d7425978a6305235dacd700a193f5628c312df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630135547, "uuid": "7730c489-d418-4065-a941-5f5f93df0e87", "comment": "Malware payload (RedLineStealer)", "value": "75d9216222fd66664686e238bba51822361ea26f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630135547, "uuid": "f9be98fb-96f3-4a27-bd44-ec27cc91c6fa", "comment": "Malware payload (RedLineStealer)", "value": "3d172599a10168622d97c35716b1161c9bedd5fdd778766b1f3f1c522cbc24fddb26fab4b3f7cf372a3fba968d9e8334", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630135547, "uuid": "b1da9cbf-e276-4a19-acd4-5b6e85d35cd5", "value": "T1EEE3AE7B91B0A0A7C9481632F4644F4B36BDDE204461B298B58AF7AFCD3C65D8EF4760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630135547, "uuid": "8f1e64bd-db41-4072-afde-5442aefad8aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630135547, "uuid": "e0bbfdd7-859a-4fe2-8516-107c371650f3", "value": "1536:oQ88l2pbuet1Ig0iPKA7Pnr9x7MT7uGTFcImAI5jK/zFlzvfn:oh8lOFteL0d7nH6lFcPAwWLTzvfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630135547, "uuid": "8f9f1e25-9706-41c6-8b65-e8a890612320", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630135547, "uuid": "4bbd9759-3a17-46bc-8e51-3d80e5f2212f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630135547, "uuid": "45ba09c3-1511-418f-86fb-48ee7112a75a", "value": "84224064f8554bcea55de014d6d8538f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5e753a-080f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630162205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162205, "uuid": "5d68ae67-09d6-4b80-8255-318b4f887345", "comment": "Malware payload (Mirai)", "value": "628f2cb76add1f7be75b5f688c1d1a2e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162205, "uuid": "2733ae41-e3b1-4e9d-979c-f4edb4a20a2f", "comment": "Malware payload (Mirai)", "value": "044062afef72c2fc6e9022c09d42202cc78e86959c129ba3b5386159a5022f71", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162205, "uuid": "3f3b62c7-5f4d-487d-a98d-ae81136bdb50", "comment": "Malware payload (Mirai)", "value": "92a028daa14c8e70cd92dbf5e44a5018fddc7282", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162205, "uuid": "7c5f08d9-74c2-4d50-b8ae-84b663db4ff8", "comment": "Malware payload (Mirai)", "value": "0d36e782b60a4b32df0762def2b5c01cb40e3e5d1df4d97adb01796cad4a3382a2ec2ab5633c05a7e0efcbc42e33dcb2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162205, "uuid": "61f90e9b-b1db-4b73-ac0b-0b12548d2ea9", "value": "T11B535B88B9D19F13C9D1567BFB0F035C372B03D8D2DB3203D929AB60378A92A0E6B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162205, "uuid": "1c5b9c9d-4768-4192-ba0f-daed6f3972da", "value": "768:O5+O5EckueMXY05rmGOO+lTMdP3ghh4LURtqp8M3/UqCJTB+8mVAEmav46/K57IZ:n3ueAbrboAP84cu38FT0LXmav3/Kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630162205, "uuid": "e9fcb265-68d9-4660-87c9-0884c273516a", "value": 64860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630162205, "uuid": "35417bd3-2fc0-488c-a37a-0ac73fc9450e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162205, "uuid": "5d940fea-6e31-4453-8045-a66a2eebe910", "value": "arm-20210828-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f33291b-07c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630129221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129221, "uuid": "924f6bd9-b9c1-4b37-9f7e-6b7bed3ea05f", "comment": "Malware payload (Mirai)", "value": "3415a64a3e6324a02c9bc26e61b8c054", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129221, "uuid": "0ed4e15a-c914-4470-b338-d99c80690ba8", "comment": "Malware payload (Mirai)", "value": "05387a82f558b31226c608fbf6c77e59264f7111d7da4946c523d78b40ddc0d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129221, "uuid": "19aaf063-86c7-4330-b22b-128f68b54e35", "comment": "Malware payload (Mirai)", "value": "9f9a8b7358421a673ffc9820a6eb80ac40e2611f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129221, "uuid": "14acd507-449e-43f8-a187-4528608d3d8d", "comment": "Malware payload (Mirai)", "value": "17aa9ec247ab7fda5644ca84479af45937f5292ee7b7cb00fe96165a4305eb83739147871620f65dd7afc882d17fe321", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129221, "uuid": "adb4c369-8635-4f61-a699-7e0d103cb928", "value": "T15E834C12B2280B47D4930AB12D3F2FD157BBEED025F0B685656FAB0A9435E332546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129221, "uuid": "6230fb7d-ba62-4bde-bb44-6ebd492661c6", "value": "1536:+t9/osje9q16FsUTmGcqOGH6Cgy7TQ0bI5n6Eu+a1NWB:I/cq16FTrOGaWQ0bI5+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630129221, "uuid": "5fa20f64-ec60-4f56-8a5e-a40abbde1981", "value": 84676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630129221, "uuid": "0f672a24-0d2e-4fd9-8700-990d3801c8ba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129221, "uuid": "b92aab16-4c7b-4cea-ac34-3c6f22c448e8", "value": "3415a64a3e6324a02c9bc26e61b8c054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0532ce28-079d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1630113152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630113152, "uuid": "d42c91eb-15c3-43a3-a542-35310a10a226", "comment": "Malware payload (Gozi)", "value": "808dad1a561ea320b99367af8fd3405a", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630113152, "uuid": "c323f9e6-e7af-4c5a-9a28-2621b5e20507", "comment": "Malware payload (Gozi)", "value": "078c51dbcb5b4395f0400e81cd1d395e03c5f16b87a171b079ab0c0c5fe2375c", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630113152, "uuid": "6b236d2e-e23f-4a7a-b75d-ded4bbe54fab", "comment": "Malware payload (Gozi)", "value": "c7003ea2e67763faf471307f468231cd059aaccb", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630113152, "uuid": "84eed8df-03b4-4690-ae8b-408dd6b40b8b", "comment": "Malware payload (Gozi)", "value": "f5c9ce06721ba4fae129033a9f3f8dc27e84c818973aa9b572dae0da1d194577a612868833dd6b7e0479d300f1ea790a", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630113152, "uuid": "08ba97d7-73e7-4ed6-a69b-0a2e0da85248", "value": "T1E1751DA6A08695574D956393BDDB88AC32B4C10B070F5A206F73CEF4787B2DDC2B2716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630113152, "uuid": "dc718c16-7c07-4e4c-b2ba-7ed8e353e385", "value": "24576:nXhieMlBdQ4xWP034VqLWRGCtrhElgAt4bT5O:xH0z8tr+4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630113152, "uuid": "d1fd630e-55e8-444f-93b8-7c1d745375cc", "value": 1701416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630113152, "uuid": "99f9eeb1-b89d-4a5d-bbec-202ad7912d0b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630113152, "uuid": "05e7d0ec-55de-4e55-bb9f-96fadc63130c", "value": "Ry1j2eCohwtN.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3586c78a-0825-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630171644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630171644, "uuid": "2c985fcd-ca96-4d8a-89c0-f4eff27cca95", "comment": "Malware payload", "value": "29c285223985706d4c716194e5972231", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630171644, "uuid": "bf78c3f9-3d3b-47cb-a586-86069d9e2d49", "comment": "Malware payload", "value": "082206ac6d592e7fe083d9624f6ebc2458f5bb6cde1410627a7686ba1d21e4d8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630171644, "uuid": "10b50610-0455-43b7-a2ce-6341d5769fc9", "comment": "Malware payload", "value": "7ef4e26830dc2d60d88ca779d0fb2d777f13feb4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630171644, "uuid": "e91ce726-7f8e-440d-9898-f30f05c90d9f", "comment": "Malware payload", "value": "e6c017db3f1d834342d0f29fce369571ecf876a3205591f20e0ccf618c22d6ef34c53208e7b0511eb0221ccc7a6feb1f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630171644, "uuid": "e2556260-227c-4a58-870d-8a48e92c5acf", "value": "T1D9C61253BDA6C839DE574073D186D643982A06F4995FD09F32AC19C64B60E0E0F93BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630171644, "uuid": "72b8bef5-8fde-4bcc-ac7e-b8ed0871f35a", "value": "393216:2U0i2sYdqFa+KUEWc+C9jOtQ/vfgU8r+s0dpwuNBp7JFD:pYia+Pc+Ch3fjp1wIp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630171644, "uuid": "9b0061f0-f56d-437f-bfd4-383bc58b6448", "value": 12593634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630171644, "uuid": "f3f2b01c-8bfe-4b5f-8926-24e51a66b3f3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630171644, "uuid": "ff9ac2ee-990d-4252-a9e1-40819380b4db", "value": "output.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8ed208-0824-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1630171310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630171310, "uuid": "585f5af4-ce1f-4e63-bc91-d339ea0efb73", "comment": "Malware payload (QuasarRAT)", "value": "f0798a51a4943792e04641fe973f6387", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630171310, "uuid": "1c374744-f659-4525-b2d5-ab60a6ebf5a7", "comment": "Malware payload (QuasarRAT)", "value": "0924992f8005f8f64b0bbfc1fd8a7946f4afb994a631de073c6acb65ea5fb42b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630171310, "uuid": "c09ef28c-2d90-4263-9df5-baff858b0aa8", "comment": "Malware payload (QuasarRAT)", "value": "b5224d4f73d9b2a2d511be1d3ec84c7c0ee9d67b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630171310, "uuid": "967ba838-0112-4ae4-bf55-62c7ddf6499d", "comment": "Malware payload (QuasarRAT)", "value": "b1ec21dab7e9c657284ff211779b82386433855ea86571e38fbe9c9d43002f24a4edcde0c4cf68dde35c39d08d461fc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630171310, "uuid": "65b07883-ed4f-4a67-a352-4373c82d4f10", "value": "T169B4BF39F7908D33C17B2A388CEAD1644A74B7911D35B94A3EE8494C4E27BC2BD18797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630171310, "uuid": "c951dc0c-5ba6-41d5-9f46-7b37382734e1", "value": "b462095fea3219e285e54ac0547eead6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630171310, "uuid": "7a81ecc4-dd36-4fb5-9797-c21051af1200", "value": "12288:H190xaMJz7bLg0EKsWmAhndfnZs8svfozj/:jUReQsWmAhBIvfozj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630171310, "uuid": "447d2cd8-10d6-4e12-868f-acb0057a690b", "value": 532864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630171310, "uuid": "0c2a741d-88c6-4aa2-ad49-3501c26c2092", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630171310, "uuid": "94565702-14b1-4444-b0e5-22cdb59615ce", "value": "f0798a51a4943792e04641fe973f6387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38585911-07ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155328, "uuid": "045e3bc3-5ec5-4bfc-9732-02bfa49dd994", "comment": "Malware payload (Mirai)", "value": "0daf97ebb97328716344f70159a84662", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155328, "uuid": "3b029ab5-5c50-4730-acba-4309a65806a5", "comment": "Malware payload (Mirai)", "value": "09ca410a599799e226a535367666b3bbd8c1b0d3eb10e6e8232321dba58034d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155328, "uuid": "8ca7ea99-e8a8-43d0-b240-0f60d50de669", "comment": "Malware payload (Mirai)", "value": "cc391d4035311f217f8eccb8148f3bcfb4b3a9cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155328, "uuid": "0af50534-dc3d-4a13-a367-057307edcd5d", "comment": "Malware payload (Mirai)", "value": "ba122afa8bf1292ebcfca0ca1693757440acfd49921ed6f8e6eea3c7dbc668f8a0848b0389efd662156eb0f452ee6382", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155328, "uuid": "87c1d8dd-e4a7-4588-8936-458f0e5e759c", "value": "T164F2F1706A25D8F2C6E07D36EC2402926BD4263CEAEF32324DD94C26B5E655487FC927", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155328, "uuid": "a04363fd-b9b5-4c94-a31f-04c0244cf406", "value": "768:pNh95Vu25SKAHRZ5ky/rJVSFtMGf69035XdU3CN9q3UELbev:pfhbopky/PSFIypXWBLiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155328, "uuid": "a45b3920-49ab-4864-abfd-abcfd98fee4e", "value": 37240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155328, "uuid": "8ffad58c-f4bd-4049-8f89-273c0dee512d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155328, "uuid": "c5c70b80-c686-48f4-8628-ab42ae4d1384", "value": "0daf97ebb97328716344f70159a84662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3f4ef1-07f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630150102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150102, "uuid": "1a6c1434-8bd9-4acf-90f8-4c311870da6e", "comment": "Malware payload (Mirai)", "value": "1b9485c533369f1bc3729f655dcf1283", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150102, "uuid": "252cbf66-92ab-4cd5-bc78-35dd90461ccc", "comment": "Malware payload (Mirai)", "value": "09eb4ab7dc6fc1ffeee4844e9a437f78f8863010862204cb454f591650a1d969", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150102, "uuid": "e3f7e289-da58-4276-83a7-450a5e801b9b", "comment": "Malware payload (Mirai)", "value": "62123202056b2828386c64b84b7cb68c61bcdd9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150102, "uuid": "ebca1563-141f-42f7-b033-cd788590296f", "comment": "Malware payload (Mirai)", "value": "f850d798df72f6c710ed8a073ad8fd11dae3c5db473fc7f258c9806c87f98e2233785e8f4e3ebe5928563d0cdea143d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630150102, "uuid": "c0e4f8cc-3f7f-4f22-91a3-97c962013d13", "value": "T1DF338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630150102, "uuid": "be128a76-68d5-436c-9fbb-6c7fdbe05914", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvG:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630150102, "uuid": "edf72509-8fb3-43eb-b612-6e39fef1e51b", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630150102, "uuid": "b3d24186-ef2b-4c4d-ad6b-ed766e1214a3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630150102, "uuid": "130e55f3-bfc8-4ad7-afae-4c404dcfe43b", "value": "1b9485c533369f1bc3729f655dcf1283", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf6f556-080e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630162075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162075, "uuid": "a74bd1ea-2f8f-4455-a220-665427c4d0bb", "comment": "Malware payload", "value": "8d42c01180be7588a2a68ad96dd0cf85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162075, "uuid": "206c417d-43e3-4ea4-9b26-6302e3bdee28", "comment": "Malware payload", "value": "0b2a794bac4bf650b6ba537137504162520b67266449be979679afbb14e8e5c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162075, "uuid": "e9d9fe2a-c96b-40cd-ae67-67f33af389e6", "comment": "Malware payload", "value": "89a7861acb7983ad712ae9206131c96454a1b3d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162075, "uuid": "74a45c58-00e6-452c-94e2-e87a31bb8224", "comment": "Malware payload", "value": "51cc54b90c107d98a47db6fad60e5a453a716200ef1ca842098e6a10e54c806b048d3e64ea03ab6860a04a9c041dcc6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162075, "uuid": "4d644a6d-637a-4a7b-9050-0d0dad27f6ab", "value": "T170E20A0AF6D6C016E9374571242EFA76893EAD71133897FBBB411B7C1C702E2A87125B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162075, "uuid": "1ce1d7f3-c3c5-4f2f-9e58-2120f8469c25", "value": "2dfea0cb99dfd178aefd42a0ebb0ea98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162075, "uuid": "89b0b2bc-d3c8-44fc-9edd-560cd9f0918a", "value": "768:LrTnyz1RPCMpABTqM6PgNww0XVwvOMYoM:LrTnyhRPYNaAwwgIOMYoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630162075, "uuid": "f4975cd2-7e91-4966-a484-1c0805138ccc", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630162075, "uuid": "db375d4c-1087-4533-a5e2-6aa6babd2da0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162075, "uuid": "fc342f92-2d72-4e1f-a391-98a0e2fb0962", "value": "vol1-C..Users.l3v1ath4n.AppData.LocalLow.Microsoft.CryptnetUrlCache.Content.ifconfig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab004857-07d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630137052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630137052, "uuid": "1db5457d-5cc8-49a7-9f27-60fd8c7930af", "comment": "Malware payload", "value": "5e5e526a69490399494dcd7195bb6c67", "object_relation": "md5", "Tag": [ { "name": "Encryption", "colour": "#B8720A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockFile", "colour": "#30EEF9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Prov", "colour": "#E76ADA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630137052, "uuid": "050e68b4-2648-459a-909b-58ad11021954", "comment": "Malware payload", "value": "0ba324337b1d76a5afc26956d4dc9f57786483230112eaead5b5c92022c089c7", "object_relation": "sha256", "Tag": [ { "name": "Encryption", "colour": "#B8720A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockFile", "colour": "#30EEF9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Prov", "colour": "#E76ADA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630137052, "uuid": "874a84db-2909-44ed-a3c7-080ef354cbfa", "comment": "Malware payload", "value": "c9428afa269bbf8c48a08a7109c553163d2051e7", "object_relation": "sha1", "Tag": [ { "name": "Encryption", "colour": "#B8720A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockFile", "colour": "#30EEF9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Prov", "colour": "#E76ADA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630137052, "uuid": "291a7e91-dc98-42be-ba49-50b99e270efc", "comment": "Malware payload", "value": "7f216da03c32a7606c84d2accb5e5047bf1b5ed8788ac3f96d60de18674700623aecd44a98f9952ba9569ca90489bd01", "object_relation": "sha3-384", "Tag": [ { "name": "Encryption", "colour": "#B8720A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockFile", "colour": "#30EEF9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Prov", "colour": "#E76ADA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630137052, "uuid": "b1a053a8-0b7a-4e6d-8940-da472ac73f2c", "value": "T1F8443B5E8698319CD4E2E3BAC22DA49453BDB3373F275D72458E05403EEED4BE2E2446", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630137052, "uuid": "e1247e4d-b86c-4ef1-ba77-b8f8aba51b9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630137052, "uuid": "0efc1583-a141-4435-a53d-31351878214a", "value": "6144:LViYjDaF1BLLvdocNcdul5RorTsclzBL9GyRTGzZnjhLlLNRb:RiBLLvdocekUTh1UueZjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630137052, "uuid": "c49a59e3-b15a-4c3d-bec0-c3c19cb981a4", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630137052, "uuid": "48ec0d81-ce83-4452-9e70-100fb63dbbcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630137052, "uuid": "f460dac0-4fdc-458d-93cc-51e50f27a8d6", "value": "prov.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651d7424-07df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630141659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630141659, "uuid": "65527177-7f9e-4108-9506-c6a6c3ee58c6", "comment": "Malware payload (Mirai)", "value": "55ba7b991cf723861329308f30db1a07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630141659, "uuid": "f113d70f-858c-49c2-9d6e-0e4c71d9f9b3", "comment": "Malware payload (Mirai)", "value": "0d1ea1300d22a3cb47fdb4c577691f921220131ee9113722179add55bb1441f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630141659, "uuid": "d9e95526-e202-41af-a003-f8cebc302e53", "comment": "Malware payload (Mirai)", "value": "173fc3e1ec918483e804422d5a856f11730cf2c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630141659, "uuid": "381af4eb-645f-4120-8322-97fd33a96c62", "comment": "Malware payload (Mirai)", "value": "86616d4ad25dc548fb7d61770fd4ffb00b941cbecfc19eb8ab01b8b80009a1f0320886789386e48845e8e3db0b93925f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630141659, "uuid": "d6c8f8fe-bdb7-4c89-8b8b-d5fe676d13e1", "value": "T198634B82F9C2D212C5D9677AFB0E428C372257E8E2DE7203DE295F2137D756A0EA7141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630141659, "uuid": "70db57e6-63e3-4b6e-9965-1257cf0b90bb", "value": "1536:1iEfLtMW1cS312fvZ1AC8uHQPTNI2wYXF1slA5MJ:xj0XzAC8uHQTNIwXnsSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630141659, "uuid": "b8ffd1eb-d2b6-47fc-bd8d-8b96abaa3cc2", "value": 68320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630141659, "uuid": "0c58f0ff-d8b7-4ed9-9bff-163714ef7f36", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630141659, "uuid": "c7502528-2b49-4c8a-aa9e-82f2ea36eabb", "value": "55ba7b991cf723861329308f30db1a07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a921e91f-07c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BazaLoader)", "timestamp": 1630131465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131465, "uuid": "8163cf83-da26-434f-b838-a78e2c564d7c", "comment": "Malware payload (BazaLoader)", "value": "34b7f1a3efc09ee89ecfa557e75ccb5d", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131465, "uuid": "e045c4fb-cc5b-48ba-aa61-2fc6bd8192e7", "comment": "Malware payload (BazaLoader)", "value": "0d93da5a4c34db012ef7293a6dc72345fad0e2859ba378d34db8b0788d89e90c", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131465, "uuid": "739f4c6f-198b-40ff-afcf-ed72abc3444d", "comment": "Malware payload (BazaLoader)", "value": "f6fa7d45e48d33dc1049c8a3c40a82ae6eaaa0da", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131465, "uuid": "c6a903a0-d628-4e53-842f-c3a60e8a9cc7", "comment": "Malware payload (BazaLoader)", "value": "2cb697f071cf45af4153315c29ab77b74c5466f137f7e7d80e8747afcce8d94c1264ad25bef3df7f69e80c6b48ba2e82", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131465, "uuid": "a198d4ba-2f16-42f2-8135-e0d36076aa60", "value": "T19C64D01049652563F1599DF128C4AEA2243A7232423E3FA7EDD9E32C115CEBD8F09E9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131465, "uuid": "df690fc8-69ce-4c51-9b52-947f491f173a", "value": "b211bec2627ea9b5322d60ef3ed97e1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131465, "uuid": "99e34a9f-3652-4cd7-8386-cbe2299b81df", "value": "6144:yYFxGa6+jTluQDJVoHIZ0z7PW0uet1hjdweUt7DTxzP4:yUj93VGHcey4DdY1z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630131465, "uuid": "5e145494-dd35-4ed4-80b6-7771b66efe14", "value": 332929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630131465, "uuid": "462ed995-b2ef-490a-82ee-525a3007108f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131465, "uuid": "b34ddc77-a129-4b1e-b6e3-659bd6e9aff6", "value": "34b7f1a3efc09ee89ecfa557e75ccb5d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ee40e1-07ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155567, "uuid": "e267708a-e80f-44b8-bb96-bc6e032e4ef2", "comment": "Malware payload (Mirai)", "value": "6a360ca5d7bdb231157cd3a2c6071596", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155567, "uuid": "f0a89643-7b54-41a2-9392-dca58ebc3ed9", "comment": "Malware payload (Mirai)", "value": "1131b834868bf2c9357e75b32d74cc0942c0fe66e383a00d162d28db6c355609", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155567, "uuid": "6d91c341-4257-46a0-a58e-11513128ad4a", "comment": "Malware payload (Mirai)", "value": "f0af52a99ad2afe2191cc49032b4b37091ca23a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155567, "uuid": "42f5545f-e835-43fe-ac79-780af9682939", "comment": "Malware payload (Mirai)", "value": "75a1a0eccfc5189d04d1e3d01de8642ab858665f83a59f04afbea7f0c54e59e6b261dd32c17f517e5e2aa14e8000cd22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155567, "uuid": "d89aac01-76bc-4542-8653-5d539f3895f9", "value": "T13BD2E1EDD18098F6DA7FC83953DA13032A2413A585C76C5B31A6B643CF698B1B8871FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155567, "uuid": "9fd9e874-606e-40ca-a564-6fcca6004ad4", "value": "768:lZI8JvLN/MnqFFvj6lc6YBNolvK4watJgGlzDpbuR1Jt:lO8JvR/IqFFurYBNoA4w0VJuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155567, "uuid": "a219ffa3-4d88-4b61-9548-7877b3973096", "value": 28532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155567, "uuid": "fa8d2d15-faca-4130-982c-93df827aff5f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155567, "uuid": "fa2c45f1-fa0d-4f84-bb10-7967c463319a", "value": "6a360ca5d7bdb231157cd3a2c6071596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e43fffa-07e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630145996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630145996, "uuid": "b0f9f153-519a-43f3-a3a8-50bbe5425cd4", "comment": "Malware payload", "value": "3c945140c87239099672c1736e94785c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630145996, "uuid": "c6216769-5f06-4cc7-88cc-5d45e8107110", "comment": "Malware payload", "value": "1185fffab4b6b38a31e8b1d5e92fa8f50b7b56ce45ca42f841992735c7d15778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630145996, "uuid": "4ef17d03-8e9c-4d59-bea7-3e871acd7ec8", "comment": "Malware payload", "value": "0974893e5f9f46918c2c985cd6745a4e1ada3fb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630145996, "uuid": "b1b057a9-f3d3-4eb1-a08a-0360ccae7ac7", "comment": "Malware payload", "value": "d929d686f1d2014660f43ddf898a2006a0883df8c6813ebf8937baf05ac3b75122626da94dec36da62145eb7fdb15c22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630145996, "uuid": "39ee26c4-4aa0-4f4a-a40c-263900f8f4b1", "value": "T11A173355AB36C4F0C23B56B0CDF2AA56EE727CE477347A5A231482E1530AD49CF29372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630145996, "uuid": "c9b24050-ce8f-499a-9488-448507d74285", "value": "ce92706925e359aa40f23197a9743843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630145996, "uuid": "1369fa84-c78e-4257-bfb0-ed9cac865b31", "value": "393216:MrIMVwaBRMDYFcSmj7MLEJu+ESVEIRlRckLSDDjXAZNisrSwE/Ls7hrMk2R:MrIMVpBiD7MYJRVnH9ADevS7fR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630145996, "uuid": "7e77acc4-066e-4952-88fd-5b2052c57215", "value": 18744336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630145996, "uuid": "6daa7d6a-f8f2-4df7-a8af-3e5dca894cdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630145996, "uuid": "46c82042-b153-48c9-9487-44763985d696", "value": "winpe10_8_sergei_strelec_x86_x64_2021.07.21_english.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc8aabc-0822-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630170287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630170287, "uuid": "adee82c2-eea5-4cd2-a777-5a2658361ddb", "comment": "Malware payload (CobaltStrike)", "value": "b3b77f3cea0160f59bea3f6ab2e767fc", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630170287, "uuid": "3939ca27-073c-41b8-99c8-4470a3eb1ec1", "comment": "Malware payload (CobaltStrike)", "value": "11aa5220689c193f7c78f935861f3ce55b842f4bd3c85344a76ceecfbe6a9ede", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630170287, "uuid": "25425187-8149-4f68-8f6f-179659aa515e", "comment": "Malware payload (CobaltStrike)", "value": "1b21ab867f0bd001fc220a4b254fa42810668568", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630170287, "uuid": "0fcba6a1-62d8-49be-9e9d-2906b27a7224", "comment": "Malware payload (CobaltStrike)", "value": "a324ebbbdc18396507aacfee7a05d5a5ffd3b939d015de30fe477b45e67e6a986741c23b205817e32692e0485d363e23", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630170287, "uuid": "1453c2e5-91a5-49c3-a8ef-78c31b7ce32e", "value": "T1B824DF797375EA96F61160F13F7EA431AE31CA4F7B8A39D8D382F175A9434304B58482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630170287, "uuid": "c254d917-3e59-43e0-8194-bc3d9e9e878b", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630170287, "uuid": "9299f2be-c252-4de4-9628-37007c12cb07", "value": "6144:QmwgmHv+U6cJ3ytIhx4CZ2tigmMLw30yTjl:K22iMxvZ2tivMLyFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630170287, "uuid": "7a02765d-8575-4311-9f16-05a312790742", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630170287, "uuid": "2514a087-dac6-4a8b-88f1-4d2239d7b156", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630170287, "uuid": "5491c839-fdcf-4e49-9af6-00ba85ed905a", "value": "cobaltstrike_shellcode.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78927fd7-07d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630137826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630137826, "uuid": "c91154a9-c2e7-494e-90b6-b03906974acd", "comment": "Malware payload (Loki)", "value": "6afae368ca54cb50b11747ce01850e35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630137826, "uuid": "9617d1ae-7c55-44f4-b1bb-08fc9886c449", "comment": "Malware payload (Loki)", "value": "11ff77586b240f482b03b2732203b49a98619b7e69955a9d9fd61dd3a6dc348c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630137826, "uuid": "a541f6d6-8658-431f-8eb5-6307348bb475", "comment": "Malware payload (Loki)", "value": "8ab6ac811dd83c9ccdc77dca3cc868ddfd65c5f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630137826, "uuid": "722ee35a-01e6-4d02-924c-06fefbf94db2", "comment": "Malware payload (Loki)", "value": "1d37d7f0e45e33057a03eb75a9de9b7d3f858a48bee2ff8ccd5188a019838cb267863cb82eed5064e792000769b8587d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630137826, "uuid": "204de7dc-a933-42b4-b708-fc00fad17f8b", "value": "T1E9053B3D29BD262BD179C7B5CBE0C837F0549CAF3111AA6464D78B6A5352E8235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630137826, "uuid": "479db2d5-1664-4dcc-b5ed-87078080a7f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630137826, "uuid": "e10b02af-98bd-4cc6-9a24-9ee9ac8a5ff6", "value": "12288:uyu2DhJ3aZm2w+Au4hPqvu0q/9sAsK2J6sLc:a2JKZV0cu0Q9sD6sL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630137826, "uuid": "1c0133cd-a991-4964-9226-4caf8a7e1e06", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630137826, "uuid": "00a88588-4889-46fb-9d2e-7c81b5edcf7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630137826, "uuid": "89df5ab3-3a25-41e3-9d15-25eb970266fb", "value": "6afae368ca54cb50b11747ce01850e35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe78f89c-081f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630169404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630169404, "uuid": "3275cdd8-49ae-4bc3-9281-8f39a7892d02", "comment": "Malware payload (Mirai)", "value": "5407a3577befd22a6024d7c817c7d08e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630169404, "uuid": "f2c528a1-06ec-4f8d-84d2-a4b2e567933d", "comment": "Malware payload (Mirai)", "value": "134f7bdcc085a6b6496b979129a0046633f3334834ac72e822323be9f0e74f99", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630169404, "uuid": "7f119e0d-aca2-4456-b0ab-43f4aab74d71", "comment": "Malware payload (Mirai)", "value": "2ef2ec1e0cf696adc94ed991c8c41e7677817ec3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630169404, "uuid": "1a5047cf-7bab-40de-852f-b21e6156e745", "comment": "Malware payload (Mirai)", "value": "45cfd29c6d59e951cc97a6c751e41039d750d39f4088a1c23e5217e966cb0cad9dfab6210df41595c11080cda2a82ee2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630169404, "uuid": "f1e04110-9d30-4302-ab5f-cedf3b2d89b7", "value": "T1C3D2E15669F54745DC1BA1F92ABEB8C85DB0F208110C85F2FCE4B0B774BAE9886BC251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630169404, "uuid": "372ba123-c204-4a5a-af3a-bb19f3038981", "value": "768:4u10uwKSUh7UaQIFjnqajSPwOTFOZ5jDnbcuyD7URQRjR:Z10EQaJhhSDFOZNDnouy8Ryl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630169404, "uuid": "5a1335bf-b723-40ab-8e0c-d39647ea5cf9", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630169404, "uuid": "b17c5548-494d-4e16-a67b-f3f13e659eac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630169404, "uuid": "7e9ffb6b-7675-488e-9ee9-0223b312b0b4", "value": "fbot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352d0260-080d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630161336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630161336, "uuid": "ca72e814-46c9-4b53-adeb-9b016087fc21", "comment": "Malware payload (BitRAT)", "value": "edc6fc03fcae70ce049633e7462df1f4", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630161336, "uuid": "b467ef6c-9416-492d-b565-3f552a62ad92", "comment": "Malware payload (BitRAT)", "value": "15da7fc578a4c9d29717b19b4d5b604e08307810752fdf63d27335ba3171bbaa", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630161336, "uuid": "c748b725-4444-4291-b10c-e77814c86a61", "comment": "Malware payload (BitRAT)", "value": "4358cbebe4ee45f4e78264399b901c459e42ef4b", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630161336, "uuid": "d341c1bd-d283-4bd8-8b96-91ae53fff8cc", "comment": "Malware payload (BitRAT)", "value": "49049165ef8fd7e01314605a9e4d21da0bb3d615bf7c7eceeff0cc26cf925776aca4d13374e111acd328ea1b83d8e9f0", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630161336, "uuid": "fa630131-e8c2-467f-b600-6e6759357eb0", "value": "T1FEC57886CEEF8F8FC89F3176141E6D5319DE81A825718AACED17AC41B7C068318661F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630161336, "uuid": "27b3c5e5-888f-46d9-ba76-35342cd2f4a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630161336, "uuid": "083c14bb-463a-4823-8c33-7b0bcd638a42", "value": "49152:yH4ZbyZHYr3nsDW7fOFpLHRoN7Thvl9HAMcZ182dhMbYt6Ku+C:kZms0GFYZl9Hq42+I6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630161336, "uuid": "9202922e-7f97-4bed-9a61-be2aa01574db", "value": 2612736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630161336, "uuid": "190b7de7-d047-4a69-aa21-dae733a9250b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630161336, "uuid": "508e3d45-d6e4-4e66-aac3-ba5fd4a06d21", "value": "edc6fc03fcae70ce049633e7462df1f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e816f37-082b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630174209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174209, "uuid": "143528fc-c046-43a9-832f-15e6799c28b6", "comment": "Malware payload (CobaltStrike)", "value": "39c7c7bfc96f382eda0169be06f34914", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174209, "uuid": "dbdcf69e-d349-4ff0-ad4b-3766e846559d", "comment": "Malware payload (CobaltStrike)", "value": "163118403e2756e842914296c1552626c8c3ef377ca036d3369a2543a57a7dcc", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174209, "uuid": "514bc485-65dd-4cf8-a540-b33527454a22", "comment": "Malware payload (CobaltStrike)", "value": "c7b3048d3aa0dd7d5fa6287fcfdc02d83e11a7af", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174209, "uuid": "fa734b9f-46b4-4482-aba1-3e50d83d7bb6", "comment": "Malware payload (CobaltStrike)", "value": "0dc4584e2bd3d2a22ad66df670bff5b9228f4d91c47fc4e9583a43eb9ecf5f90e5d4db2ce61b7aa59008a9475aa51872", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174209, "uuid": "2951c083-bfa0-4106-9837-663d04e0b38d", "value": "T17B24CEF8A87B0DA1FED4563D997C2CEC0FAB78DF034211FD9A8CB435B0556880AD1999", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174209, "uuid": "3710adef-154c-4cec-8315-f67b9e08ae29", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174209, "uuid": "6a2e44c5-bfe2-4f7e-837e-f9b05c34e0b6", "value": "3072:mn0XHqgE8YzAMDLuspafV0Yp1cR6abXs85ExRHLdN501aYhlDL5ZGQnuQMQh:VbrGAMDL6fV0YzEsK2LPSakz4QuQ1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630174209, "uuid": "0e9d577b-0f0a-4e59-b3c1-0270b64a4f75", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630174209, "uuid": "c0fdfa07-075a-4a5a-a187-ce978f37ed39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174209, "uuid": "53be301d-1096-4658-a3ce-ce9cc995a17a", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eea4339-084a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FickerStealer)", "timestamp": 1630187471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187471, "uuid": "2a4e640e-1134-4d8e-aa49-61eff9a37e2a", "comment": "Malware payload (FickerStealer)", "value": "344d0fae77046d608a50b4f07f7e2767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187471, "uuid": "623feed8-241f-45c2-b29f-524fea28de3b", "comment": "Malware payload (FickerStealer)", "value": "1787460d5784f717397a6e3bda4e8b835e855e53a384eb6e50d12311b8788b90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187471, "uuid": "2776a182-0127-4daf-8dd3-d5e18e79fd68", "comment": "Malware payload (FickerStealer)", "value": "b600dab2678c4a487c6009e0f3bf8a6bf00efa71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187471, "uuid": "fecdc726-15ff-4e2c-8422-84951c0d67f1", "comment": "Malware payload (FickerStealer)", "value": "06b461386f21818f94ca2d70cec7880095a48730b1fbdd4309031ad0e9ad325f0c104d5d147e0e686acce7106bb67ea2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187471, "uuid": "645b5fea-d574-41c0-9e46-f98700309d90", "value": "T19EB49E3055F49C29FA9622BC45AB835AA73E7EA05B32C3C7467615F58F231D2ED70382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187471, "uuid": "5c54c1ad-3450-4cee-95f4-4b3a899e14d4", "value": "f6ee633166e72a1d10f4f54440093ac0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187471, "uuid": "e7db0473-d8a2-4ef2-abf4-30b6cd678173", "value": "12288:ZSAdQClH18X/kq+Cw6rWdk9n/Bls9EdhWX1EW0rF3:ZPrH1OE+WO9/Bls9oIy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187471, "uuid": "0535ed8e-0075-4263-baea-5d00ac734779", "value": 523083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187471, "uuid": "864a0d51-ffb7-412f-858a-72a273febf49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187471, "uuid": "cb02dae0-4539-4572-beca-b8ae0d43f702", "value": "344D0FAE77046D608A50B4F07F7E2767.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74cac893-07d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630135243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630135243, "uuid": "511a6a47-e97c-4a1e-8a7f-600423110b84", "comment": "Malware payload (AgentTesla)", "value": "bc48edd1be13cb850ba3c0bba7d74ea0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630135243, "uuid": "e08b127c-7ab0-4d98-85d2-5ac3dc7e9288", "comment": "Malware payload (AgentTesla)", "value": "1856d4a7299dadc2fc80ba3379167a381be7c75acfff9e427149e62f5205aab3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630135243, "uuid": "c72934e8-113a-4342-a3bd-9e7c1e4bdf7c", "comment": "Malware payload (AgentTesla)", "value": "6c094a6ca139beb39d1850f1abbfe88f9a8502c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630135243, "uuid": "85a9234a-bee0-4e9a-afd3-8822763d33e9", "comment": "Malware payload (AgentTesla)", "value": "5e903c4c612d4cf11ec50d13f14f1983292a84af391b12759ec8612acefc8156aebf72da89b2c32af4d48ed800eadf62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630135243, "uuid": "fb8547a2-f3a5-4e2d-8b47-3fde8b99dc4e", "value": "T100D4F18593AD481ECADFCDB98690E47487B48E334642E3450EC46EBBB1653E04B4BED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630135243, "uuid": "ddf28450-137e-41a9-9936-f70450201b15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630135243, "uuid": "c8f43feb-5100-4e58-9fe7-a2c88bc47ee9", "value": "12288:a14qAJ7/gZa624K9RSSbhH/Rqels8iPubwD08435f6bE+25aJlBvR3:1gZa62cSbhH/Nls8iPS84pfc3Eaz/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630135243, "uuid": "212b8e58-9dea-48e7-9abf-950b8af0214c", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630135243, "uuid": "ae4b7983-013d-44c6-a97c-dc8b76465564", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630135243, "uuid": "1b594255-ade3-4a1c-bbde-a39c320c042e", "value": "bc48edd1be13cb850ba3c0bba7d74ea0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236f32fa-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630167748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167748, "uuid": "4d60bdbe-ab2f-441a-9470-835571ad78d3", "comment": "Malware payload (Smoke Loader)", "value": "c9b70a797816a2a999dd91383ede9476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167748, "uuid": "74403915-ba75-4fb6-8001-f9dd11921436", "comment": "Malware payload (Smoke Loader)", "value": "194fac72068b59295f3c091c72d9df5a62669b18b6f4133d2b8df5e78b1f395b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167748, "uuid": "3bce475e-af12-4069-8e32-f5027114bb2b", "comment": "Malware payload (Smoke Loader)", "value": "2a50d1c449ebff7a4829c28c66c3efbcf47754ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167748, "uuid": "1f91b555-59b7-4755-9c7c-a5dc587bd913", "comment": "Malware payload (Smoke Loader)", "value": "04ae27f82b3b3294d004560e9283dd15c482363c4e7428681b692dc22a754f4da42f30d128f921b200ac87835436774b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167748, "uuid": "88a8da2c-9ba1-4a1d-b54a-731f0ca759a2", "value": "T1B7D3BF1636B0C473C5C21576486CA6B16A6BBD316F71CBCB3B58475F3E223C0862D2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167748, "uuid": "5aef1f05-9d23-49a8-897b-1b9a2e745746", "value": "4f5dc64597ca4f695b16cf6dee89f692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167748, "uuid": "4d10e419-8e24-4dd9-ba6d-5b33a533db30", "value": "1536:33i+1boAlu83Tkspge/lirG48ht8U3wL7p5zIwDSnSn5Zqsjk5/Npj6T61mD:399LpwrGDhA7p5znDSnMqsI5/DuT61m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167748, "uuid": "b8e16d9f-748c-4fbd-87d2-ffe3df3b6a26", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167748, "uuid": "08a76949-0174-4400-9b6f-f8d0843b0b3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167748, "uuid": "90438a14-68a3-4d87-b22b-bd59a16ac5cb", "value": "c9b70a797816a2a999dd91383ede9476.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7c218e-0841-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630183925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183925, "uuid": "b797de95-cd81-473e-8edb-02e8ac60075e", "comment": "Malware payload", "value": "fe6bdb92e84a326c743af342784de96c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183925, "uuid": "570d614d-77a0-448a-8080-0d2c51c8487e", "comment": "Malware payload", "value": "1974aecc234949f139e347e7720dbe9ca7e5ead675926c98f2543c954c35f6e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183925, "uuid": "94a0f290-4c0f-45cc-8e43-968b22694218", "comment": "Malware payload", "value": "526edea2547c7d0002a7ffdda47396e3a01eb504", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183925, "uuid": "7cc12dfe-e1e9-42d6-b860-c4f5a9cd096c", "comment": "Malware payload", "value": "e11676afaadf327e31e93d1b2b6affd0037f42ec21a6f38cdf6ff02aae8dc613785f3cb54b0b935727ee5111c39f6e3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183925, "uuid": "7e654c16-ec5d-4c4e-96f9-467f30e91447", "value": "T18583E895B8C18E15C5D413BBF92E018D331267A8E2DFB2129D206F147BCA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183925, "uuid": "b67fe55c-da4c-494f-8008-1ae7f9e449bc", "value": "1536:uRnabgUZLKq/zB8dAm5UhNTzeRGq1SM2b/cc7JT9i6N1nGKYw5e5e995nZ4cuIfN:VgYLp/t815YNPeUqoMS/ckJRpN9NL0aN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630183925, "uuid": "81216ece-11b2-4ae3-81e4-36535f2af9de", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630183925, "uuid": "9d43b7eb-740b-4d05-96a4-f52ac591fadd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183925, "uuid": "b36bc967-26a9-4b90-b094-1e472d1f0a86", "value": "fe6bdb92e84a326c743af342784de96c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fe333d-0842-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630184211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184211, "uuid": "c0d326b4-c74f-4465-9e16-687c9a2a5af9", "comment": "Malware payload (Mirai)", "value": "b372da58e02f4c4148a3712755f8f00f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184211, "uuid": "e3aca797-4f69-4064-a222-b600c55b2636", "comment": "Malware payload (Mirai)", "value": "1b94ce1c5778406dfe45afe70db24978d4ba293b1131cf3be7e99579b461dff5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184211, "uuid": "9fefcd97-4fa4-4f85-9343-efa17469e520", "comment": "Malware payload (Mirai)", "value": "0ee4868056e79da6e7389a406772f38479d4261c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184211, "uuid": "6463fa3d-bab0-49a0-9c01-0841b3610510", "comment": "Malware payload (Mirai)", "value": "fad94be3d3359163106d6f87d9af63b3ec9f8312dfd4dda8fc574c9e12c4a68507e71fbd75c6d3eee5280d83c8141c15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184211, "uuid": "c778203a-2ca6-4e73-8598-48c68562c5a9", "value": "T1AD93B71E3E258FBCF79D823547B78E229648378A26E1C545E15CEA011EB034E741FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184211, "uuid": "d7ca69ec-38ba-487d-97ba-a08268044c40", "value": "1536:bK/QR35eT0Ata648QFOyAOVDZZYHWmdXSWYkhoh9O:ke3sTPiBRAOVNZrmdXSWXha0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630184211, "uuid": "ef863ce2-f67d-48c6-98ca-955814a1da8d", "value": 89628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630184211, "uuid": "7225ee63-9175-44bc-b32b-95cfa0823ee7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184211, "uuid": "7c027a02-0f3a-4fef-a289-c3676a56d801", "value": "b372da58e02f4c4148a3712755f8f00f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda9b3ba-0827-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1630172785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630172785, "uuid": "0cf4af9b-3864-4fa1-ad9e-be9998181d23", "comment": "Malware payload (AZORult)", "value": "f98399c21666ab44ffe10da4e3326546", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630172785, "uuid": "c78e78b1-afc5-4718-b138-2ac1157c925f", "comment": "Malware payload (AZORult)", "value": "1ca8a6eb97e3bdc6632c0f4263c759a2a2b0b65c765bdb57437312f509452ce7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630172785, "uuid": "3a155a4d-f9e4-460a-aee1-2ac9b0fa0d40", "comment": "Malware payload (AZORult)", "value": "9aab0059b86f437c987e437dfec661ecf7fa22e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630172785, "uuid": "4dc13272-e49b-4ccd-bd85-ca9ae756fe88", "comment": "Malware payload (AZORult)", "value": "e55b74cf71e8d9efe1389f16e6206bb5b9b0c4ff9ad253c46170241cab81aca57ab682a11b017836c5008533f7110ed8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630172785, "uuid": "b5892d9c-0d54-49ae-b9b6-dffc0f9b8742", "value": "T1F37402063793B366C45C05F084E3092513F5F7AB5233EB4A7E4841EA5F567D88B4AF8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630172785, "uuid": "99c6642d-b9c7-4d65-8a28-10f1f0e4606e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630172785, "uuid": "df9a44a1-c5a1-41fc-a71a-767540cb1226", "value": "6144:RqFQsTyzSawiMDgvm41cN9gL+cD815ua33Gk3DY:GnTyQ5E1cXXTua33BD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630172785, "uuid": "2700b363-a04c-4c3e-82d2-056940ebef01", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630172785, "uuid": "a5283116-a160-440a-a518-33d87c3d31bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630172785, "uuid": "c0fc0672-1fbf-4820-bbc4-56dffc500ebe", "value": "f98399c21666ab44ffe10da4e3326546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4fdac8-0818-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630166097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630166097, "uuid": "9cbcc70e-5712-4f97-a90c-0f6ffa79ccd3", "comment": "Malware payload (DanaBot)", "value": "54415694e11467be54aa0e5fc0c63ee5", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630166097, "uuid": "c3cea051-c7b1-4306-bf63-cc5070f4d8a8", "comment": "Malware payload (DanaBot)", "value": "1e51f18092d8b33ce540f0be383e973e3bb962de84630144d4a40f70d74551f3", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630166097, "uuid": "a4d5b377-927c-4506-aeee-c561dd8f7dd5", "comment": "Malware payload (DanaBot)", "value": "adb1fa18fc275e98e26660621b74ee188fb0b66b", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630166097, "uuid": "4e3992fc-82d0-49fa-b45d-b9b9e42a79a0", "comment": "Malware payload (DanaBot)", "value": "f17ca92f5254636e402811d745be57a9bb75bf9ff26824ff5a13109654d8b678c2f0e21a14ac16b16ed142f543ddfac0", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630166097, "uuid": "72096f3d-980d-47ae-9ad5-9f2011cb2377", "value": "T193351233A2808C72C059FA3D38D1AE94146EF7717E67F91A1ECC449FC8DB641A41A65F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630166097, "uuid": "0a1e8f44-0fa6-4564-bbc7-ea074acc1a64", "value": "0db41ef1d0838062c008ff4132905031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630166097, "uuid": "56981cb6-6a94-4a21-9626-50ec87bc5b08", "value": "24576:mZlJEIt2wdfQlda/BnHUmdtqqAqMenRFNEuA5u0u5XjO+MG1c:mZ3EIt2wdyElnAqMekiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630166097, "uuid": "5445ec73-9d59-4917-9ef6-2f59ddc5d8e3", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630166097, "uuid": "2122090f-1b82-44fc-9432-f26a3ee1cec9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630166097, "uuid": "24f020d0-3638-4a6d-9e57-a59e6b4419a1", "value": "SecuriteInfo.com.Variant.Ulise.282168.3684.1426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345eb1a5-0847-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630186245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630186245, "uuid": "30c2c7ee-59df-4945-8166-6ea2ca39cc07", "comment": "Malware payload (AsyncRAT)", "value": "34060d245a9ae95572345acdbd711382", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630186245, "uuid": "87fab05d-8d7d-4f1b-89a2-68c142f5021f", "comment": "Malware payload (AsyncRAT)", "value": "1f944ff0fe96662eba88deb2c14893d01a441d18ade26ff49ca0b7d774be6407", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630186245, "uuid": "6347422a-39e5-4b98-bc73-649f5b7f06cb", "comment": "Malware payload (AsyncRAT)", "value": "942e15294577f0a5f4239dd66e95df81990aa618", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630186245, "uuid": "4aad236a-9eff-4540-a04c-50cd437df75c", "comment": "Malware payload (AsyncRAT)", "value": "dbc8193acd8ee6f8fb90caf32f101250ce2988120b6cbd5ca6a220b4b15486d8b637ecd3131e752cbecfb39f8bc2c13c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630186245, "uuid": "2fe93e1a-9cfa-4da4-a419-b298467258ea", "value": "T12BF2D066F7FE42F3C9350F326D3315C50B7D8686A5768F2FA48D9604C8D322A63936A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630186245, "uuid": "05dd9001-eaea-4ffb-b8aa-83b0801c583c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630186245, "uuid": "698137fd-bb93-409d-bef2-4dda06323fa6", "value": "768:WjlhhG+qnWSjAfGyAf4o+jLaRLkWQCiIvPp+:4Hk+qWSCAwo+UmIvPp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630186245, "uuid": "8ee1605a-3d42-4bee-8ac9-6e49d4d2d7d4", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630186245, "uuid": "ea6b3c59-06cf-47cb-b831-e69c95c48cef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630186245, "uuid": "d3e385bd-19b9-4bea-9f74-98d00cdb7ae9", "value": "34060D245A9AE95572345ACDBD711382.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f797ae-0856-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1630192848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630192848, "uuid": "d2ee3861-d60d-4ee9-a8f1-2ef9ad0d0f97", "comment": "Malware payload (DiamondFox)", "value": "35f16297325ed756df16be1282b64ad3", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630192848, "uuid": "6efb9a11-9658-4f53-8cd4-b13c48e8d47e", "comment": "Malware payload (DiamondFox)", "value": "208660089575dbef9e473ae2b2556e5492e8739376d39e1f5575ca65d33892f7", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630192848, "uuid": "047480db-7deb-4250-8db6-a13aad1184fd", "comment": "Malware payload (DiamondFox)", "value": "2676e2d8f9e336c0e63032a2d4cf8516e94a7ebc", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630192848, "uuid": "5324fd90-c4af-4ccf-94b7-5046325cd68e", "comment": "Malware payload (DiamondFox)", "value": "cabefbb459f939eba4eda810a6ffbf66affdec65b75b6eb280a5125464d48a62f343856d9c5b35e361f3a096219acd9b", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630192848, "uuid": "f5f14611-064a-4013-9654-47ea443875f1", "value": "T198E5332818F2D0BEF843A1364F22953D75436273B9B1627A73769F447827180CF9DAB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630192848, "uuid": "405750af-2e78-4a58-be2b-764ac38026d1", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630192848, "uuid": "d1dce3b7-41f3-481a-8839-eb48f4e12f7f", "value": "49152:EgqRTT9SaYrgC87+Z9CNph1NghUYiHuqJieZLS8QdUMT/axADmf/U:J+TpDfVTXiAuUieZrQdalf/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630192848, "uuid": "5bb3ee24-4605-409a-91a6-6a4b543f7abd", "value": 3315257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630192848, "uuid": "68567a4e-a0c6-42bb-9a45-c2e4accaad7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630192848, "uuid": "af7e78a8-2b41-4df9-8099-fac43ed942d4", "value": "208660089575DBEF9E473AE2B2556E5492E8739376D39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd8f260-07fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155065, "uuid": "3dafabf4-5174-40e3-9720-63b925235161", "comment": "Malware payload (Mirai)", "value": "a69a55373e2130f1d98c519fa77750d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155065, "uuid": "dcce525f-069a-4288-b7f0-7e60671fb518", "comment": "Malware payload (Mirai)", "value": "20a385866604e1f1dba3fbf6c41083344389aac80c10d06e56248861306eddcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155065, "uuid": "d5b2033e-cb1d-49c3-960a-a4d4d25b0b60", "comment": "Malware payload (Mirai)", "value": "bad5d217595a539ee92dd837c46544df60c2f44d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155065, "uuid": "680563f6-ba3a-4dd0-8951-f1b21b021585", "comment": "Malware payload (Mirai)", "value": "74c048f5bbc0809a52573baa4d3c8ea94e66a006219aa935cebb21ec5abe87b04fe8c2dc7b3eed8985b5bbb9706415b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155065, "uuid": "e866df9a-6a62-45c4-bd15-825786c7470c", "value": "T1FB635BA6F800CD7DF856D77B44130A05B130B2540B921B3BB766FD93BDB20A4A866F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155065, "uuid": "c0a79125-b425-4a7b-befe-fe7b6406a71b", "value": "1536:vvqJXmi+t6MJ1vBQpR8C8fjOPiizFrr8DIvGKzZE8:vvqJX3+MeBsR8Pixr4SZE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155065, "uuid": "dea3cb8a-7f6e-4a51-b87d-ea3b85988700", "value": 72960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155065, "uuid": "f7122832-f629-464a-95f4-b49263c87ef7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155065, "uuid": "5e71e365-0c06-4310-9364-f7372de4616b", "value": "a69a55373e2130f1d98c519fa77750d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5468fe-07ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630132568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132568, "uuid": "401e411e-e48e-4038-b753-49c3362bd43a", "comment": "Malware payload (ArkeiStealer)", "value": "e4ca8bc940cac1e50f2017d19346e3c1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132568, "uuid": "53c97b93-483c-4675-8875-a52162e62367", "comment": "Malware payload (ArkeiStealer)", "value": "22d3ff4cbb97f742506b9520b3d18cd81ef29759036b3eaee94343432224547d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132568, "uuid": "2d5861a3-855f-40e2-a55e-ade6116429a8", "comment": "Malware payload (ArkeiStealer)", "value": "bf3ce26ed616f7bb363330fd6204424bf356b25a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132568, "uuid": "01cc77cd-83c9-4b99-85de-38691c967a8d", "comment": "Malware payload (ArkeiStealer)", "value": "1a6b951833078349e655d4903dff143d102c400de9a406738c6e378bf4496f407ae3baf7081a85d911c44a35d13f84d2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132568, "uuid": "7306890e-507e-4c4f-9326-d9e1ce773edc", "value": "T180D4E034AB90C035F4F712F848BA83B8B5293AB1676050CF53E516EE5734AE9AD3174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132568, "uuid": "a5458d80-f19a-44ae-b1c0-6d28d5f887fb", "value": "e68f2e15edc1c604720a74f10b8483a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132568, "uuid": "3b4523aa-5c75-44a4-90e4-e2291bca4b5f", "value": "12288:4EvC5bVrYp8lnz86/YYZKO+CKtY18TpCI0CrUC7Wglx:FqtlU1PYZKe51OsvC7Pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132568, "uuid": "0e16c4b7-6bbc-4c4c-9288-0cceffed8c05", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132568, "uuid": "b548cd23-1b59-4e9d-a7b1-726acf77c69a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132568, "uuid": "6259f76e-3c99-4d9f-804d-00ac93fefa3e", "value": "e4ca8bc940cac1e50f2017d19346e3c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb02db5e-0817-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630165963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630165963, "uuid": "46e939a6-e25f-46fb-bdd9-2df9fbe575e4", "comment": "Malware payload (AgentTesla)", "value": "76f7acc90f45654ed2eff7bb0328e127", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630165963, "uuid": "56b4b92c-4f4a-4680-852d-83c4ae2a9105", "comment": "Malware payload (AgentTesla)", "value": "22e330c7507bd1b09bdd853bacedda75eec90a4e8d903c8435f56d1aca469e49", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630165963, "uuid": "17a25a7c-042c-4ef1-b7db-548452c91af6", "comment": "Malware payload (AgentTesla)", "value": "a88325430e8c27a5abbf90e627db969682e29fdd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630165963, "uuid": "813b49a6-e251-44ed-8dd2-e5086430d052", "comment": "Malware payload (AgentTesla)", "value": "70e319bc752e053cb7fbabae5a66b0c37869bec0614f662154cdeb4580ef53c93dbcf853557f65c3561bd8a78b991c6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630165963, "uuid": "32e66f9e-7ce1-4e22-9c91-0714d14de83b", "value": "T158E41B7F19BDA2279175C6F58BE38827F0108B6F3110696476D347264322A7AB4F336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630165963, "uuid": "8aeb73fc-d8be-4e04-a982-d87efe77ad59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630165963, "uuid": "048c07ed-d7ad-457e-ad3a-5e038440e29b", "value": "12288:h0aMHYpG1Zy7iO753DqathbylbAN5fG1vGJqipdLDRzH:GaMHYpG1Zy7iO75OafyxABJJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630165963, "uuid": "ddbd114f-6b08-48df-a5b7-7e109217200d", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630165963, "uuid": "6e93ba9d-33a8-4c9b-b7fe-61c7d4bc8869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630165963, "uuid": "06f521b9-41e1-486b-92ef-0c172cd96d7d", "value": "Bank Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662e2760-07bd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1630127058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630127058, "uuid": "ebb8b6c2-eaea-4632-92e6-d88f7ba530f4", "comment": "Malware payload (QuasarRAT)", "value": "be39493dac5e473ba50f9b004003eba7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630127058, "uuid": "fdf936c7-84a7-4075-842b-16313ccea1c5", "comment": "Malware payload (QuasarRAT)", "value": "22fdaddfc72a9e1bdfca54d70170db8a82c176fd633fa3a76125961e975369f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630127058, "uuid": "ea2053ea-28bb-4f41-ad41-7dbf0c12d729", "comment": "Malware payload (QuasarRAT)", "value": "e28ed3d923a9889ffc24f74cdad607a1a1005b59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630127058, "uuid": "8f54282b-4357-46c4-b913-fb159a7047b3", "comment": "Malware payload (QuasarRAT)", "value": "c70e26cd61d5ac829aacfaaee4d12801d6d083b2bb4a6160400f726a39c604b2b5ebec2aad29f812982c2c12d29bc847", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630127058, "uuid": "345d3465-ceec-42f9-ab2a-f80b6af5da07", "value": "T1F8748D1377A8E97BD1FD177AE47206050BB0D64BBA16E38F5A5C45B92E133868D803B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630127058, "uuid": "8c4d5f06-2568-4ea6-90c4-f02499d47cad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630127058, "uuid": "582e11cd-f44b-42d8-9203-0dfc21c7534e", "value": "6144:gvNHXf500MUS+YH3V3obR5PMTj9xQ7Hc8e:Gd50lVXRoOTj9xQ7Hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630127058, "uuid": "5561f8e8-6486-419e-90c2-7db241431cb2", "value": 354816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630127058, "uuid": "03671937-2f26-40d9-8045-502a0a7fae5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630127058, "uuid": "c7044ab4-3493-489f-bd04-76411706a1b0", "value": "be39493dac5e473ba50f9b004003eba7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7446f87-0849-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630187404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187404, "uuid": "8c56175d-06f0-4449-a9e2-a95fdd879d58", "comment": "Malware payload (Mirai)", "value": "0ebc2e6265db1e49755a280a48c8c855", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187404, "uuid": "390a27d4-6bed-4b1e-8b8f-84d4c51eed3c", "comment": "Malware payload (Mirai)", "value": "231683f6e071ea71475ba3ae95e95cb343ac3a6c4d100d357d026fe4e9290c43", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187404, "uuid": "887c0332-6b9c-46ea-a904-ef39084a65e0", "comment": "Malware payload (Mirai)", "value": "4ef459eb81a3994601180497ad9f18b794caf247", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187404, "uuid": "e5423736-0f58-4771-9ff8-283dcab5c5a6", "comment": "Malware payload (Mirai)", "value": "516e43523cc09d71600ee35ef7e04ed895cfb674a7e9a19b2ef4c6dce5c515abf4e81e5f1ca9b6ab0ffeee9796707603", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187404, "uuid": "9a6d4d90-2671-431d-bcfa-8f572b4dfcba", "value": "T19D332AC596C3EAF1EC22007C346B6B719F73E57AA436D9DAD78A5832CC05506D2073AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187404, "uuid": "2731895e-9c7f-4fb5-89dc-48150585293a", "value": "768:VNGORKL2ZztJjbbCcedj9yueoE9oexAzsweaNmSgBDmwHOg+iKmmw9:VPkYtRs99eoE/xAzswDNmSqmwugf9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187404, "uuid": "8f7fe934-7794-499b-a298-38bd5bfd33fd", "value": 54404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187404, "uuid": "3b9d83f3-5585-4f1a-8204-2cccd529c73b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187404, "uuid": "108fba64-e883-4258-bf76-dadba701aee6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317c179e-082c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630174644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174644, "uuid": "f2272977-5a9a-440c-8a29-86dfb93c4547", "comment": "Malware payload (DanaBot)", "value": "e4dec87fb47a92ce0c13ab8497efcd6e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174644, "uuid": "5d3dccbd-c764-4232-8e7a-6d2c7c37b4dd", "comment": "Malware payload (DanaBot)", "value": "232ce5d4eb72606c4d4ba04852ff588cdc8274c84c9c72d9d9499f7deaae5235", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174644, "uuid": "1ee70e7f-caff-4f93-9425-b169de3812af", "comment": "Malware payload (DanaBot)", "value": "23fea611f623219de53bfbef1281c727802482de", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174644, "uuid": "63bd83c4-e1ff-4beb-96d8-6b6449d12386", "comment": "Malware payload (DanaBot)", "value": "c7e9b9908e33a0cb3ebaa8de871aff61e450a6e9877a2953b9d56c87ff02b75cb0697ecfbddf34c2929a29fadb763eb2", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174644, "uuid": "5be6d5b5-fa42-461b-bde0-6e56402d6398", "value": "T1943523457EE4C0B6F6E90A707CB2D2C75277AE216132DF17A7486ACD39B344011E8A7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174644, "uuid": "be88342f-76d5-4929-8cce-ef5f2342be59", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174644, "uuid": "211a590f-56fa-4761-b36d-64d5d7d5e44f", "value": "24576:zLgC1Zty5k33Pra5mlVrk4l6Bsfi9gE721wCc8xQuMdIFtWawpCe58EV:P/1ZQwjy+B6yfi+Ey1/bxmdFdCEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630174644, "uuid": "d16321f7-6f2b-480c-a91c-bb8d348d045a", "value": 1088891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630174644, "uuid": "641dcd3a-4221-4652-8211-4b42a3979b19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174644, "uuid": "ac3530c6-6bf9-4c9f-b09f-e7f4ca2893fc", "value": "e4dec87fb47a92ce0c13ab8497efcd6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084aad1c-083c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630181447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630181447, "uuid": "cae86934-6b44-4635-998b-5e6695066e7d", "comment": "Malware payload (RaccoonStealer)", "value": "512196f6d8f1a7b0468970b7f79d7582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630181447, "uuid": "70f0f587-cff0-466e-b6b7-9ca61a03188f", "comment": "Malware payload (RaccoonStealer)", "value": "23328ff578992e73e0b524092ad90c8b7e3cd2ba0e59194c190a58f7f362d553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630181447, "uuid": "3729478d-2833-4b12-8356-ac952fdb19dd", "comment": "Malware payload (RaccoonStealer)", "value": "f5468509219c9b6b2ca1db9efa3894ff2a68e0cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630181447, "uuid": "74415334-f69b-44a8-a1ab-93b5437d91a9", "comment": "Malware payload (RaccoonStealer)", "value": "e36c9a76a4c22dac5145da38b720a982ddc15bbc1109a22ae40cc97bb97e0fe0ed5fa172cc5292b014a6f5895f5dca4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630181447, "uuid": "6cb2176c-5050-44b7-9059-72a8048e65fa", "value": "T175A4020576F0C13BF9C609714C38E3A1663B7ED3AE24A2573B481FAE39A16D0551EAD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630181447, "uuid": "c57f319b-8c08-468b-aa75-1c23321b118b", "value": "065a584d0d50807005a7c41fcb9adea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630181447, "uuid": "32ed32b4-07df-4fde-b9df-26cfb96b030b", "value": "6144:Nlta1ptfidxJ0BlqHRaM2lO5fzgR34rZDs857gk5MlMdpnGxHwhZU9sI5/:NStfgGuRj5bwKZD757gGHYec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630181447, "uuid": "4b94f2c3-1ec5-4f77-afbf-4b4a80f4860c", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630181447, "uuid": "026bcd4e-3156-491a-a6c0-f5b9becf920b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630181447, "uuid": "bca71035-1bbb-4efb-9f01-ef3ff0221403", "value": "512196f6d8f1a7b0468970b7f79d7582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceacbf01-07ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155580, "uuid": "38dbc937-4961-40b7-b278-a28aa34e58ff", "comment": "Malware payload (Mirai)", "value": "90ad51309b1584ab3997952abc3d2bc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155580, "uuid": "34e2fdb2-91d6-45e6-b98c-f3dff3f02228", "comment": "Malware payload (Mirai)", "value": "23d3cebf2c2e5960ac1ca43868eefc4230a173c71af954453f42a9082e3a7b4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155580, "uuid": "b3b4fcf7-66cd-41bb-a741-cbd2a0551b67", "comment": "Malware payload (Mirai)", "value": "ac994d90136c792ba1d50bb57a0b487610882fb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155580, "uuid": "f32c91c1-8265-4d7d-ba19-a9eb9b87ef13", "comment": "Malware payload (Mirai)", "value": "ab6dcea304acc5a581f188e841015d61eac41a4bbf0321275794a602a4bdf161272fdf024b3d168b39603962e3db7471", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155580, "uuid": "fe2c4308-f06f-4a7d-a521-28a456a718fd", "value": "T1E8D2E1B0D208ACBBDE733AE05A10CDD563D60FA973F19EEB10D1AB13662712312975E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155580, "uuid": "5187b0ca-ac9b-4a25-81b1-13e24c4bc50f", "value": "768:y4QB6uvdQTYwOIo5YJAyFbPjaGgBnu25LJ6CL4uVcqgw09ur:0BHFM7OIPVPmGuucRL4u+qgw09Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155580, "uuid": "e2d793bc-2ecd-4712-affd-f9f644fab950", "value": 30616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155580, "uuid": "8137e730-2341-40e6-a4bb-4362cdce2d06", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155580, "uuid": "437dcbbc-525d-4018-b52a-027db372f838", "value": "90ad51309b1584ab3997952abc3d2bc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78549db-081b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630167621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167621, "uuid": "075fa5ed-acd5-4f0e-9910-aa4f94ff989d", "comment": "Malware payload (DanaBot)", "value": "4215d8a4ea5fdbd1cc249ec27a736ee9", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167621, "uuid": "9ff5a9ea-fdc6-48ee-8ff0-de7aefa21c11", "comment": "Malware payload (DanaBot)", "value": "24943c70d8dd1d81437466c413ee3145366681b7e7f4d8a5337de7a38d8188d1", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167621, "uuid": "79d586e8-ddf9-4195-9efd-17bf1328f159", "comment": "Malware payload (DanaBot)", "value": "64b398dad266acfdf462ab275d3e0fa27740f1bc", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167621, "uuid": "54c6a3a8-cf07-4c89-be4a-88a198e4c54c", "comment": "Malware payload (DanaBot)", "value": "4643f2e7b1628d2ef69eb04549e2697c03252ea8f311b17538f954c5b9db68db4322fa462b4ab70497dcdb76e39b0127", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167621, "uuid": "52557af8-9d02-44a6-8523-ecece21f6b1f", "value": "T12335233512B190B1C3D42630806F9063AE6FFD12BF6542872BD4999F3FA69C0D5AE763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167621, "uuid": "c249cdf8-0d9d-4e59-b6d3-216d163a6dcb", "value": "065a584d0d50807005a7c41fcb9adea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167621, "uuid": "f57aba5f-54ea-42c6-be5f-c2ab3ef8fc82", "value": "24576:A6ZkqB8Ot+11NKz8i2rVKyz5TYltZV9dI2qmsQsP6h:A6Ku8O2fg8i2rVKgdYX9dL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167621, "uuid": "a1ef2b7e-caa3-4115-bcdc-981cc86391a6", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167621, "uuid": "577b700b-32f0-4102-acee-d71c94036e91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167621, "uuid": "ce5aca25-6f44-4911-800d-7c0cf8ecdea9", "value": "4215d8a4ea5fdbd1cc249ec27a736ee9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c952649-0815-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630164811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164811, "uuid": "b22ca794-87ec-49d2-8218-40187ad702da", "comment": "Malware payload (Mirai)", "value": "ba6f437c91252bca9d05463d8345c6d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164811, "uuid": "6a249354-6a07-4e1b-8b38-b790a2486553", "comment": "Malware payload (Mirai)", "value": "284dcdd2bab81cc353f2f18c2b11a077f3f9801ad3b19f1ddf81694e9a32c606", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164811, "uuid": "8ece765b-b6ad-4d47-a273-3e214a1adb76", "comment": "Malware payload (Mirai)", "value": "360cc05295bbee16faeae94e7b0d1dd82a99e4b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164811, "uuid": "c870e574-e10c-4bb3-b69f-8cf26763533c", "comment": "Malware payload (Mirai)", "value": "22ff59b5831322d97638b7ad1e0e0fb9db644b222bad98b05774384f6630c37071c8e423f4bcef914dcca08e2e1cc4df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164811, "uuid": "a1923a18-f26f-402f-949e-14aeedc834c3", "value": "T173537C42B3180D5BD1636EB02A3F17D0A3AEEA8112F4B285761FEF459171E31558AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164811, "uuid": "c5cc3b6e-bb5b-4d30-a1e3-cfddf9fb785b", "value": "768:WigHLLSMR+negP8diN555W29skWDr6MwS7/PF9MtT960K/rIaJB:1mPdRuzbslP6MwSLjMRI0KznB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630164811, "uuid": "b96c6239-1cb2-4c77-8e5b-d98ffe410e86", "value": 62980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630164811, "uuid": "ff331f52-2c0b-4408-8b27-6713e8d04009", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164811, "uuid": "fb0435f2-88b0-4975-a51f-24fd6809290a", "value": "ba6f437c91252bca9d05463d8345c6d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d70dd3-0859-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630194245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194245, "uuid": "9fb26d97-aff9-422d-a0fa-7b3d36444e32", "comment": "Malware payload", "value": "1f0a89360bb9471af8b2b1136eafd65f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockerfile", "colour": "#D92C09", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194245, "uuid": "204a20f9-f989-4e69-8ca4-ee435ef75bb9", "comment": "Malware payload", "value": "2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockerfile", "colour": "#D92C09", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194245, "uuid": "e9ccfb65-c35d-4343-9384-f89508a5cf89", "comment": "Malware payload", "value": "a7bd3592ff31c5c659cda9810936ddce842d6590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockerfile", "colour": "#D92C09", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194245, "uuid": "26df37dc-ef0c-4231-8c40-b74b0e61838b", "comment": "Malware payload", "value": "67baaf7bacf864e7339029d1216be5ba96acd1c4b118b9450f24b26bccf1d6f4b180ab26446d253c08e13d0dfc1a998e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockerfile", "colour": "#D92C09", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194245, "uuid": "b73ca0d9-6a87-4ed1-a215-48c470eeafd9", "value": "T1154413C22EE84B50E67F45F245B37007E761A63AC6DEDABCD982C9A501609E60D51F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194245, "uuid": "d6a8efcc-7c94-455c-ac8c-e4d670db6378", "value": "07a0cdd4807510f9323ce2fd61059e50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194245, "uuid": "28345334-5412-4044-9312-6694432c623c", "value": "6144:bAr3VCaIjpP65V3Q400RwDym6flM5OPh2r:bAr3VCMP00RwDymd5Uh2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630194245, "uuid": "d7a46141-fae1-47c7-875d-dd91fed581c5", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630194245, "uuid": "9734d7dd-0826-4bef-ba0f-093514bcb7f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194245, "uuid": "34103e34-87e0-4f06-88ff-dde9d1a22081", "value": "2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7add166e-07d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GCleaner)", "timestamp": 1630137830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630137830, "uuid": "f463d5d9-2146-4f8f-b656-f6c13657ac35", "comment": "Malware payload (GCleaner)", "value": "4023c1f7385cee3b9fcf0b752706ddd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630137830, "uuid": "5cbf183f-3006-487c-9684-f7c28133d86f", "comment": "Malware payload (GCleaner)", "value": "2c8e4b47e652f619060f7c73b37f9983d88c41c18145efa7535fee067314daf0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630137830, "uuid": "87ef144e-c9b2-4b86-b131-e961a4808248", "comment": "Malware payload (GCleaner)", "value": "0ca07df385211b3a67156563ad9d77e63bfcc634", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630137830, "uuid": "421a901c-8d83-4b33-b4aa-4d55f8cf1d72", "comment": "Malware payload (GCleaner)", "value": "6ed9612812f002b87c06ef91776486a93a173df94b14ff0001d32fdd2c12c3bda03a052d0dbb709298b42c45034b933c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630137830, "uuid": "63f50888-d506-4068-98d6-dcdd1a982294", "value": "T1F324D01136B18273C4D7297449F9E761676BBE226BB5C2873B09176B3E332D0463E287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630137830, "uuid": "e39f893b-4a78-4e80-98e6-45e4c2ef766e", "value": "d58ad3fff7de7656678e7a59274fcc7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630137830, "uuid": "2d1f0c09-450b-4a7f-a155-5ed7e58dc659", "value": "3072:+jHsmbja0G6SOP1U64JkQGytWeBlXRsel9Dgz5WGG1V0sI5/DuT61m:YHsmbi6t1U6QkQvheODjZgsI5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630137830, "uuid": "00e75798-1400-425a-b413-5fff2950a8f8", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630137830, "uuid": "e399dafa-495b-4751-b94a-8096cef58607", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630137830, "uuid": "adc01d99-047e-4ddb-8b0d-85b9c46dc086", "value": "4023c1f7385cee3b9fcf0b752706ddd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881ae024-0841-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630183809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183809, "uuid": "046c2b14-327f-4430-8e20-fc81c537e390", "comment": "Malware payload", "value": "e98b3794fa269372753430c6f3c98cfa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183809, "uuid": "7403d725-1d61-40db-850f-472ac07ab65c", "comment": "Malware payload", "value": "2c904c42321ea2faeba24bba3e8139bd2be61f19578da90f705689370024700e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183809, "uuid": "94d0a2fa-b229-4c86-9c40-1d8986d52ec8", "comment": "Malware payload", "value": "b12bd8d92fde106f6418d178c29536ccf41a2ce6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183809, "uuid": "4e4d81b8-c13f-42d3-9ee2-272be06c19a0", "comment": "Malware payload", "value": "38d717bb0ebef22301c3cca3d282d6eda81b960c19217f9f09bcb610f939e548a83293f1a7fb92dd38dfa2b8fea84a2a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183809, "uuid": "d3d992c9-69ef-4126-966e-07d0a2ffaa69", "value": "T1AD33E8527DC26A2AC2E0137AF96E81CE332067E8D1DF7257CC211B0476DA55F0DA3B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183809, "uuid": "5ff12430-f035-4bb9-a090-59bf2c73d3bc", "value": "1536:hCqZI1iDUguHppKKOxgPg6osAvH3Y0qWZoh+fgh8U:XZeAPDqWmhA3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630183809, "uuid": "09d908b5-8fd8-4c09-81ee-50b07952d430", "value": 52144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630183809, "uuid": "12713b12-5e19-4732-91c8-c1295887b148", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183809, "uuid": "ad828d1a-655b-4f77-88c2-57bf4b8663de", "value": "vcimanagement.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794084ec-084d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630188938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188938, "uuid": "37586992-a570-4323-9832-078b26ba0ea5", "comment": "Malware payload (RedLineStealer)", "value": "25b01b6f282806ad99486c3d072e5bfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188938, "uuid": "c61fdc09-1340-4982-b60e-773ef97b54ac", "comment": "Malware payload (RedLineStealer)", "value": "2cc5f31570047becc5e77581e2f640afba8d6904c6be61105603d60d01c181d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188938, "uuid": "6abd27a1-7ab9-4d36-b9b0-e6c7cb24d0cd", "comment": "Malware payload (RedLineStealer)", "value": "c2ab46c1a27ecf22dcf17cffca96ae2ff56db740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188938, "uuid": "6aec83f9-5b6a-4b26-bbdb-d9d1b4a90f9c", "comment": "Malware payload (RedLineStealer)", "value": "ff91442b356cddb580bfb5ac7f5b74d44f957ebf29f587422a047a83871127fab9c2eeb1c136c3dfc55a26feef4e39ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188938, "uuid": "5a208cf9-b241-428f-9e48-0f2a3b64cbfa", "value": "T136A63311BA40B5B1D1B23D33057A6F992A7C6D2186E546AFF3E00B22CF72C52E336567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188938, "uuid": "b7733fc7-af1e-4d2f-92fb-1c1211143d0e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188938, "uuid": "4c8456d5-cd73-4187-ad1a-6c4a3d3dcccd", "value": "196608:PvlQF2xHG9mT5kszFw1d4zZkxaZzDaC0b8LP3gt8lKKVURWw/RNKE5N:3l02g9E5kszq4zZqwzD30biPwIK144RT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630188938, "uuid": "25049bb5-40d7-44d7-bec9-d178875343f4", "value": 9498874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630188938, "uuid": "da350670-6d49-41fd-a49d-73573257a342", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188938, "uuid": "fb25b015-9cdf-4ba8-805e-f1402a969710", "value": "25B01B6F282806AD99486C3D072E5BFD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f303ba6-0840-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630183257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183257, "uuid": "3fcc4c1b-7acb-4196-85ce-f542167896bb", "comment": "Malware payload (BitRAT)", "value": "0fad47023f69958fd54f40e582933add", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183257, "uuid": "95e260bb-6046-401c-9eac-28e40efef7e1", "comment": "Malware payload (BitRAT)", "value": "2d98f4728313ef6cdac362a783e933f8f9157bc1afda15aa9b27a5dc23c65cdd", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183257, "uuid": "18c0fabf-cb95-4916-a2cb-399149ebad0d", "comment": "Malware payload (BitRAT)", "value": "a24cc865b92d2e2502da209a3967bef0809882c6", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183257, "uuid": "adf04942-71de-4b4d-904a-b0bf7c851028", "comment": "Malware payload (BitRAT)", "value": "7952398bcfa40970ed9e30c0ff5c302949fad8b00ea20cb0d4755e13e0afc28881ea5d58ed91f23d68657205b9709746", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183257, "uuid": "16b78d9d-882c-4008-a078-47eba6919328", "value": "T15804BF0076B0C57BF9D51570446BEB902A3BF9F39A38418B364417AF3E316D0962EAE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183257, "uuid": "daa29df8-b6ca-4688-a2ea-9bd968d2bf01", "value": "065a584d0d50807005a7c41fcb9adea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183257, "uuid": "830cecf8-8387-4a03-9362-9e598b0f7ad7", "value": "3072:WuA2fuH9S+yZD1jan5EnCOnHwhZoWC9sI5/DuT61m:XF69VyZxBnCOnHwhZU9sI5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630183257, "uuid": "04b270dc-e9e3-43a8-9435-1c344e993f4b", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630183257, "uuid": "8f5ee0d3-9d9b-405e-b8af-a284d6bf05d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183257, "uuid": "9975e0ed-e28d-4ed0-b2f1-b93301842553", "value": "0fad47023f69958fd54f40e582933add.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4d7609-0814-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630164279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164279, "uuid": "a805cc89-59ab-449e-9e90-1edd5b07cfbd", "comment": "Malware payload (Mirai)", "value": "804770de9f85ae756f2a199dd34536b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164279, "uuid": "94af96c5-b222-4120-b227-26107e9fe437", "comment": "Malware payload (Mirai)", "value": "2e92997646f4d1ca7bcdfe7fdc17ce76731a77cd8d9169c0616cb96eae4cfe2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164279, "uuid": "c00d49ef-9d08-4268-88d7-2117d8e087c8", "comment": "Malware payload (Mirai)", "value": "b8793042b515061a22b76d0e667c5d8f7a176a41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164279, "uuid": "72778025-af58-4b4b-8b6a-48b504180db6", "comment": "Malware payload (Mirai)", "value": "3a75393704ddedecfc47a684b1c388afc27caf7af9263a6fa6361e9572b0e77014ed4a02fa6c670b1a0fab4550941c73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164279, "uuid": "b238f954-acd7-4b56-91c1-fc272f1efc73", "value": "T1D173E74AEF605EBBD8AFCD73566A070238CC550A22A837797534D42CB65F14B85E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164279, "uuid": "904ed831-21a0-4239-b4e1-953dfc960655", "value": "1536:1O7Xdom0I5Y1QbhYKxO2Xf81ZANK01QNZWKM:1O7NomvKGf81AG9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630164279, "uuid": "b27cc004-94ac-42fe-a3bf-23dcfaf057b6", "value": 80572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630164279, "uuid": "54f99149-65a1-4ce3-942b-757d9e310e79", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164279, "uuid": "8b842c2a-ab1a-4185-b7af-2e506fa305c0", "value": "804770de9f85ae756f2a199dd34536b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7c3d3b-0843-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630184485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184485, "uuid": "20f11b6d-7a79-4593-b5b6-f3290746d66a", "comment": "Malware payload (Mirai)", "value": "553d84522316358951107084a5a8d986", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184485, "uuid": "ab69c2dc-b88e-4d55-a04d-7f85e4d93827", "comment": "Malware payload (Mirai)", "value": "2eb0ec28d92a1dd43f6a6994e703cf3cecde60bae0e72e33e88d66b89d53a36c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184485, "uuid": "01c71d3f-d5dd-4b4b-9585-c292ea8a2474", "comment": "Malware payload (Mirai)", "value": "6e165bd172c370cc6d5719a532b51c5795a8b5e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184485, "uuid": "68dd7c53-502b-4f7b-b871-b3fb28fc69fc", "comment": "Malware payload (Mirai)", "value": "94017f0d2f23b7f7218ef32bd0ba10e5edf8be7d9cfd68d5a9d53fd6ec971780de84d39b7b9187654f9bcdcd7526d142", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184485, "uuid": "ee55b17f-c5b5-4c08-a007-b272c4810cc4", "value": "T10563079678C19A12C6E423BBF96E01CD332563A8D2DF321B9D212F5477CA82F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184485, "uuid": "ab0c4b88-e84b-47da-8961-5596faea47c7", "value": "1536:U69Uvb15Wu1S7+hIVt5f6pxCCpRT8PBOcahWMUXH4g5b9/e35uEfh:U6ex9RIBOvhTNgm3nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630184485, "uuid": "6095fe71-3422-4004-a6cb-2b87422a0b94", "value": 72188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630184485, "uuid": "34d8e68d-4bf4-4e09-92da-2b9b5d62b182", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184485, "uuid": "91eb3082-5fc0-482b-8557-eabb1f9db16b", "value": "553d84522316358951107084a5a8d986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1734dbe4-0843-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630184478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184478, "uuid": "8522e364-10ec-4e49-b94e-facc8fcc4b78", "comment": "Malware payload (Mirai)", "value": "645562b1122bc4e62bc4c7d4c96289cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184478, "uuid": "3789fb56-6b7e-4323-ac18-e4d1f4839265", "comment": "Malware payload (Mirai)", "value": "2ec577ae9c9881368b984d2578c5609a68f1b29e3c44e48bd6aaa20d7219a8ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184478, "uuid": "f5ba7d9d-80d9-4cf7-8b04-04e45ebf22f0", "comment": "Malware payload (Mirai)", "value": "9442d0cfe3818bc152d30c40f1201bf927e2b235", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184478, "uuid": "88a1dcc9-8e08-4949-8f35-32200b67ebc1", "comment": "Malware payload (Mirai)", "value": "8923f6725c3c4c31f8e71635662dea595b0494fc164755d9b3dfc7a85e4935ea87776229d42d6f3a49a7a015f49f5ed5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184478, "uuid": "04b9b592-1bf3-4058-ac3d-0cfa4a9eb3f0", "value": "T19C53AEB6C819BD94C4008334B422DEB81B53F40496671EB98E8789955487EFCF61E3FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184478, "uuid": "b1206704-f108-4dc7-93f2-0bfebdaa7bd0", "value": "1536:Oa8tF/MUQ75ifwt1ARhAWJx/Naz/TlHmrmCwM:OXttMUQ75Q3zCTlmrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630184478, "uuid": "5b3890d4-9a0c-48ff-a790-a591db5a07ec", "value": 63884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630184478, "uuid": "7cbda87b-b476-4291-b6cf-59799b6cb6ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184478, "uuid": "d41eee04-b6c2-41ca-a4cd-b0b745de0c09", "value": "645562b1122bc4e62bc4c7d4c96289cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2352cf-084b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FickerStealer)", "timestamp": 1630188057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188057, "uuid": "18effc97-9b2b-48e5-a0ba-35c1b4fa3ff6", "comment": "Malware payload (FickerStealer)", "value": "2a454ebe8ba40a5ea033f91307862f80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188057, "uuid": "1e8bb012-445f-40bd-a68a-3c18000012af", "comment": "Malware payload (FickerStealer)", "value": "2fbe9b55c293c3428a9cdf476ef094e1235e27cab28055aca0c5258840b03c4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188057, "uuid": "7329d009-0746-44c8-8901-4c733962923e", "comment": "Malware payload (FickerStealer)", "value": "cc7f9ea6db6a44293bdd53dab6e032d2f8c0e742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188057, "uuid": "c2d2ac35-f8ee-4ce3-800b-f6342a9a717d", "comment": "Malware payload (FickerStealer)", "value": "e6417668b1cfb44ff950cc642d9daa53a5ba1eb2d3711e1f6c31427ac65bc3180c145c2ef5ea4881c218c454bfdade43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188057, "uuid": "b8bf138d-145e-4f42-a76a-89cf5b6b7531", "value": "T1D9B48E3055F45C25FA9322FC45AB936AA73E7EA05B32C3C742B665F58B135D6E830382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188057, "uuid": "d6e3da1a-bf87-4a48-bd23-255a1b520ee0", "value": "61341387e3ce2ad06f049c03ebf5f67d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188057, "uuid": "f2c727cc-3a88-428f-ba3a-24572134d0f1", "value": "12288:andJLz2MxPWVMuySre8OL7TLpdk1EW0rF3:uLz2MVKeTLNdWy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630188057, "uuid": "69ee3779-df11-4404-ae5d-9e4e323004d1", "value": 519499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630188057, "uuid": "bbc12405-2eaf-48b6-89b4-9354e2859d44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188057, "uuid": "88a71dfa-f8e5-4202-9041-9b42e90ed71e", "value": "2A454EBE8BA40A5EA033F91307862F80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae52b0e-07f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630152004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152004, "uuid": "bf0d2562-e24e-4846-86cf-82139b286e0a", "comment": "Malware payload (Mirai)", "value": "f9cdb4b63bd55332f373eac9a5ce5f4d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152004, "uuid": "1fb22028-6e06-41eb-b3bd-a6cf33f0105d", "comment": "Malware payload (Mirai)", "value": "302cb12e0292defcd35533f3d79be8686f9515c92a0194abc86a679af6b3ed34", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152004, "uuid": "7ea3278c-4cd2-403f-ad76-ed08dbe1c505", "comment": "Malware payload (Mirai)", "value": "2919e731396e4f495d65a8d19a87ed48cad9716e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152004, "uuid": "43a93162-a07d-463a-8d98-6caa087ef516", "comment": "Malware payload (Mirai)", "value": "24b6f95a8db8f6b700f228e1728a9f83bed3f88f3885c86b9015afcf6f6cb4ba69908520195b86bd417894a9e374dc48", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152004, "uuid": "1b4bd6c0-ca9c-4db9-acb7-1c59e06816ca", "value": "T1CBE2F15EE5628FC6E235107908DE7E8C0D4865ADB221DF73CDC84531189A7AC3A3EBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152004, "uuid": "4d8241c0-c245-4ab0-b21d-bda605483bca", "value": "768:TVCXSxOPOcxIr0HxpJCMV4Rnq0Pj77dPpbPgRajdnbcuyD7UGQRjk:TVCXRP5xnRpw+4Rnq0PjdPKQnouy8GyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630152004, "uuid": "f41a83d4-c0bf-4c5d-ac2b-1fa2dd0dbc13", "value": 33064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630152004, "uuid": "fe78d411-07e3-4b74-85f0-305d68c43e84", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152004, "uuid": "97c64afd-a1fa-48ba-85f1-ef29422e33b6", "value": "dark.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92644330-07fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155050, "uuid": "2dc3ea50-b4b9-48f9-ad67-8f230167f8bd", "comment": "Malware payload (Mirai)", "value": "b5cd8161e0eb095f207f856bead8b512", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155050, "uuid": "92d9592c-5c61-47cf-bf3d-e4377e60bda1", "comment": "Malware payload (Mirai)", "value": "305e1aafd5a0a2d20c4ee5fa2aceb8b28eea496916e29a86610e92358b85ef1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155050, "uuid": "132518d1-12c5-42ab-b990-3ac2b8cbecaf", "comment": "Malware payload (Mirai)", "value": "515962497a7660d9afda882dfe296ca564d74753", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155050, "uuid": "bbb649cc-cf9f-450f-acfb-a8b6a1fbacc5", "comment": "Malware payload (Mirai)", "value": "483665a56c3b84fe356b748c59d434c3db2dbc66a193f6fd491151fe575cef6bbbda3380160441184ef390accf03cca4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155050, "uuid": "b79051b4-6f4e-4001-b6f3-0e442ad8df1e", "value": "T1EFD2D0EFE0A52083C6ECAC39055E17ED88A4F2D173D99BEC32135CC55B5DA922C49B2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155050, "uuid": "e3e2e444-4416-48a6-a173-227a2fa1a859", "value": "768:H9Jd9zCnnaNq4pgFw+0iOXITr6p0SATSMJVTWf:H9JdmOqwgFJOXP7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155050, "uuid": "e297cf00-d523-4f4e-86f3-d80961f51768", "value": 29608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155050, "uuid": "a1867af4-c0bd-450c-a2c4-68f6d6dbbe74", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155050, "uuid": "c09ef38a-8177-4641-8a5e-2e1a07d786a9", "value": "b5cd8161e0eb095f207f856bead8b512", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f754425-07ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155313, "uuid": "2d65ae8c-5a0e-4e3a-84f6-7e17b8f3cdf0", "comment": "Malware payload (Mirai)", "value": "b08891390b31b3faf2462fea41770eb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155313, "uuid": "6a6e2cc9-d157-4602-84ad-3e58bcd72440", "comment": "Malware payload (Mirai)", "value": "30c2841a9c0df7938a84b97a818a01fc35c11695bb7f5b9719a7bada5ed9c081", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155313, "uuid": "e440f46b-ef70-4af2-a492-e3b4b89c6efd", "comment": "Malware payload (Mirai)", "value": "0b78e014940c76cd9a91e6f4c0d933d605c8e346", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155313, "uuid": "14c883b1-ce8b-4127-93ba-26de1518a01d", "comment": "Malware payload (Mirai)", "value": "ab27fab809d3d7473cb671374eab2a1bd0826739a3c934ab56dff3f9562e22c0423997fb8578f2ea571a9d0121f0f2c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155313, "uuid": "b8aabb86-f380-437c-8ea9-aa2b329447fd", "value": "T199E2F1DCFF0848CED1A8F1B956E157644F248B756403EC08BCEAB9D2556636833227EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155313, "uuid": "f003e9f1-e6c7-48dd-abc9-c5d392ecb364", "value": "768:Xgc55Pi1VArVRMcupUynh32xj59S0d3UCINGZtiqJgGlzDpbuR1J1:Xgc3kEicuiuhKjfS0d/ziOVJun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155313, "uuid": "92467139-0107-4344-9904-1f81b517b5d1", "value": 33372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155313, "uuid": "df47ea1e-79ff-4740-a353-3596f60241aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155313, "uuid": "c93cce51-d28c-43cc-8f12-380c63319591", "value": "b08891390b31b3faf2462fea41770eb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e06bfec-07fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155042, "uuid": "45bcf2b6-8f99-4cfe-a1da-b176c456293b", "comment": "Malware payload (Mirai)", "value": "241eeae9a24dc98ef4c91e10bbe52fab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155042, "uuid": "6fc8f0d9-be6a-4219-8da2-32c2566e5b61", "comment": "Malware payload (Mirai)", "value": "313190bea894e2ea3ecdd2748a9a8d268bc9f2cf3e6cb88c1b0046ec36f5c36d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155042, "uuid": "ca01525f-7964-44a8-944c-0dfd429bdf0d", "comment": "Malware payload (Mirai)", "value": "13d3772b7982b68b3988a0329e7e78db3cae25be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155042, "uuid": "cb2fc1ae-78ae-48f1-8eb6-3dd134418b87", "comment": "Malware payload (Mirai)", "value": "a721da8312477c849dae7cc23ff9bdc8e93e17644d650418547dd59323a03cf07e5834e132b2db4047027112ea28eae9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155042, "uuid": "d3344cd5-4f34-4f73-bbda-06e08a35b622", "value": "T18EE2E136D066B76187B46CF2E7F12DA73F151DBAD0473164A1A8C93CA0B1A0F86AA542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155042, "uuid": "e53e23c2-7539-4746-906d-804575b82c69", "value": "768:heHlHk29rbDTcTJQsr7FsZypqIws2qYZXm9q3UELCa:heFHzVfgTW8JsZiwsoL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155042, "uuid": "77c51955-fb63-4d5e-815c-b1e77aa22d87", "value": 32188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155042, "uuid": "df11c5a0-2b6b-4cef-bf28-1fccf7690c01", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155042, "uuid": "b2baffd0-5929-43b0-a3da-0742e27a7e17", "value": "241eeae9a24dc98ef4c91e10bbe52fab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6425b5-0859-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630194174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194174, "uuid": "6b2ce9da-9eea-4f34-b7a3-ba81cd8c6567", "comment": "Malware payload", "value": "df30d67f1edd66174a5e760255be934d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockFile", "colour": "#30EEF9", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194174, "uuid": "d4484e83-fc2e-495b-8640-aa3d8216f03e", "comment": "Malware payload", "value": "3303a19789a73fa70a107f8e35a4ce10bb4f6a69ac041a1947481ed8ae99a11c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockFile", "colour": "#30EEF9", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194174, "uuid": "ebaab021-3830-474f-acfc-c29e8a3520c1", "comment": "Malware payload", "value": "59d231b42bcc78d58e5da34fadab7949ac7e0594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockFile", "colour": "#30EEF9", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194174, "uuid": "a9e007b8-3f74-4569-b3f2-83b86cedb57f", "comment": "Malware payload", "value": "b266add7bc6960705e4356f9a8f476312932377a92ffb4c18341d5e9303124d42fdd48ee1a5192f76c32557e4468ec49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockFile", "colour": "#30EEF9", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194174, "uuid": "ede4fd8d-b4ba-4617-860b-8066b6716055", "value": "T101057D5A62A813F4E07BC0398942410AF7B27C9587A09BDB12A0276F5F73AE55F3F750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194174, "uuid": "550e53dc-7d1e-44d2-9d39-f12926e4af55", "value": "7d86c3ecee5df750bec35c27721879ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194174, "uuid": "45b4cf9b-a9ae-4df6-aa8d-6a6a3d659aef", "value": "12288:CwTjz4QwaGdWYgeWYg955/155/ybxq1yg4bP0Xrh57rXoMkZGs:CwHcQwBPxq1KbSh57rXhkMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630194174, "uuid": "be53dd7d-b828-4729-99d8-64155360e0bf", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630194174, "uuid": "48a9f1d9-71a5-455a-aac8-8b15214ebfbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194174, "uuid": "1fb4c1e3-b7df-41c0-b6b1-ceef13977c85", "value": "3303a19789a73fa70a107f8e35a4ce10bb4f6a69ac041a1947481ed8ae99a11c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8968c15-0849-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630187406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187406, "uuid": "4a0ce3d8-7cdd-4164-844c-4ab58e544a72", "comment": "Malware payload (Mirai)", "value": "551f533a0bcaaab15fe72e86de30d0a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187406, "uuid": "36a8f205-dbf2-43e4-a464-0d0e3254284f", "comment": "Malware payload (Mirai)", "value": "333f82ee9c681b229854641ec083da8ed17738f60796c52f67b989b6bf9644e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187406, "uuid": "d79a3a04-2edd-41d7-a4de-7b51d8d00409", "comment": "Malware payload (Mirai)", "value": "3b445ef45f4f8238116859fe8d508837163a9646", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187406, "uuid": "1be9fb5c-b51f-4f0b-bca5-e0073844ae19", "comment": "Malware payload (Mirai)", "value": "539eafd25658590200653436f6b8578e59d1db4a2f414cb3210948e0e3eeaa85624e3e19923a33bed4bc940bf1144ce9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187406, "uuid": "e8eb7d8a-868b-441f-98f2-4d95dc6d257f", "value": "T165732AC5B840AB12C7C14577FF5F028D371A5398E2EA33039D296FA5378B95A0E3B649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187406, "uuid": "791ed691-45e0-480d-b280-467593e58a4e", "value": "1536:4BVyHWPGswBBf0Jky5crVzXILjOf+UDcI0GTvgN:P2Tw9ZrBInU1tgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187406, "uuid": "233c15aa-bec1-48e1-bfca-20cc20fa7235", "value": 76912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187406, "uuid": "86e7a3f9-869e-4578-bc5e-242edc339aaa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187406, "uuid": "9fa1e63b-e173-4188-af7d-23fbc48b3b26", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d398e9b7-07ed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1630147858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147858, "uuid": "aeaedf99-184e-45c1-9897-2c7d1fb9dee1", "comment": "Malware payload (Hydra)", "value": "fbce0fa1e53ef16d6ee54dab524dc638", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147858, "uuid": "3be58757-c35a-4805-8db9-42bc1742ff67", "comment": "Malware payload (Hydra)", "value": "340bfbd674dd9389b4c7148cf5ee004f641d0dc94753e1fe66acc98cd9ae525b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147858, "uuid": "91c41ed5-28d2-4e8d-8b97-3cc3ec582bee", "comment": "Malware payload (Hydra)", "value": "cc8f2b3fd8cb8bc3f8162f76aada315cf04af25e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147858, "uuid": "f7d9c95a-4854-4263-ad19-43a08627b765", "comment": "Malware payload (Hydra)", "value": "fad64fa0058d211462614abb52ba57617ec437ff8a77dac7aa1838f6889a46555a4b425149b199d23cfec2f2fb67d9c9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630147858, "uuid": "75b040fc-61ea-4651-8487-8bae70ac3e5f", "value": "T156B53385BE69C75DF61B98B3556744E6202D07103A85F46F2832EF8C14E6D326F23EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630147858, "uuid": "f4a93927-f238-442a-a796-aaa6cfaf187f", "value": "49152:amikfiYdl5iD4PcZjyzW+fxN4msHghLVLuiG2E50Z1dtXvauye3Z9ISZ+4gUNOaY:agi45MqFW+fQmhfLuiG2EyfrXvQe3pyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630147858, "uuid": "01957587-7f81-42fc-848a-6ef63902802b", "value": 2454129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630147858, "uuid": "161def39-158f-467d-8db7-1031dd37d300", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630147858, "uuid": "9d12b482-9159-45ee-a01a-f9bca4ed1699", "value": "39816_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e671aab7-0849-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630187403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187403, "uuid": "a0287dad-8b8b-4702-a5fa-b1e3e72be54a", "comment": "Malware payload (Mirai)", "value": "81bcbd734b625a7fd481b6737e845bae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187403, "uuid": "2eb22f80-0a6f-4671-918e-20fe2caccc90", "comment": "Malware payload (Mirai)", "value": "348a7dbe1b7599f08fb0be4052bac5827b31713356ca87e73ea5e4109159a15a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187403, "uuid": "458c8d39-2ab8-4262-ab07-8de260875b34", "comment": "Malware payload (Mirai)", "value": "abc08b4b4b47787853483276f1a4042badc3ef76", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187403, "uuid": "5bc4ae9b-4dee-41e7-9947-84a467beb061", "comment": "Malware payload (Mirai)", "value": "41a7483f261c5dbaf7bc1c49032424ef0014f85a31e850d464c4b70cab6fc6b91d5904fa62723bed13ee62a24747fa36", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187403, "uuid": "e0866e0c-2597-4fd4-84e8-cf04ee3adedb", "value": "T1C1F31A46E640DB13C5D22B76FBDF424533239B64E39B33065928ABF43F87B9A0E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187403, "uuid": "4a6afcc2-7d5b-4006-bf41-7bc226eef321", "value": "3072:pgr50T4fWX9Uj0kgjUYZlwCT/bsNumaWGCaiEngWGLqcKM/91S3pvmnwjnDPsxq:y50T4fWX9Uj1alwCT/bYu1WGCaVRGLq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187403, "uuid": "2dd71cd2-30e9-4b50-96d2-2ba5ce78b203", "value": 161894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187403, "uuid": "34db6836-9871-4521-9579-479d9af18edd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187403, "uuid": "ea4e56e5-049f-4c1b-b61e-32081f24554f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4019ad-07c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630129486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129486, "uuid": "1363beb8-9fe5-40c5-bcb3-5b75d520c4f2", "comment": "Malware payload (Mirai)", "value": "485a77649e9bb055bbbf22feb067b366", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129486, "uuid": "fca47789-87e6-459e-9ea9-b1494a2a1836", "comment": "Malware payload (Mirai)", "value": "348e51f4f69946a1c8efcb6fe4e8349add825bf7d8de8d3c2816d734c8f201e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129486, "uuid": "8c922e82-3bc3-46ba-bbf3-0366d78b0f91", "comment": "Malware payload (Mirai)", "value": "d011ca8080b0eedb6f38bd9618b8be33fdf2f688", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129486, "uuid": "9ba3eb19-0895-4c7b-9d4a-e6de83aa7f1f", "comment": "Malware payload (Mirai)", "value": "33f3c54a9adb566b149d2d9a40127e2dd5138034523a47b9c51a39801c29a186a4ce9f7e2a164fff99e89a1fb0a19722", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129486, "uuid": "6d25efcb-0690-4b54-ac1f-1d732892380b", "value": "T1BC935AD6F8016E2DF88ED1B6811E0E0AAD3563805F530F27B6A7FDA76C72095BD12D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129486, "uuid": "d33567fa-776c-4e74-bc9d-47e38fef2bce", "value": "1536:1JEgaa/ve4N2W/z1IH/9uwwgMu9BpoDG5r59l59K8Wc8CKmYSL9:1OZW/Ja/9uwwgMu9BpAiVvKpwL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630129486, "uuid": "b835c156-6ca0-4e63-8b57-95b4e7a05358", "value": 90468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630129486, "uuid": "7420a8c0-1e92-49e6-ba81-aa10054d92ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129486, "uuid": "c21628e2-b559-436a-9dc4-44f5e1b435b7", "value": "485a77649e9bb055bbbf22feb067b366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cabe77-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630167880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167880, "uuid": "c3fc0cfd-8eaf-4bf4-8b1c-789d54f10273", "comment": "Malware payload (Smoke Loader)", "value": "0363b5c6d14da9ef30dc642674650ec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167880, "uuid": "87a3314f-4bce-4e08-b0fe-715c508eb92e", "comment": "Malware payload (Smoke Loader)", "value": "35c750d5bffbfed577e48314537823a3cf9a224883966219f8f50d088e2d5b2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167880, "uuid": "26ebf5fd-468a-4059-ae55-6ad85970fa71", "comment": "Malware payload (Smoke Loader)", "value": "1a7e8934ab44932403dfe93782e2fc7e0aaa4c0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167880, "uuid": "c29731aa-aaa5-4066-a6de-3be2b1a01587", "comment": "Malware payload (Smoke Loader)", "value": "2e50e3c49ac2989b2e92b18f561c9c933cb86f770509a3ed046a0fc52bc32b30e011467f97577213c687670151b64730", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167880, "uuid": "5bd3481b-2441-44b7-b451-ba4bdbd2b03e", "value": "T1E2E3BF1533B4C973D1C279708858D7A12A3BFD326B7589873B4857AA3F616C1863E393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167880, "uuid": "612b93df-2353-4219-b26f-b3fa9127bb79", "value": "d3c9c233147536fd2cb825c3f3ce75bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167880, "uuid": "8ed6c1ba-9480-4a1c-b196-89df467d8cec", "value": "1536:3qyjkp5eEkWHpDfokIh2rVZyVhjJMxwbvB50cJw9Jdsjk5/Npj6T61mD:3cfok0OZyrlvB50cJw9sI5/DuT61m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167880, "uuid": "329a4a3f-486e-4109-ab59-e11952397a61", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167880, "uuid": "247e36f6-9200-440d-8316-91ab35213e64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167880, "uuid": "43f75b23-1867-48d7-938d-af53d084a454", "value": "0363b5c6d14da9ef30dc642674650ec9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbff6fd-0811-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630163226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163226, "uuid": "1ad1da5d-248c-4b36-83e4-f7fc668ab5f2", "comment": "Malware payload (Formbook)", "value": "c04916af4554b23f0abfcf6493196cb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163226, "uuid": "6706ca0a-7aa5-460a-9073-7b36799e211c", "comment": "Malware payload (Formbook)", "value": "361b0f41c92e2156b12838e48d3180831f211f605dc68d46532ee49eaa4a0638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163226, "uuid": "8ed84aff-a95a-4faa-b155-5f95575902cc", "comment": "Malware payload (Formbook)", "value": "41517711cafb6ce66094d8ac0ffdad446a341ddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163226, "uuid": "6a790a0b-a32e-46ed-964b-3cfac9729501", "comment": "Malware payload (Formbook)", "value": "92aa04648f4d7d37f5b7562b25ce86814e9cc4de7e53135c0739aec6f8b4868a3fb19e59f56bff6ab077595ccf88f21b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630163226, "uuid": "5ed47aae-3b7a-4997-8364-deb285b2ee8f", "value": "T14CF41C7F19BDA2278175C6F58BE38827F0108B6F3110696476D347264326A7AB4F336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630163226, "uuid": "cc8d3f9c-9c4b-4d45-9782-e8c7176abce7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630163226, "uuid": "1c2cc078-16a6-437c-b13e-85f5191ab468", "value": "12288:NaEKWh9psVhUNVkjHzJQinwmZKfKDKh1yWiKscCbE:0YFwzwiKfKIyWfCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630163226, "uuid": "53c68ced-55a9-49e4-980e-db2952c92a4d", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630163226, "uuid": "2bf4a36b-addd-4d66-ae88-e395436c34f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630163226, "uuid": "83f0bdbd-6d9a-4441-9df8-7582a0f7ff60", "value": "Pirkimo u\u017esakymas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850eb279-07f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630152021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152021, "uuid": "cd4ef5fe-fbbd-4196-a7e8-cc50a3735bef", "comment": "Malware payload (CobaltStrike)", "value": "a8b769daba2ce07104de3b304ffffcb6", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152021, "uuid": "adbaa232-6bdd-49de-a1b9-c08b8c9853a8", "comment": "Malware payload (CobaltStrike)", "value": "386905021498147779b0a632c682bd707fd05e1074407e5a8ff879a2274b9cfb", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152021, "uuid": "a94d2186-7c73-4597-8c74-053d790010c0", "comment": "Malware payload (CobaltStrike)", "value": "44b142fb3cdd7b06e0a4c684ea19a170d389312f", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152021, "uuid": "8f07bd69-4304-474c-b430-dd4075b21be9", "comment": "Malware payload (CobaltStrike)", "value": "24ff419b0b5015a6626d08fe67ebc17d936bc03d655aea828653242708e867bb8813620d5cd4b55394a939853152abd5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152021, "uuid": "57d04b8a-4bd9-42c4-ab4a-dfc929a77d3d", "value": "T19B857E42FDDB64B2E552623208B7A2EF2334B50A1735DEC3DA04AF7BAC275A11D32355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152021, "uuid": "14eea77c-50e9-404e-8235-70becddcecf4", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152021, "uuid": "4618d050-a9f0-473a-9a3a-7b2b60ff56df", "value": "24576:c94LBP2CcUqdzLiC2AXooy10kbilDVDf6xOXRK4CfczYD1pePlYrq9Fehew/NYoQ:c9waxXVzDfVkmYD1EdlFm/WoVZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630152021, "uuid": "8a280c62-2f41-4eb6-a9a6-2b363523cfaa", "value": 1804800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630152021, "uuid": "e5c5aa73-b593-4650-bf94-67fb5212f8a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152021, "uuid": "4688e205-9dcf-4757-95e6-180d1be047a0", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8946f2f-0849-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630187406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187406, "uuid": "d4870392-697c-4890-b7f9-a6bb53f6ccac", "comment": "Malware payload", "value": "e80237ce3852102bc9725b02789ee742", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187406, "uuid": "ee29e82d-efb6-4646-a0f7-7783d29a77ac", "comment": "Malware payload", "value": "39fe966d4741ade24fd737dab3165e82c09e2a0d0ef633870fb5e8b73047fa8c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187406, "uuid": "123e0a62-bb2a-4b87-bbb0-f4fa0dc65817", "comment": "Malware payload", "value": "aa4a3d62db5b46a1a28bab62d7144c2c627b8538", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187406, "uuid": "e83b9a09-4460-48c6-a045-2b503244e7bb", "comment": "Malware payload", "value": "5009ed4b18861be50442fb954a6be5ad367cadb5416faba39d04fe8e4aefb76da02d2f4895cc0f8893743beb13bb062d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187406, "uuid": "04bb4635-03ea-4387-acd1-587ce409323a", "value": "T1F4630782BC80E626CBC01677FA5F508E331567D9E1DA32469D161FA07ACFC1B0D6B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187406, "uuid": "e844d983-bf71-4fe2-9645-fffdaef76f69", "value": "1536:74blEKw06Z1XjuxfEQoqm5YB8t46zHMGJok:74bllw0Wi0484EH7Jok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187406, "uuid": "d8a109f3-a59b-4a97-9afb-52a02f93b014", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187406, "uuid": "ef4a9a96-d347-4c84-a709-23ab77186fdc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187406, "uuid": "a1ec8c51-64e0-4f0a-baa2-8adda665d02c", "value": "94VG.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad3adba-085a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630194604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "c5e6a169-3b59-48a2-a160-b640cb63ce83", "comment": "Malware payload", "value": "910bd894410f63772ff8ba774dc6f544", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "62e19bd9-9d64-431b-b158-7c143a400842", "comment": "Malware payload", "value": "3ac04defffa28db0eccc91abba20faa52d5f8f132254795099f2d499d5a5dd0f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "e563219c-a0a1-49d7-aff4-b4d585aea9ae", "comment": "Malware payload", "value": "521b7778dbc73027ce2fd56abaca9618f545e2bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "c49ca564-51d7-4389-991c-abd49e0f6566", "comment": "Malware payload", "value": "5f638bdb84ecc89b9c8ecb21fbd06343c2681e000d6003c8062476a6f06b8a456a58f55812c1ccae0180b4f4f3f6e6d6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "105af8d9-e2f0-49bc-b873-d948f05e7f29", "value": "T12A633B42AA42CAB3C8930AB502EB9A260631FD2A0F179F55F31DBDF49F134C87617365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "7a8dec9e-eee8-47b7-bb3e-e584653f5bf1", "value": "1536:e98b4EmDIdV5LTepgWncXydolDmF+l2OZ/fufYEZ:zb4EmDI1LeNcsYmEl2OZXufYEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630194604, "uuid": "500b94a5-3063-4ab5-977d-62b7aa88b696", "value": 68892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630194604, "uuid": "ae8ba860-b901-4335-ab9e-de89ca580254", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "8a28ed2b-ef6a-489f-828e-9522e0872e87", "value": "razdzn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770700ac-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630167889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167889, "uuid": "53361243-d411-4d00-90e0-ac888aa2f53e", "comment": "Malware payload (RedLineStealer)", "value": "dc6c4631961c7e1c8b952eca2331199e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167889, "uuid": "f8ea406d-aa56-442b-bacb-d6fd56470a8c", "comment": "Malware payload (RedLineStealer)", "value": "3bd40776370b7471f50fa074756dee076004e2f279e5b84795c09d7323c5e6bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167889, "uuid": "02dedbee-3787-4d19-81d0-5da99f3423af", "comment": "Malware payload (RedLineStealer)", "value": "a46b1eca276e73bfa1f9dea84312de143a781315", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167889, "uuid": "683a97bf-cb7b-4bd5-a924-95011649efe7", "comment": "Malware payload (RedLineStealer)", "value": "0a13687a9cbf1cfa56fc9b5f104ba7f148387eed753ed643d13bdcd140a8cc4b737e72da3ef2c2cdc952e9aae1f8281e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167889, "uuid": "50f83374-6fcd-434b-886c-1797769cab34", "value": "T1BEC412691178CEF2D5E215B2482CE790265BED25ADB7C0C7760A932F3F316A0853E723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167889, "uuid": "a9c94c39-b177-492b-9ad2-fbe40d61bd9b", "value": "d3c9c233147536fd2cb825c3f3ce75bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167889, "uuid": "b579cc28-c82e-4d7e-accd-c0a8b177389c", "value": "12288:YKawjht7/Eci/uRDw3tKbOCQzCU/n2KQUpvOHhGzR/CD4BV4c1:VhtHiADatKbdQzCm2sHR/M4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167889, "uuid": "e0fb39dc-b4da-42b6-8bee-3dc3062b4e6c", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167889, "uuid": "22906391-d5f1-402b-a176-c875aced5337", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167889, "uuid": "de4527ca-1232-429d-bc66-b875e2fce992", "value": "dc6c4631961c7e1c8b952eca2331199e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4522de1b-07ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630132586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132586, "uuid": "9e52b42d-2938-4073-ac57-7f3dc156c43c", "comment": "Malware payload (DanaBot)", "value": "8dd817cc7742d1cdd9c4ea682c38983f", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132586, "uuid": "f75639f9-487d-49b8-b4b7-9ac9374b84f4", "comment": "Malware payload (DanaBot)", "value": "3dbbf4a443427bd73efeed8ddd467c02f7d8a30b10f944f11e0ffe43e5783d53", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132586, "uuid": "07a66989-3a0e-47c1-94ad-dc8fc2ca645b", "comment": "Malware payload (DanaBot)", "value": "aec12b0211a94b4faf7cc674b393cd25cd5167aa", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132586, "uuid": "5a4f684e-fae0-414c-b52f-d10442c565d6", "comment": "Malware payload (DanaBot)", "value": "b29c2e621c4b89c73051403a2d87c3bccb58f0bb0242313ad19bc219fe715eff3298475a01d70752968f91740261b225", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132586, "uuid": "85c2a574-a76d-4bb2-b873-7aa07072c614", "value": "T14B451230A7A0C03AE4F715F899B982B8B83D79A0677550CB92D166E907346F9FD31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132586, "uuid": "9e18a081-67a8-479b-bed0-7b461ef6bb50", "value": "e68f2e15edc1c604720a74f10b8483a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132586, "uuid": "db1780ef-3c60-4587-a0a4-6b55f53bc3c8", "value": "24576:eVgGBOf0ajwXSZ60b38/Bv/neCpCgi7aMJnOB1z0oT:efajww67Bv/eNvpOr0oT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132586, "uuid": "8167ad21-53af-4d3f-ae7c-3a160faa3db1", "value": 1183744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132586, "uuid": "1371ce41-831a-4438-8159-e0795b27d1c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132586, "uuid": "78b437ac-7d41-4d3f-8adb-1dafa9e441c5", "value": "8dd817cc7742d1cdd9c4ea682c38983f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43625633-07ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630132583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132583, "uuid": "31d1f4a6-e24f-4de7-8b39-732a30fa9512", "comment": "Malware payload (Smoke Loader)", "value": "1347ad0dd707cd40aeecee7e7a4e89ef", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132583, "uuid": "f5582ba0-ea64-4047-9e24-cff81091a88e", "comment": "Malware payload (Smoke Loader)", "value": "3e7bb59da0c14e0afceafc0de5f85510a793b66f825b61846752aa00836dde0e", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132583, "uuid": "5833b438-aea3-4d0b-a967-f6849f77dffe", "comment": "Malware payload (Smoke Loader)", "value": "782384fecdc4336eab4a2dd09aa7e15075189ec4", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132583, "uuid": "1a501f0d-2433-4fbb-9eaa-44df30b734a6", "comment": "Malware payload (Smoke Loader)", "value": "1b06f1efc427e87f4b5095c3898b136d8a0ec6be63310f2dbbc311da03b72c43cdd540fef7c4a0dc1fd489614ba0ec79", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132583, "uuid": "60adf38d-3a0e-4145-b97c-195ded2d6890", "value": "T1BC448D30A790C035E0F712F859B982B8B5293AB1A77450CF53D52AEE5B346E8ED3174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132583, "uuid": "c02779fd-3925-4464-a168-17d11f0d7c46", "value": "e68f2e15edc1c604720a74f10b8483a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132583, "uuid": "4a121862-2b4e-458f-8660-17caa6f1482d", "value": "6144:d/Td2bX/46yyzmE4bhFT2FzjHVGFPMyWreBuc:bWv461zmxhF6Ff1UEyWrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132583, "uuid": "9fe2a4c9-256b-453b-a0b1-fb5bd428ea08", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132583, "uuid": "2e314066-39e3-4871-8e7d-a342e816e023", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132583, "uuid": "097453ac-2f44-43d2-bf9a-7b28e306d3b4", "value": "1347ad0dd707cd40aeecee7e7a4e89ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5fc089-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630167815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167815, "uuid": "b3d24ea7-66bd-45c7-a155-713cf067ec65", "comment": "Malware payload (Smoke Loader)", "value": "01cc9dd22794e7fdd24b37bdd30f4487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167815, "uuid": "77fc47c0-a717-4a57-b278-caafb901259e", "comment": "Malware payload (Smoke Loader)", "value": "406811bd2d94c52102ecbfc207ce52677a7efe17aeb79573c4f607b28a102e39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167815, "uuid": "168d48fa-8ada-4ed0-926a-d4dcd226efda", "comment": "Malware payload (Smoke Loader)", "value": "015eb43592868492e032ed6022466060a695e8b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167815, "uuid": "1064e025-6212-4aca-b372-f618c3cfeac3", "comment": "Malware payload (Smoke Loader)", "value": "838aad9bffc17041e08514d41a387d27147f7b1d57626c32ea20f31ef271b7ab60dab07d18d4a32d08014756d420511b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167815, "uuid": "3321f38e-e591-4008-8c42-97730d25c66c", "value": "T16CE3CF3571B1C6B3C1C259B48499EBA1267FFD316A708A873B48536B3E751C18B2E393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167815, "uuid": "28fab588-be53-4344-b466-4b5b7881bf66", "value": "8e0bb80ced2d421c88737de82cded0ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167815, "uuid": "d6519561-876a-482f-89f2-6621e1c1dedf", "value": "3072:IwWiqHqAe6HmhyX5D30kHIxsI5/DuT61m:MiqHxFGmk4SsI5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167815, "uuid": "3b4e7580-d368-48a4-9de3-fc55c8c689e4", "value": 152064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167815, "uuid": "d26a9ae5-1f67-4734-85ce-71f0e98be9e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167815, "uuid": "ac21d834-e4a1-4c76-9d6e-8c7f98fef3a2", "value": "01cc9dd22794e7fdd24b37bdd30f4487.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2abb01-07f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630152006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152006, "uuid": "08df9904-a207-46a9-b09e-ed5ba559f2b8", "comment": "Malware payload (Mirai)", "value": "e021581a41a6f06d41e3959c9ef88339", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152006, "uuid": "9b268ff0-f608-4703-83ae-a97ca8126a4c", "comment": "Malware payload (Mirai)", "value": "414860283100b2d1c36cfb5bfcb370b825cad23adcd2f45c8b2f7a071f66708a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152006, "uuid": "b74603d0-61b5-4aac-8a6f-4cbb3f4dd36a", "comment": "Malware payload (Mirai)", "value": "f971bd4f2d9b7613e755586d8086e7d2209ae9c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152006, "uuid": "14affd62-836e-409f-8196-1f99f331b670", "comment": "Malware payload (Mirai)", "value": "455a2538d304b0d8e2b2a3ce3a922576b9ff238eab4607e0819c569db4a6253546150ada619de073e34d9e8962fea98c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152006, "uuid": "2ad5b499-f83c-42c8-87df-4731278aba01", "value": "T1B943F1B833B6F8525AE18832F71585137AD70BAC83DF9D252767474866F243324982DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152006, "uuid": "6fa97758-c925-4dcc-8697-8c835fe0c01a", "value": "1536:QgvlLXSsTb6baYYmXzwP0Hz6ohLjBLZwCQ2GvO6LYm:QGlOsX6OYYmj6/oNlLZwCQ7vv0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630152006, "uuid": "48efff26-13de-4231-8661-26acdf4b387b", "value": 57444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630152006, "uuid": "3de69cad-3ba9-48b9-985b-844eea9c4ec7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152006, "uuid": "a144c412-2f35-42fd-a1fe-880a3166fb05", "value": "dark.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac3e95e-085a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630194604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "f87ca87d-9447-468a-a9c0-413df2c5e23a", "comment": "Malware payload", "value": "d45598b65a282cd912083c71ebd7372f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "b9d69cd7-83ea-4ade-bbc9-8430d59a6b86", "comment": "Malware payload", "value": "4164e56b7bbd6e861d35b4a26400cc5502a6a41712ee13dae0d0888aff244dd8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "484f5c88-5f6b-4593-8cc0-f848a452fd3b", "comment": "Malware payload", "value": "8c1ffb592ff3b62709215fb12c37003ea7e4a064", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "5a55552a-ac1b-40f7-97ca-6c0fc9e04148", "comment": "Malware payload", "value": "ef362af2b1f5d59564bd057e347a3905f86b9de920a34b2cfc19387957e4a64eda08a4c4288f4d359f8151b47c6be2d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "9993c650-7d5c-4ca9-8000-4b4bbdd2e313", "value": "T199A33802D5508B57C1D2177ABB9F426D37332B68979B3321AA247FB82BC279D1E3D121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "07b2583a-7bbb-4129-9668-d9fa1a501ad7", "value": "3072:iHobm0w+aSP+wqsGZmDYgTE+mBQO/IXZFW:iHo6+aGqsGJEE+mBQO/OZFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630194604, "uuid": "f96d6223-7e1b-465c-adf1-f1459f602b23", "value": 106529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630194604, "uuid": "f6dc3173-1c3c-4cc0-8b81-3ef1bf9469ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "a9ae140c-4f72-4641-87d1-bd9a20b1a6db", "value": "nvitpj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cf2390-07c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630129480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129480, "uuid": "51861b50-88d0-4a9a-b5e1-1f5240fe1263", "comment": "Malware payload (Mirai)", "value": "ad73b896c3a4039804e2c5c698027040", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129480, "uuid": "024ef594-de16-475c-a5ce-a33dc1186f66", "comment": "Malware payload (Mirai)", "value": "4194541ccb10a0e399334a6d4e2ac7bf78d7e78b35fbf9bb08f0a14abc53a962", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129480, "uuid": "2ef743e1-1e4e-40e4-a528-78783d3a6334", "comment": "Malware payload (Mirai)", "value": "de8c02b63b6adfd180911a0280e51a8544a048b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129480, "uuid": "73f08bee-f435-400c-a447-baa8657ca85c", "comment": "Malware payload (Mirai)", "value": "4b16bba079a7d2193664b979ff93f49ce8f0f65a417330b2d4ccd86e8a0ad19930d9e24b204a91c99f7b570666f85e4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129480, "uuid": "157b748d-0d72-4e91-9cd1-e70eb18b1112", "value": "T1F8739E76E424A956C086023074F0DF380B73AAD996271E77BA9006B25407EDDF60EFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129480, "uuid": "b98ee06a-0071-453b-8e64-a76b6296ce29", "value": "1536:xa8w0ByvjwSvA/CAjiZ2Kkla4PzasO7imiiCRR6Guca1NWK:xX4jnv6xw4rasO7imiiyGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630129480, "uuid": "775fcb7e-8522-4a14-be95-a412d21433d9", "value": 80480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630129480, "uuid": "e5417143-58f4-4e15-8dc8-5d7b954476f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129480, "uuid": "6d94cee8-c731-4dd3-94c3-a0c6145555a5", "value": "ad73b896c3a4039804e2c5c698027040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb5fd41-07cb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GCleaner)", "timestamp": 1630133302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133302, "uuid": "5f0168ca-aa19-4597-b59e-984c7c44b942", "comment": "Malware payload (GCleaner)", "value": "a8bc13be235628a07cf2d0d90d907b42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133302, "uuid": "22eca705-8cfa-4c03-bfe2-1160523df77c", "comment": "Malware payload (GCleaner)", "value": "4301c19a0d9579d2c3b7252c4e36d02d854bb688d1621d5ad06bd19770a2aeae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133302, "uuid": "a7cddd79-fba3-4877-80b9-206be89bce69", "comment": "Malware payload (GCleaner)", "value": "b11ba1a4e57295956fb3b7e7dbb4cd2e48eb06f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133302, "uuid": "d3fc13e5-2008-49ab-8df6-b57a2d06e9bc", "comment": "Malware payload (GCleaner)", "value": "442a5dd11a574042d1f3eef8529f917d59af4010afba40f745c826f602015cb85afe9b7deb3bd699558f9a472d9b1c4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133302, "uuid": "70af6269-8413-4044-954e-7d7f7d38946a", "value": "T1B254AE30A7A0C035F1B712F459B993B8A93E3EB16B3490CB62D526EE46356E4DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133302, "uuid": "6297ffe0-a5e8-4998-8312-93b8edec41cf", "value": "a740faca4969ca85c5d64be386fb4390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133302, "uuid": "c444cf92-b92a-4fb1-bca5-4af5ac957c5e", "value": "6144:HciywtTA/o7n8dtGyQCQx6x4m5wUAtkjCeN6Yck:ZDtUQ7nAGyQHa4mFCe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630133302, "uuid": "8d7b30a0-1fc9-44ab-a5fd-0369c3c2b80f", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630133302, "uuid": "799b5d1d-73ee-47d8-a6c6-2c14a65e2b9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133302, "uuid": "7101069a-37f3-496d-a01d-2a307d378e56", "value": "a8bc13be235628a07cf2d0d90d907b42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843d1edf-0838-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630179937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630179937, "uuid": "40bd8dbd-0432-4d91-ae81-2206b6acddb9", "comment": "Malware payload (RedLineStealer)", "value": "aecd557387d444d90e5965770fe2308a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630179937, "uuid": "f690d5ee-4a35-4167-b70f-c00c011fb545", "comment": "Malware payload (RedLineStealer)", "value": "4322b25b29f160a08e809764a5dd86deda2289623331867004f85a905ce47769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630179937, "uuid": "ccd24d1f-fc01-4f34-963d-c306b04c19c7", "comment": "Malware payload (RedLineStealer)", "value": "75cf9b4dec304922234842e5902a6e471a8db966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630179937, "uuid": "dc3d8bee-825a-4d7a-a64f-1c823102fe03", "comment": "Malware payload (RedLineStealer)", "value": "d8368e9c53156f131e570bb2d6ccbb80a44d0ffe45e1cbe831cae74c05f9eae1121c2df9ec358c3757bc70e70d83eb56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630179937, "uuid": "9c953ce5-6e0d-499e-a79e-052e6c2ab7f7", "value": "T19396333352651140E1E1CC398637BEA4B2F65B6B9B827C7805E7ADC129969E0E703FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630179937, "uuid": "563ce763-df39-48cd-aae1-a17c286d0458", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630179937, "uuid": "0145b53f-0a3d-46bd-9c14-efca08e71584", "value": "196608:7rH9rc/tzMP/Ok4Xt+CoM2xeQHHKbEdvc7fh:7rG/twP/Z4Xtb9QnuWvcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630179937, "uuid": "c53c7ada-b15a-4f58-a3a8-53d92e5fa62e", "value": 9065984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630179937, "uuid": "fc7fcdc9-725e-4602-a8c1-7a2bf0bf8b20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630179937, "uuid": "936ac655-c7fa-491b-a123-dcf6d2f13a18", "value": "AECD557387D444D90E5965770FE2308A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a837bb3-082f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630175894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175894, "uuid": "20aa7594-7a54-434a-a92c-aa03ea43be66", "comment": "Malware payload (CobaltStrike)", "value": "082dc36450b4cc93e33c1fc0ca71a713", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175894, "uuid": "d3b90013-65f5-4c00-97b9-c596b65b8914", "comment": "Malware payload (CobaltStrike)", "value": "44a62ceedf74271297ab0009697dc8c3aa9c4329c10eb0b55c7bea920474a41d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175894, "uuid": "e938280e-ade5-4eaa-b54c-4639f3fd8c60", "comment": "Malware payload (CobaltStrike)", "value": "5711e5893b8ff1f2b9e2a48ec47dab4804dc7d26", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175894, "uuid": "c1cfb000-9ad3-4107-bb66-013b5d9c260a", "comment": "Malware payload (CobaltStrike)", "value": "fb892a223c7e6ca2616e4c34dafc75ed81822e076f4b6b907d89b37191b6a735085b19e9eb79d49981d922d695b40079", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175894, "uuid": "fc2f9b89-d066-4877-9f37-78ae266ecef6", "value": "T10024DF3277365DFBEC4CCDBE328A2A360CE9C303681D67059537A859572E9878E560F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175894, "uuid": "c0350310-5b5a-42ee-9fff-9a0a2414132b", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175894, "uuid": "c8ea845a-eccc-44ba-9145-03bc21751548", "value": "6144:xVNNtUwMgWr/TitrGkNpLuwotWZX5Q0azo4ievu:x5awY/S6kfhMWZX5Q3Ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630175894, "uuid": "f090bba6-a2f0-4c56-a590-35739d7bc1a9", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630175894, "uuid": "2a18d083-741e-4c0d-af14-9ef87e600878", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175894, "uuid": "3eabb6f2-6e3a-4780-b513-a3a3065ac19e", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71c8c8b-07c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630132026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132026, "uuid": "144de2cc-e3ab-4aa1-9d8d-4039d0789cc4", "comment": "Malware payload", "value": "3f25200067afbf6abba3e380be7cee18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132026, "uuid": "c8dfbc23-f6fc-4ffb-bf8a-e2fb8c0971b3", "comment": "Malware payload", "value": "451d501adb77393f2d795b5c363bcacc490cc0d83426c75f45ef98342ccb71ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132026, "uuid": "b3aef856-fc66-4825-a76a-758b887157b9", "comment": "Malware payload", "value": "b4755bf08298765468737fa2afd23a9d2d37729d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132026, "uuid": "0ceb2455-67a1-4060-a444-5ec8504017a9", "comment": "Malware payload", "value": "dd58df8ee34f1903e80c6c69eb09aa66b799d61d2b446eb6f808c750dbf0e74f1799195b3b4aac54cecd8d7c5c573073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132026, "uuid": "2a3892b4-dd24-47d3-a500-a401733a4ce5", "value": "T16716F157BC6420F8C5EEC231C626A62279303899073877D72F9062F91BB6FE45A7D364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132026, "uuid": "7e522a80-0a1d-467c-bdda-aab98c366080", "value": "49152:AwptF+Srb/TkvO90dL3BmAFd4A64nsfJ9KB5ehpylOePliwQkCkGDIyKSh2KHl58:AwNxK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132026, "uuid": "da544863-c952-4898-a068-704294f056f0", "value": 4035307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132026, "uuid": "80e6c165-5e17-4ecf-8fd9-9c1abe464da1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132026, "uuid": "7e11da56-a3da-49d2-b99b-7f60f8d87995", "value": "3f25200067afbf6abba3e380be7cee18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a13bba-0859-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630194107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194107, "uuid": "65fec2d4-c37e-4701-9167-24394dda3ea1", "comment": "Malware payload", "value": "15aadb9eb6a136cb89f0c441770ec6a0", "object_relation": "md5", "Tag": [ { "name": "EfsPotatoe", "colour": "#CCAFCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockFile", "colour": "#30EEF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194107, "uuid": "110510c5-0265-41ea-b822-743534fd4165", "comment": "Malware payload", "value": "47b85abee8a07e79ad95f48a3e3addf7235144b67b0350e2f9ac80e66f97e583", "object_relation": "sha256", "Tag": [ { "name": "EfsPotatoe", "colour": "#CCAFCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockFile", "colour": "#30EEF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194107, "uuid": "3acff447-1d8a-40c4-ab11-788e7a194c41", "comment": "Malware payload", "value": "ce20d87c83b3d86ca2f78516f7b714786e3e9def", "object_relation": "sha1", "Tag": [ { "name": "EfsPotatoe", "colour": "#CCAFCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockFile", "colour": "#30EEF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194107, "uuid": "4a3cda0c-1d37-47cf-adfc-eadcfe35abb2", "comment": "Malware payload", "value": "71ebb3d7e2f64d8a539cd279af5246e6acff8f8f5e2678095c52f3d7d118024f1b1b9e3bc09e3d5b1a8646bd61b0fbc3", "object_relation": "sha3-384", "Tag": [ { "name": "EfsPotatoe", "colour": "#CCAFCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockFile", "colour": "#30EEF9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194107, "uuid": "8affb4a3-c9ed-4861-9bb1-7bebf68e1dae", "value": "T16A721B8AA7DE1525D5EE0F7C88B305110BB0E5160FA3D79F0ADC448F6C23B9459E27EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194107, "uuid": "3053d273-6774-4451-8395-b1ddb2d4ff51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194107, "uuid": "ea58e6ff-f0f2-48cc-9c67-1d1db30574f3", "value": "384:qvLWrfGW81MvSKhV19xjdzPnlkJvTQbgvSmFw:GLaf+OtjlkJvF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630194107, "uuid": "b5637930-9f32-4596-9ff5-c92ad3cd3369", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630194107, "uuid": "ed54a792-acaa-4627-a69b-b10cbe1e47d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194107, "uuid": "03ca104f-b7c4-4f98-bfa5-74d6f24b6c81", "value": "47b85abee8a07e79ad95f48a3e3addf7235144b67b0350e2f9ac80e66f97e583.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40259b46-084b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630187983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187983, "uuid": "c773699b-968e-40d4-8527-192dc7ead3c5", "comment": "Malware payload (Mirai)", "value": "723b5784e2ee7fac9180b20b9d839eee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187983, "uuid": "41dafe59-6037-4613-b225-cfaf0e99083f", "comment": "Malware payload (Mirai)", "value": "48ac79c8cc242c19e12d1792901b1c7e91a7184f13b4b412c98fbddd39e94242", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187983, "uuid": "162d55c2-bd62-4946-a58e-eef3e61b267c", "comment": "Malware payload (Mirai)", "value": "1a2df3b412691ef71bd8f598210196d43317dbc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187983, "uuid": "8a6c6f68-a8a7-4f14-b34f-84aab7218877", "comment": "Malware payload (Mirai)", "value": "ec36158a20363724e2e7a40d5651f4309de96deab5caf6b00b10b76f902078ef8104342e25c73cc2eeac6f8c9962a074", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187983, "uuid": "cda1c688-2ed2-4777-9a55-c852fb13ecda", "value": "T118C2D0742844A570E330053DFFD98A875BA7C1F481E432161A604AFEA64F5C6B8BB78F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187983, "uuid": "db7ded8c-f940-4c13-af76-0884ebf206f2", "value": "768:xRSa8ZS/L6rze3OXrFKg9KZrqoDu2pbs3UozYe:vSjFJXZBCJDu2QzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187983, "uuid": "57501b93-629d-4e59-a8fb-8c6fd618cd3a", "value": 26292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187983, "uuid": "d5718236-81ce-4cc4-adbf-124568977ddc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187983, "uuid": "04506ff6-991a-418e-910a-09b4541ccd64", "value": "723b5784e2ee7fac9180b20b9d839eee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc74d5dd-0843-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630184755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184755, "uuid": "980cf4a2-844e-45d7-9421-8c7eeaf4f018", "comment": "Malware payload", "value": "ff8009dbe0d3104ed35158f6ecf3f571", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184755, "uuid": "e4700145-3b11-4f11-b946-0438b34d641b", "comment": "Malware payload", "value": "49a649dfa13b7869d1228a9fdd60a0092921c3a79076ff9f13625a0b46805911", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184755, "uuid": "701b645b-3531-4674-b797-ed49c8206318", "comment": "Malware payload", "value": "101e0cd6765916a6c7e18b26a6839506fa43d5fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184755, "uuid": "a1d51576-8218-4447-aa55-6063e57dd41d", "comment": "Malware payload", "value": "06e1325a552c6ba24a45ce4a54efced520d034938ae4c4285bc013f7015430149d1071f213f944a706e5c073159cca42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184755, "uuid": "6f4b218a-bfcd-462b-917d-b97ad8b86043", "value": "T18E635CC5E4019E3CF99BD6BE84160A08BA34635456A30F2BD6ABFCD77CB316C9E42D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184755, "uuid": "71b7e349-3bc9-4e6c-8cd5-0daf19fcc8f5", "value": "1536:RDUL/1TtgFyrstQCOe6xxPEzoCBK20IgY8lxE:OL/vclGP1/Soe0fdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630184755, "uuid": "415e0c6d-8395-4d9b-9e2b-d1704ce57a57", "value": 69588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630184755, "uuid": "8aef98e0-8f89-4fa3-bd9d-ca20e35895c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184755, "uuid": "0753279e-1f0a-4612-87b6-a39b1f610c4d", "value": "ff8009dbe0d3104ed35158f6ecf3f571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3997d4-080f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630162203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162203, "uuid": "9f6f6148-c230-4155-9630-9d3933294723", "comment": "Malware payload (Mirai)", "value": "882c55fa72bce7cd503bb94728a37c36", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162203, "uuid": "da84ff35-9ef4-4a95-93d3-f03b510964ba", "comment": "Malware payload (Mirai)", "value": "4b9de31fce220a2d2c3a65cd221b4aaf3301eccb2003a333b50992b0521288ba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162203, "uuid": "ce2d6e26-6024-466b-a763-d41ab9a0c7a4", "comment": "Malware payload (Mirai)", "value": "7023b4a7f364be0a215c27ceb65da77ac6343a7d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162203, "uuid": "dc2ab360-05ec-445f-8dfd-26b17f1f2a93", "comment": "Malware payload (Mirai)", "value": "17e83a4e8340d4bc078ef130f53ed49e263615d3e4ef5570910131d07371025e4820e87d3e2356aca4340dd0b66ecfd2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162203, "uuid": "59d7ba70-188f-4f05-aa44-9ab98ac8e9e8", "value": "T181E35B46EB808F13C4D22776BBDF421533239B5493DB63069928BBF43F8679A4E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162203, "uuid": "77a52ca9-1cb9-4748-ae78-22941f1d4c6b", "value": "3072:o6DhYaCgAkYaqMmg4DScdCqOZCPZ7j7dAaXM/9v4WF:o6tYwjYaqMmg4Wcm87j7dM/9v4WF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630162203, "uuid": "c8bfe667-bee1-4b33-b134-bce2fa3cb292", "value": 145153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630162203, "uuid": "f9d26032-30fc-49eb-b646-983c99e9bb60", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162203, "uuid": "b8b7f6fb-2953-4194-a0bf-b5344602d49d", "value": "arm7-20210828-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29da1fb-07f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630149601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149601, "uuid": "20de7037-bc8c-44d4-bd07-bfecfa2b018e", "comment": "Malware payload (Mirai)", "value": "b6df0e0fcc433549f3b01407dcb57057", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149601, "uuid": "bb33e9c3-726c-419a-9234-bc6a4d41a869", "comment": "Malware payload (Mirai)", "value": "4cd7a1c62cd3f48bdddbec779ab7d0b8e51092a9bb9c428377a43674698d67ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149601, "uuid": "eee31aec-9a91-4300-8640-7ef4806fbea8", "comment": "Malware payload (Mirai)", "value": "57843292f97460752c35f87f2b5ddc5aa152ca49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149601, "uuid": "24a9708f-ba60-4d78-897d-e5618868dd32", "comment": "Malware payload (Mirai)", "value": "e0e10b323c7c8c729d7ad8b4b09bf8890d5c6677ab12a01250a59734ca3f7ec8a935b0cd6cff21ac8134f742da4debac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630149601, "uuid": "b55e5497-f6c4-4d6c-a894-5b7b638f8044", "value": "T126A2D01822CDE962D170903EE13CC207AADB83A652FE713E1E0807ADE44591AD7BD945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630149601, "uuid": "5aee6217-0563-4ab8-87f4-24b1722f6905", "value": "384:Yzmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbKhymdGUop5hXr:YKoh/DxCvhdR4IjWVFbSWs3UozJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630149601, "uuid": "88a58036-0135-4524-91cd-33cc2acc2327", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630149601, "uuid": "d9d2181c-9d08-459c-85bc-6238a5bc8600", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630149601, "uuid": "b447dbbd-bdf4-4c35-a9aa-8ff0398c24ac", "value": "b6df0e0fcc433549f3b01407dcb57057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22be684-082e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630175692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175692, "uuid": "59c40b0a-77c0-4320-b003-35c785bce633", "comment": "Malware payload (CobaltStrike)", "value": "d05f4936162c66a4ec236d20bad63e50", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175692, "uuid": "b5b5e58e-884b-4425-92fa-6f2c3080c278", "comment": "Malware payload (CobaltStrike)", "value": "4d000d7bf26f5813c32b2f78b45a578ece3b21873dc05cb31dfda5276708017a", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175692, "uuid": "51cf3993-eaa9-4e64-b49c-507a9d0ff200", "comment": "Malware payload (CobaltStrike)", "value": "527126fc0a0b9c816f8302f6ac76f05d9fbec691", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175692, "uuid": "4295f7c2-bbd2-4c06-89ff-8316cbac717b", "comment": "Malware payload (CobaltStrike)", "value": "72baba94db509039c3d1d93a2d6634fe1151022095dbe1906c1a36cf98742eadee89d15e2344e33af224182febeffe2d", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175692, "uuid": "2526dc69-a34c-44eb-926d-109202740cbd", "value": "T1F524DF78F0121C12F4CAB3746CB16066DE6ABE976C2335CE4AFA9D20F1C395F8A51D94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175692, "uuid": "3e1669fd-46d5-40f8-81b3-26b457e674b0", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175692, "uuid": "acdfe2a4-4b10-41b0-a0de-1849e76821e7", "value": "6144:jdOFvRAxw6UvxA5s+KUygzrbyyyhWdLekB:jdOfYlGHrDwJek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630175692, "uuid": "a7490587-7c37-4244-a6b7-28fa9edf027c", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630175692, "uuid": "72e0f57f-41b1-4ac6-bbdb-a20c74305360", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175692, "uuid": "5cf922e8-3e65-43de-bfa7-0fd4ebaf1ae1", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89cae675-07ee-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1630148163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148163, "uuid": "c28b5f2a-e40a-44db-b85a-2a6b4d4314cc", "comment": "Malware payload (Cerberus)", "value": "5b361783bcfee72ca959719bbb0edaff", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148163, "uuid": "f90c6b2c-034f-48f2-a349-440c340e6265", "comment": "Malware payload (Cerberus)", "value": "4ff6ea5fd58662f21827ffe33518aea786edf954d46a53da6ac47b562ec56aee", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148163, "uuid": "efedfc86-d8b7-4125-a116-a867bc79fc6d", "comment": "Malware payload (Cerberus)", "value": "98b586d73e2134a8666a03e83cde5cd1f4f294f6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148163, "uuid": "d2ae3a2a-0e18-4542-9a62-b5952da3119f", "comment": "Malware payload (Cerberus)", "value": "e5f6f3d1d61f1b07f290fe8d4d8d66d176d8bf9a908da40f2acc38997e6ae607ffbdb2502ad9a25a790a0a3b239ea164", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630148163, "uuid": "bd4d2677-4f11-437a-9c97-f93b3dc8b66c", "value": "T18AE302C343D9396CF10FE974616B07065F7E8620A2E9E3BA13A684A49CB77655F2CC24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630148163, "uuid": "986bb55a-414d-4e93-bd2c-63edadae1a0d", "value": "3072:ditQk7koDjr2aglLk//KteAUQBhdg0txKPnVBIVBQhPZhPUH:O7NjrFgt1txhdg0txi/I/SH8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630148163, "uuid": "ecc62546-1839-4912-aee0-dbbba3d3bb90", "value": 153009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630148163, "uuid": "ce252592-ba48-4e55-a617-a0efb99f3e8c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630148163, "uuid": "6bbddfba-386d-4822-a0a3-563fa3127081", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879825d5-0831-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630176936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630176936, "uuid": "64b77980-1411-4ef4-be64-322fd0c9105f", "comment": "Malware payload (RaccoonStealer)", "value": "ce2328dfe8cdacd43216f91b61fec631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630176936, "uuid": "1c9b73c3-2a05-4ed7-a468-b64f0d41ee64", "comment": "Malware payload (RaccoonStealer)", "value": "5044bd3dfd6bd23b2ed2e52e4efc0ec6ee59d71d7672d37ce9f2b68e2299a9d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630176936, "uuid": "c86a17e8-3e74-4afd-99f6-fec101ef5103", "comment": "Malware payload (RaccoonStealer)", "value": "80380910dabc95803a470c9f58d1ff3645747997", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630176936, "uuid": "96f1ffbc-c217-48e4-8506-7dcc93a51f19", "comment": "Malware payload (RaccoonStealer)", "value": "4ef7a9ca568f4a0c6bb8c6b1ffa39348876d8296b330785cf1471fc9a89a5e13c06c068c7e37a0d15f3960438ddf976f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630176936, "uuid": "4385bc81-a829-4a78-9776-95108819e7be", "value": "T130940299B6B0C573C2C6A4314C55E7822E2FF9216F75C6873E988F9F3BA61E0461D243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630176936, "uuid": "b7a2bb11-0680-4ccc-b275-aff61b15821a", "value": "065a584d0d50807005a7c41fcb9adea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630176936, "uuid": "3d6743e9-32c1-4c20-810d-42b520e138d0", "value": "12288:Ctp+P1v1xuXz4AYOFg3APbDiVEIgN12/c:CHAMXz9PeI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630176936, "uuid": "eb5034dc-979e-4823-a70e-ad70e2f3482d", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630176936, "uuid": "3af3d59d-e2cd-467a-bb9a-5597e96f73c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630176936, "uuid": "cf499ecd-4ce4-4bfe-b7ff-b8a08a3572c7", "value": "ce2328dfe8cdacd43216f91b61fec631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c49fd06-080d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630161321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630161321, "uuid": "3cdcd903-bd25-41cf-bda2-d747a1f7b38d", "comment": "Malware payload", "value": "382258edbbbd2fa457d71daba12c4a97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630161321, "uuid": "2c13ce36-71c9-453b-8131-b32e67a971fd", "comment": "Malware payload", "value": "508a816001e6d2f7b6617d9009e97c533d02d366055dad4eb17a9ee38915fa4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630161321, "uuid": "9ea2555e-1a0a-4a9e-ad45-a41513f4e092", "comment": "Malware payload", "value": "1c625fadff1b7a509a6eb16b72651467354266d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630161321, "uuid": "580dea73-3af9-43ec-9fd8-dc5d5c69da78", "comment": "Malware payload", "value": "409d3a4df4ff30a7f7362dcc38f3c7fda8a1b03676f01911f4b8ffa8cb42044287a45f9fb5c5c2ff437eac218c1f4799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630161321, "uuid": "e7699d84-3a4b-4fc1-b218-4c71f7931261", "value": "T1F194131D66E177DBE40905F64992A3687DFAFBE34DACF38F027566190DBB1A0340A381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630161321, "uuid": "f1379d0e-143f-4cfd-96e2-4478dc3b5d08", "value": "1b39fdd128f4435e110614f6dc1ba005", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630161321, "uuid": "e85064fb-c135-4152-a254-cc06ca39f447", "value": "12288:dj7h2c14HhTh89Oi2Un6fldp0L2P7ys+:dj12ciHhN0OdfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630161321, "uuid": "87a50e2b-64be-420d-bdc0-9a07d45abb7b", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630161321, "uuid": "f82c532c-ab36-4469-ab61-8d7ee556091c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630161321, "uuid": "c2306202-6f1a-4b05-a2dc-4936dc8765eb", "value": "46.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c04ce5-0845-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630185340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630185340, "uuid": "f0524d0f-1fba-41c0-b9f8-2c787ea22e6a", "comment": "Malware payload (RaccoonStealer)", "value": "2f0f374ba2a8adf6d5b1095607fa6cea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630185340, "uuid": "8792f70d-e1c4-4175-9f26-b11593fc0c6d", "comment": "Malware payload (RaccoonStealer)", "value": "514cf7b9751465c6f04d46cea1c49bf846c3322a4144faffef07e314793dc5e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630185340, "uuid": "f6591b15-9bf8-42b4-bdbf-3714da92a5fd", "comment": "Malware payload (RaccoonStealer)", "value": "4efd278872e7ca4c93bb2ff6527fc9c21ecbf724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630185340, "uuid": "ea7c7980-2480-44bb-936c-dc28e17b7ed0", "comment": "Malware payload (RaccoonStealer)", "value": "04b0e4873c46d0b949e304e4fd0cf69f862e08e872c2ed67ea774dd93dabed6c1659deb13c49c8acdf5222dc991295dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630185340, "uuid": "76a0859d-d833-4e56-a5f9-4045d467c811", "value": "T18C46222B52218009E1E1C8369633FEB971B61E6A8B40EC3829F77CD735BB5D56513A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630185340, "uuid": "423a6294-4236-4e0d-aba1-b9a463433160", "value": "5b9290431b366a1252cf05522cb28180", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630185340, "uuid": "3c2ef6a4-4af4-47da-9ca6-54109ef8945f", "value": "98304:vwU7gEP0pm1noxqvb9FbqZULA1oq/ze+PBkBbUfg+81K1T:9d0pm1nE23AULW/i+JkBHQ1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630185340, "uuid": "b5c2ffd8-0102-469e-b23f-9bca3948445b", "value": 5517808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630185340, "uuid": "643bcde0-b4f1-462d-bf84-1f8fbcb26822", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630185340, "uuid": "96398900-eb13-4123-bf44-b5166749c2c5", "value": "2f0f374ba2a8adf6d5b1095607fa6cea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d2a2e1-084b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630187972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187972, "uuid": "f38326cb-6866-4a17-890e-9e6770ea7400", "comment": "Malware payload (Mirai)", "value": "9635e81feb9accf61260d639dcd17331", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187972, "uuid": "78ce48ee-c497-4258-a97f-f3c347c31212", "comment": "Malware payload (Mirai)", "value": "51c44ef837c94022efb183b9c44faf31743634a718cdef5b88408c90d80e6427", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187972, "uuid": "daadb4d6-d845-406c-986c-6539089f14b7", "comment": "Malware payload (Mirai)", "value": "97d2fbea42dd6805210e2f5015aa2a7dcc7fb0e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187972, "uuid": "f2fdbd00-25e4-42df-bb20-f5f29b1ec1bd", "comment": "Malware payload (Mirai)", "value": "5a5b331431fe8307b8b9e178830fe63c2ae848086c6608128149b45026cd00c4e4eb0da715605e4376158b8ba7d05b9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187972, "uuid": "db3c9a4a-f155-4f72-8a36-6fdd51565d80", "value": "T1A2D2E170A68674A2C1F00131FA9897D702972EB491FF726772211876BEF718D3FA11E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187972, "uuid": "d1fb5d86-f3dd-4096-b868-07795551b6da", "value": "768:zA4uBc0T/nVvqV072G+IFYoXHZCx3GuhxFs3Uozw:zPuB7/nVMYn+Kf54szw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187972, "uuid": "65dcdd2b-e63b-462e-965a-5c3e118caf08", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187972, "uuid": "97f59517-492e-4191-989c-38ed2952d26a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187972, "uuid": "7a6944fb-8fb4-4874-8fec-07bacf68c67c", "value": "9635e81feb9accf61260d639dcd17331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10e48ef-082c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630174858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174858, "uuid": "e58ca1db-d22f-4b2c-a01a-b0568f5e2132", "comment": "Malware payload (CobaltStrike)", "value": "d2decf60612f9182a6b8193a96036125", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174858, "uuid": "c8ea0dfe-5d72-4c35-b70c-8784bf223315", "comment": "Malware payload (CobaltStrike)", "value": "51f755225b3a4e17efc504e4189a2dcb6f416f20484880c08251e69d0c448e0e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174858, "uuid": "a017e5c6-e927-4eeb-9086-bba7d41d9ef4", "comment": "Malware payload (CobaltStrike)", "value": "4aff94ce94b58b036c01725614e6a1525405cf67", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174858, "uuid": "56f363ae-5c76-4168-a601-90aac0ef3d50", "comment": "Malware payload (CobaltStrike)", "value": "97df25fe98b1bf9d7ebcf91e54a15d0446895024dca9499e149532b7dfe53bc6791c35baf217ade182da1b782ad443f8", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174858, "uuid": "1baec880-0279-46f9-982e-07103c19f2f6", "value": "T1D824CEF8A87B0DA1FED4563D997C2CEC0FAB78DF034211FD9A8CB435B0556880AD1999", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174858, "uuid": "7ce714d8-1e86-474c-9e30-f1d38239d0c6", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174858, "uuid": "98870b07-2286-4d19-8d36-b31c3f9cc86e", "value": "3072:sn0XHqgE8YzAMDLuspafV0Yp1cR6abXs85ExRHLdN501aYhlDL5ZGQnuQMQh:zbrGAMDL6fV0YzEsK2LPSakz4QuQ1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630174858, "uuid": "3987cf69-dd6a-44e6-a0e5-b6b46cf792c4", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630174858, "uuid": "27a7abf0-9a60-4ddb-8e70-01d8dbfb67dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174858, "uuid": "8e88afbd-fe1d-4b6c-a794-8976c5ca94b7", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b04b01-082e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630175696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175696, "uuid": "58e8b6fa-9c54-4ef0-ba35-ab2a671d8df8", "comment": "Malware payload (RedLineStealer)", "value": "e89e203d78f37985b615aef3e1b22bc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175696, "uuid": "5d9f082e-dacd-446c-8bd3-b273944eeaeb", "comment": "Malware payload (RedLineStealer)", "value": "53e9b55e8884a0f5734af7f69ba5b565bcd6cda0615d3e1ed97ee9296ed9c2f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175696, "uuid": "57024c07-afd4-4b22-9379-46d8b353d342", "comment": "Malware payload (RedLineStealer)", "value": "77b85c2c7d0989b1c2a2b59e21652d8d1ce7491b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175696, "uuid": "3e6ebf3c-f911-4e9c-be74-cca01c650333", "comment": "Malware payload (RedLineStealer)", "value": "c0a1f6b41c2cc273cabadcf8182abb2fda9ec1afad83e984a9477adf4385b8ee1e036c9da79ed309257f997d2c5d8ac7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175696, "uuid": "2778e198-da81-4ccf-a0aa-ddde46d77615", "value": "T14074BF20B6A0C075E4A613F558B982B86B287DB45B2450DF63D63BEE27382D4DC3177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175696, "uuid": "16b0abd3-33ce-4223-bc3a-c562c26597c4", "value": "f29709d3d8fb23714c868be088ee3357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175696, "uuid": "474288c0-f536-4e96-829b-b8e7f461f5a8", "value": "6144:y+OJ3zvr1e/QUFo2cViTMeo8G9vfWgoiT96s25XLHPIb3+zM3c6:s5zvrOQU/ckoKGx/j6/bV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630175696, "uuid": "a5723a6d-0c50-4ede-9a5c-42f8457e8f61", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630175696, "uuid": "a5dce241-8435-4278-896b-15e77b3bf696", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175696, "uuid": "3f1f437b-35ba-4b82-91ad-1aa8d9d29e40", "value": "e89e203d78f37985b615aef3e1b22bc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd8e48e-084a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630187472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187472, "uuid": "fb5ae694-f825-4466-97cf-7f164173c468", "comment": "Malware payload", "value": "34c6baee4af65140954977232098ccdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187472, "uuid": "77719f10-eddc-467f-9aa8-52b0a43d0d58", "comment": "Malware payload", "value": "5611f533697e92daed847764a46dc86420c4876a0977e79969d3ea9f26bcfc27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187472, "uuid": "b045c7ab-7f95-4a6a-a92a-12440c0beb17", "comment": "Malware payload", "value": "6365bfe275ffc434776a04d2d4b92c961ef4ca06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187472, "uuid": "066d178d-9800-420d-9d39-3d90e564d75d", "comment": "Malware payload", "value": "71df59942bf44502310733d80b09f775c8798b5535c4797e09afe3c25052ded2b33d6e85512b1a2ff4cad5a2f5cd11d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187472, "uuid": "358d70b9-1608-4bd6-bb37-bae3044931c3", "value": "T13A9533F1A8F3D6CAD0250734EE975939A3793BBE03C3A66541D98137A0C9DDF18126AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187472, "uuid": "4e077069-ebfa-42be-8e1c-cade8da060f2", "value": "49152:jo5R67U98hPD2tbR4pDjTWgXjdsMnuwHTkfBwmdaFz++R:F7UR4k4iMVzkfBWz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187472, "uuid": "5a7b5cad-4738-4a26-8d76-f1cd332780cf", "value": 1999360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187472, "uuid": "74d0ec81-b77b-416b-92d4-d73fdc2a9ba8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187472, "uuid": "ae236381-2310-4c7e-9347-25c05f2bd69b", "value": "34c6baee4af65140954977232098ccdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e2d866-0849-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630187404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187404, "uuid": "c1fdbf6a-9d68-4f8a-aa85-2804eba47022", "comment": "Malware payload (Mirai)", "value": "3384d07d5fb16260488548346a116bcc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187404, "uuid": "35c673d1-cb2b-4316-a57c-3e364df41651", "comment": "Malware payload (Mirai)", "value": "583f6bf98aef6dbe0477058bf2b6aa82190ad84927138a3aa5d43603298ed1b1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187404, "uuid": "cee183a4-a9be-4622-b5de-b1c3a2235875", "comment": "Malware payload (Mirai)", "value": "56040c73e157c91e368582b791af8069c32edc55", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187404, "uuid": "3660ba6c-fe8e-42c7-92b0-60b207517d75", "comment": "Malware payload (Mirai)", "value": "075f379ef4a76cbbfe17285de2495949e8e89a80359bbb1877de043c5266a6f8be8660d2b777c2226ad557b289a57216", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187404, "uuid": "f284f396-dc8f-4140-8007-4a0a8ec1b110", "value": "T150E34C86FA408B13C5C61B76EA9F424A33229B55E3DB73068D185FF43F87A5E4E13606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187404, "uuid": "941a4178-b21c-4a7a-9ada-7bc04f4d8276", "value": "3072:nib6sxR464MSnJYqNMLK0cNdqjn7AOytpkAMn7maXWZ2M/9s/r:ubRp4MSlcn7AOytptMaaX9M/9s/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187404, "uuid": "bf029a40-bcfa-4922-9a8d-15f976d1f872", "value": 144087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187404, "uuid": "51923f37-3a0a-4d25-be35-af1828d7a4a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187404, "uuid": "8c962c86-6069-4e74-9c58-306f1ff7f374", "value": "94VG.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0942b1c1-084a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630187461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187461, "uuid": "263172f4-6cdf-4efb-800a-fda00be08e00", "comment": "Malware payload (Glupteba)", "value": "b42b568e5b6056dc84df89494d7b68c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187461, "uuid": "ff872e06-5b6c-450c-a29d-790963766e50", "comment": "Malware payload (Glupteba)", "value": "59d926026fc65ebc3b130a9f65c65676e75eb523482ca81d9a4379eecad68685", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187461, "uuid": "37638770-ae20-422a-b0b7-a3f54709372a", "comment": "Malware payload (Glupteba)", "value": "e851150f09f571eca40a3f4d8d7d38eb3ddca29b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187461, "uuid": "b237063e-d899-4781-b725-f939a3f835a3", "comment": "Malware payload (Glupteba)", "value": "4db0d2bd7275269f69d66b2f268b3da960b4bb5e57e9c6209a834915c5c8a2ca80fd4318b9a21115a8785e6723673ea8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187461, "uuid": "4ca7909d-c666-40cb-804c-147a24b7be43", "value": "T1A2365A50F9DB50F5FA035A3148ABA37F6731A609873ACBC3C6449E96F857AE10933316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187461, "uuid": "60c97e7f-2e15-4778-88b0-c67e4273ff58", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187461, "uuid": "e1ef11ad-3188-4224-9caf-9c857759d155", "value": "49152:wfGHhtTcVMgg7WK8eHUsCOTpHYuxaHD3363spPYgfEXcKiWaUN4tEmoawrh6Gjgk:weXc4Tp4uQDH63spPYgfswrfJAiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187461, "uuid": "e0dc92cf-3027-4daf-8100-67e3dd2fb156", "value": 5004288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187461, "uuid": "97d31a65-4e7f-4219-8d63-4e01048ff9bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187461, "uuid": "309282cc-a596-493d-aa73-1e4772d90d76", "value": "b42b568e5b6056dc84df89494d7b68c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc48618-082b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630174339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174339, "uuid": "5ce23c31-8f6b-4917-a172-67163b40b1d7", "comment": "Malware payload (CobaltStrike)", "value": "708d05e5e3405d9f153ccef04163c037", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174339, "uuid": "f39d1e3c-5bd3-4f9a-a17e-d0d6ffc0781b", "comment": "Malware payload (CobaltStrike)", "value": "59ed8721faa9122f3a73e6372de962dd86674b5a7d1bb2c140a0cc05d99c74a9", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174339, "uuid": "1d20d2d4-b6a7-4b48-9540-9feb879bf593", "comment": "Malware payload (CobaltStrike)", "value": "db65a6473361f595282cfdb97aa695b98a507a03", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174339, "uuid": "c635f454-0998-4e29-be13-8b2b92bd9839", "comment": "Malware payload (CobaltStrike)", "value": "0ffe9091e24a9e88476a74a8c83d810af5afcdcfc9a7ac1e57210f79ee31b89ea7751ee8521afc611c91931f63337e47", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174339, "uuid": "e08d62be-5ff8-48f8-851f-ae1772bfefd8", "value": "T11C24CEF8A87B0DA1FED4563D997C2CEC0FAB78DF034211FD9A8CB435B0556880AD1999", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174339, "uuid": "220ef10b-1d81-45fa-8a8c-174430d68356", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174339, "uuid": "d7b6febf-b57c-4043-8535-caf80222bda0", "value": "3072:on0XHqgE8YzAMDLuspafV0Yp1cR6abXs85ExRHLdN501aYhlDL5ZGQnuQMQh:XbrGAMDL6fV0YzEsK2LPSakz4QuQ1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630174339, "uuid": "54e939c1-6e3a-4852-93c1-fcbcb5bd7568", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630174339, "uuid": "3054e9c4-a3ab-4c50-a392-febfb9da0684", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174339, "uuid": "6c551861-ca17-4637-8128-208247361f2f", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d013cce-0839-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tofsee)", "timestamp": 1630180247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630180247, "uuid": "8ceb4d72-0d23-48f4-b840-b6f5332133ba", "comment": "Malware payload (Tofsee)", "value": "d4d66258546efbcc87356f6ecfa0e925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630180247, "uuid": "ff6743d5-b990-439b-adf8-4dd46f8338e1", "comment": "Malware payload (Tofsee)", "value": "5a755c3fa92a24bae2d0d3fc1e2a743ed11e159f3327aeb685f8118823453a59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630180247, "uuid": "f89cda5d-439f-4268-8db7-e643eb411f77", "comment": "Malware payload (Tofsee)", "value": "edf064f4b9233f7eb4f0c83a5cdb9cdd568278ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630180247, "uuid": "d45dee83-1596-4dee-a9ad-6bfedd835a7b", "comment": "Malware payload (Tofsee)", "value": "8991b1af9ecd4f2d6e67cdef0290bf8144ca559ae068b0b2fd9655e6fc0da59eec13b1322eae010e143bd0660c1823f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630180247, "uuid": "50429713-d5a6-4e84-800e-2a4117ae8991", "value": "T1AFF3BE0436B0C57BF9C5093444E9EB91EA3BF8F36A75424B3654176F3E212C0562EAD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630180247, "uuid": "a08b0f3b-1441-4aaf-a12e-8993dbd3e448", "value": "065a584d0d50807005a7c41fcb9adea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630180247, "uuid": "fc51142b-821f-4549-99a1-be04be65037c", "value": "3072:aZmgrmSXo03dk1a+5EA7t9DU+jRHwhZoWC9sI5/DuT61m:ir/XoglyHHwhZU9sI5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630180247, "uuid": "f625d529-9c7d-448b-ab5e-f60c7a1b65dd", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630180247, "uuid": "ee1b914e-a510-4a9e-a20a-599173b2488e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630180247, "uuid": "9f0f51ef-5b8a-4d2f-8958-b7d54f589916", "value": "d4d66258546efbcc87356f6ecfa0e925.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91c36d1-0843-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630184750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184750, "uuid": "d6e85f8d-d1d9-4272-ad16-618d5276ebb9", "comment": "Malware payload", "value": "50579cc1c7dc10700860f4aae7d5066c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184750, "uuid": "1e474231-d13d-48c3-a542-ae2993dfc14a", "comment": "Malware payload", "value": "5fa7ea1b81de3d022f80c5df0111ca2307d138f652da3604da265e05980971ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184750, "uuid": "f9706124-6e0b-4f4f-b60d-d860ed1beda3", "comment": "Malware payload", "value": "81ded28df74fdd6acc37113081acd6ed67ed8637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184750, "uuid": "f45d11b7-d775-40f4-bae3-572d505a7bbd", "comment": "Malware payload", "value": "6b8d050165a3f71ffcd33ce69f40188fadcf1ba79067211580e2636bcd1e685479c390bf35f1ad54be711a7f279ee83d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184750, "uuid": "3088f5fa-108b-4828-9587-128a50b466d6", "value": "T11C95336249A58C0EEC15B9369BE86B003178760BABF1D2FCF25E767F92D571F0460382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184750, "uuid": "91e9cc67-8ca6-4c66-91ea-19c351adae0d", "value": "49152:eKJPBl1Ec3mpPosbKLfWTYON73JnEpsML:nJPH1zc1G7iPRJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630184750, "uuid": "7ad5f204-f89a-474c-8ba9-29eaf42b9790", "value": 1998848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630184750, "uuid": "7f4a07b0-6acd-4e2b-ab06-c9064a9d4158", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184750, "uuid": "8a5b6356-d3d4-49a6-8925-821394751814", "value": "50579cc1c7dc10700860f4aae7d5066c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6371f897-082c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630174728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174728, "uuid": "e89c37ff-8aa1-43b8-9027-0be0b5bc37c8", "comment": "Malware payload (CobaltStrike)", "value": "81e48aba47a4c33ed534bf1d929182b6", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174728, "uuid": "9daac66b-1053-41ee-8538-663a5e6ae294", "comment": "Malware payload (CobaltStrike)", "value": "602b4c9555eff5a32e4ed4196cc69326d49bf30846eb42a6db178f2ee3d2f44b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174728, "uuid": "d4fa144b-9583-452f-9e49-82d130f036de", "comment": "Malware payload (CobaltStrike)", "value": "ed483be278ba3ce7f74b8d9bec78daa5d5f35fa2", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174728, "uuid": "2950e3eb-f656-4740-9632-f3e78c4f0198", "comment": "Malware payload (CobaltStrike)", "value": "1cdafc255564a5f937071cb11ba5e3c86fdccb1551b31f43e4fa85a937b8f079838dce3e9d0bd5751a3889bab95d1bf7", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174728, "uuid": "e1873b42-7582-4222-b41b-8b151869bd5b", "value": "T1E324CEF8A87B0DA1FED4563D997C2CEC0FAB78DF034211FD9A8CB435B0556880AD1999", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174728, "uuid": "c4f4b2d4-7c69-45c7-99d1-5b87cfb58a40", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174728, "uuid": "6ce86840-1173-4f5b-86e4-9c13d5496db4", "value": "3072:0n0XHqgE8YzAMDLuspafV0Yp1cR6abXs85ExRHLdN501aYhlDL5ZGQnuQMQh:rbrGAMDL6fV0YzEsK2LPSakz4QuQ1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630174728, "uuid": "5a57b5a0-54f6-4d4c-9c8b-e10a54b01844", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630174728, "uuid": "e3741f21-8a1b-4730-97ab-a2cb8cc39f21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174728, "uuid": "16ee8a3d-7719-4cc5-bdc6-f7574743eae1", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2f1952-07e5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630144199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630144199, "uuid": "0c4d7bb6-e265-46dc-9d73-8873fc9a5a16", "comment": "Malware payload (DanaBot)", "value": "66e876c02af84b153315d9328d032cbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630144199, "uuid": "b2242302-89d8-4797-a0ce-36cb3ff366a8", "comment": "Malware payload (DanaBot)", "value": "621b28440d4dc9ea07cf3a81589b36edc971232d40a03569cfef5f4e2293d321", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630144199, "uuid": "db9d5628-bf9a-4f41-b2c4-8486313575de", "comment": "Malware payload (DanaBot)", "value": "796bdd4a6789d2bbd1f70f26f3ff7dbfc11770f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630144199, "uuid": "6a89241e-6f3f-40e6-aaf2-949db34b534b", "comment": "Malware payload (DanaBot)", "value": "694395e567f6ccd8a047210ff7cf3a963dc320dc54536d2d9047305f22a4d7f6edb1b652d7d1bfa8f2ced3d2767453b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630144199, "uuid": "2032366f-0ef3-4909-9aad-25c8aa39d76f", "value": "T1A13523047EE0C566F7E94A306CB2A2D753B3AE615232DB27B7446EDC39A208041D8D7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630144199, "uuid": "80ef9c6b-e1ac-449b-ae52-8e3be160a88f", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630144199, "uuid": "79222249-076c-4e95-8884-2aeae2a8731f", "value": "24576:zLgk1ZgKHLy5k33Pra5mlVrk4l6Bsfi9gE721wCc8xQuMdIFtWatp:Pp1ZgKHWwjy+B6yfi+Ey1/bxmdop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630144199, "uuid": "de6d942d-c53d-436e-9a74-2009b24af342", "value": 1089049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630144199, "uuid": "2eb08069-1a75-4a2c-9d99-6743a547549d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630144199, "uuid": "5e0b1190-409b-41bc-ab6b-c91fbd10da69", "value": "66e876c02af84b153315d9328d032cbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3190b8a7-084b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630187958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187958, "uuid": "5dacfe5b-e2b8-4504-93ba-5c1deb91d3ca", "comment": "Malware payload (Mirai)", "value": "7143e26c53d11c4bb45d324799fde57b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187958, "uuid": "0b1acf65-fbd7-46cc-a75f-dcf930968ee5", "comment": "Malware payload (Mirai)", "value": "6334c9fdaf7a0e209a86d68cd07298429fdf72d5e15bf27bc75551de10d79480", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187958, "uuid": "95ada08c-f53c-4b8f-8fb0-b5e82a306a74", "comment": "Malware payload (Mirai)", "value": "fe03cea192d215f57451667046e3d962810ab471", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187958, "uuid": "8eceb2ac-a238-46ee-b9d3-9dea3d4be2f1", "comment": "Malware payload (Mirai)", "value": "22cc71b6e94975987ad5fa260e2ab8d0e173b88059a4b689508e2fb761aade037315f56acc082c301e5d4a71fb1ceffe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187958, "uuid": "45ff5152-b173-44fe-aa62-06556a0526e6", "value": "T185E2E19E65E83DB6DECD483E138C0939AFDB689743649B85272144C4A72E4B8F4DC07D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187958, "uuid": "07886fe8-0294-4dde-b1ea-ee303f9d2ecc", "value": "384:X3fpCLrsjHIX69URc+hmnulY1qHprFKt6zhS45vDajssVwf5PrMya39RWGVCz0NE:nfpWcehzJFYKgULAssKfxa3LWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187958, "uuid": "6053bc22-f15d-4ee1-96d9-582509c1f290", "value": 31960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187958, "uuid": "264d6997-dd77-4b7c-a367-1746ae89d10f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187958, "uuid": "72a60e41-22d5-4efe-a273-55dc17172d96", "value": "7143e26c53d11c4bb45d324799fde57b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74702b7a-0821-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630170032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630170032, "uuid": "72eefe81-38bd-48e6-b94e-aac4576c73ce", "comment": "Malware payload (AgentTesla)", "value": "72a36b510e3da5103c3d67deb5c23bf9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630170032, "uuid": "282bd7dc-be8d-4ef9-8ddc-0ebea978cff4", "comment": "Malware payload (AgentTesla)", "value": "635eb39e1cfce400a91e879a4278b2c1bba9d2f5e49ac18f44f077dad7abd8d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630170032, "uuid": "69cf47b3-0c4a-4bda-b34b-4a9e489eb89e", "comment": "Malware payload (AgentTesla)", "value": "f8d2e3cb103e64b3461fa0d397e55163bfb7ec97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630170032, "uuid": "62580ad5-306c-46b4-a78f-09e54ae21a1a", "comment": "Malware payload (AgentTesla)", "value": "d42df59bbcaf8f9395023802f7ca1f10962597872f182ac7b67a8bbe46db5cffa33f417eee618c0f0dafa715bdff86be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630170032, "uuid": "904213be-062e-48c7-b82a-309c047129d5", "value": "T1C4B4BE39F790CD33C17B2A388CEAD1640A74B7911D35B9463EE8494C4A27BC2BD1979B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630170032, "uuid": "bb844c83-27d5-4fd5-8534-c42f36f73350", "value": "b462095fea3219e285e54ac0547eead6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630170032, "uuid": "cc151600-ccec-46a0-9d9c-fcb1ed9e294b", "value": "12288:rGq/MJz7bLg0EKsWmAhndfnZs8svfozj/:d0eQsWmAhBIvfozj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630170032, "uuid": "fb414979-5e97-49cd-a51f-65d3cced0d81", "value": 533376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630170032, "uuid": "8efd45d6-33a7-45ae-ae84-dba994b87fc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630170032, "uuid": "0ad56324-c3eb-4b3c-9064-725db0273f1e", "value": "72a36b510e3da5103c3d67deb5c23bf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cb3218-0801-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630156154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630156154, "uuid": "51bef7db-226a-42a8-8c8a-cbb15d43a439", "comment": "Malware payload (Mirai)", "value": "366403a53fc8faef7ae1208a12320264", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630156154, "uuid": "a208ae03-711e-46c4-b277-64b042eb1496", "comment": "Malware payload (Mirai)", "value": "65f476f58a5757e099e89f62dcfa889ba8ace954f9b6aff7be3c72607e03aac7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630156154, "uuid": "eae71a69-21be-4c53-aa2e-8d65e3c32373", "comment": "Malware payload (Mirai)", "value": "8a174f8d6bb6717141a1188e04b3ceaddf1c88fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630156154, "uuid": "684b6eaf-ccb0-4fd3-b8b5-38ef73c1c7d9", "comment": "Malware payload (Mirai)", "value": "b7626f7833407e3b2ee5c1d5bf88e35cad048b2d26b48fc06af2d93635231779f87e32e6cceb1f1d97801311bb2cbc38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630156154, "uuid": "865d5788-2d84-4c40-899a-bc8180f7d180", "value": "T106734B32AE251D27C0D4627A21F78220F2F6531E22B4851E3DB10EADEF78A4471677B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630156154, "uuid": "84299a3c-e61c-4130-91f6-0cb1f955025f", "value": "768:DsnoEjo/rmgbLydlasD3/QPgsQqLszZO+75/GMg2FiF1tYFRmI3:wnjjo/CgbLydAuPBO275E/tYFRmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630156154, "uuid": "7aeaa5f0-d329-4ecf-8b74-d0f07796de14", "value": 75152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630156154, "uuid": "99d0c817-1869-4154-939e-b663d4fb2277", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630156154, "uuid": "5b6ad9dc-11a8-47e2-913b-412d62a7ba8b", "value": "366403a53fc8faef7ae1208a12320264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1079a06e-07f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630150107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150107, "uuid": "9a78595b-faf6-4027-8efe-55209f7f86e9", "comment": "Malware payload (Mirai)", "value": "68d2151fcdc59907a62552786d21f459", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150107, "uuid": "cb5ee4d5-97b9-459c-92de-9b1fa8876008", "comment": "Malware payload (Mirai)", "value": "66ad0aab93aa5607d497bffc597ddb1f8814f52445f7fb6ee1b1570eb186d246", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150107, "uuid": "71105f6e-a993-4ca3-b3d0-8655113b1528", "comment": "Malware payload (Mirai)", "value": "a283e7abf593c78d06690557ea9fd08713260105", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150107, "uuid": "17761c5b-4f42-4dde-ad25-dec9ad05f374", "comment": "Malware payload (Mirai)", "value": "c86590a61128eac79a086e34110ac9d00ac21e6e66ba7c51f3b3450c3bc563ccd5fe8f2806b6e02b3f9ba62c4d0384d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630150107, "uuid": "c86b0d64-59dd-406a-8978-becadd1e56d1", "value": "T175333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630150107, "uuid": "473173df-3732-4e44-bf00-d3a5b1f50aca", "value": "768:8CeKEfhe5XdrbentIYfNMQn5MdgFHj0iPuvWeffpqmUJTXr6Lu380D6:dsfIBZeNlJDFj0imvppqmUJP6Lc8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630150107, "uuid": "c36a6c45-3b3e-45b8-a75c-ff5c64cd7af5", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630150107, "uuid": "3d8ad18a-d22f-435c-b2d1-87b35e72c8b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630150107, "uuid": "83d0e3fb-e85d-41d9-999b-6c02eea82fa1", "value": "68d2151fcdc59907a62552786d21f459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45abf239-0813-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630163940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163940, "uuid": "a785729e-3eec-40c8-9c4a-65bc29e1273a", "comment": "Malware payload (Mirai)", "value": "de336ba6430215f133259c8d4ca194cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163940, "uuid": "1589fafa-232a-4aab-89ba-d831fe33726a", "comment": "Malware payload (Mirai)", "value": "67a31b368c835bf5b630d7e703330c703fa02928786f8a8a3b1e648b13bb3dc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163940, "uuid": "2ffc9864-eab0-4b72-9d66-ec5e7a7f291f", "comment": "Malware payload (Mirai)", "value": "be327f7172c8ea451b8715e6b83b23a5814284b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163940, "uuid": "3d4386f1-5d7a-4993-b7e7-8d54cf2b3efe", "comment": "Malware payload (Mirai)", "value": "b0e497106582c772bb94e323bd64b995f46e31d3e62b06ddfd4781b7bfa2d46366e0fe88f7878e5e0a5c6c04367872aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630163940, "uuid": "74c0dd0e-7216-481f-8c0c-0f80251e77ec", "value": "T10273288AB9C19F11C5D5167AFE1E125E331707ACE3DFB202DD18AB20378A96B0E7B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630163940, "uuid": "6bff15d8-f0f7-4b07-b37b-107e5c078294", "value": "1536:NQnab6kTBQGj0MQOEoac3szFG8IviADRppQjmWa5MYAIKo:X6uBQI4AacDRppQjmWayhPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630163940, "uuid": "b4612c14-3960-4e8c-86ba-15bd920e00f5", "value": 75284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630163940, "uuid": "50ca73db-5e3c-4531-9595-45f01f31f52d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630163940, "uuid": "8bf3e989-2a05-44b9-ae53-5093f3d4bbf3", "value": "de336ba6430215f133259c8d4ca194cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2870a4df-082f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630175917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175917, "uuid": "1e378adf-bed3-4cfa-bc04-56a93dbe7a5d", "comment": "Malware payload (CobaltStrike)", "value": "7ed8307064ed69abfad67db1ecc30f68", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175917, "uuid": "ecd229ba-035b-4708-bfa3-279bb1462e4d", "comment": "Malware payload (CobaltStrike)", "value": "688bad6e742d9ba51f0205a1d2d83ecd555d0213c94b5684b1aac4525f971658", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175917, "uuid": "ecde3166-6535-4e3d-bc4a-15ab10bbd5bc", "comment": "Malware payload (CobaltStrike)", "value": "c17e7ef7f9f8cd5e398836fb7bd7b08d6191b5ec", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175917, "uuid": "17e06f57-5afe-47ed-9fc7-95058a61dcfe", "comment": "Malware payload (CobaltStrike)", "value": "d3093903235d1f0105e701281486c9ee58571ad68b09b78bc0ec3e5ba09e3c150c26318a48c7b6de3806d636452fd927", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175917, "uuid": "cc68ba10-8275-4bb1-a178-d382e9ce9f96", "value": "T17524DFBA3D4F0EA9F4C7193B107565BEBE5DB447A8B1C8204F639C9BD428277A319231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175917, "uuid": "6cea1147-3d8e-4afb-bbbb-6bc91f502ce2", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175917, "uuid": "1794496d-8e7f-4d20-a783-840ce46a006f", "value": "6144:LK9mtDBmssioq+0wU4rE4/yIatouQIzSf0Pj3:LLt1mFipoVEd/1uf0L3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630175917, "uuid": "4ec0d3de-065c-402b-9a23-82f146cc167a", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630175917, "uuid": "29ec2ace-7b71-4734-8df7-277f3dd6d134", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175917, "uuid": "b0344c0b-1afe-48cd-9355-c44dd8d03f22", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d22cf91-0811-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630163201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163201, "uuid": "1eb62b35-17fc-4c30-aa44-f56679c68af8", "comment": "Malware payload", "value": "5b3ea928e0e5119bc86d30a3b45e2585", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163201, "uuid": "eef2b079-b770-4955-a324-2606e3ffdd4e", "comment": "Malware payload", "value": "688bc90a2817644b65bde746117dd6b64da2c139a28b4c76408ef9aecf91fb02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163201, "uuid": "9c472c7c-beec-45a9-93ed-f0059e9107c5", "comment": "Malware payload", "value": "759e6f0d8c1c35e5084ade2bde57d113ce49ca4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163201, "uuid": "bf3ca1e8-7993-4e02-8002-29e1ae4388be", "comment": "Malware payload", "value": "55c5aee6c234b654da703b518cd5afd7680e49f3d27bd134b12a2c80c51cf6ec98296c83a91a9b515ad5a8e7cff4658e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630163201, "uuid": "1853d6dc-69fc-4f22-847f-f0321df38f19", "value": "T145D2E1E45BC8B877DA251DB9F4333F227989EA13AA77FCE909C44894D101591DF3825C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630163201, "uuid": "b4c58f07-341e-4669-9a8b-b65f4290d8e3", "value": "768:/xIczz7VHD/tiFym8hgELGusNIJqDHUD9HFm:5IK7VZi8ngEWLUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630163201, "uuid": "b59b9ed7-991e-4dc4-93c6-857b2ab8f8af", "value": 30661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630163201, "uuid": "a8369186-4686-4e41-b59d-4f4641ea0b97", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630163201, "uuid": "5b743b6f-e84d-4a7c-83b3-92c80cd91b9a", "value": "LNK-File-Itself.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2e4add-07e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630145808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630145808, "uuid": "36b43365-cc4c-452b-a420-ca9dac517783", "comment": "Malware payload (Formbook)", "value": "a1d2eb1b3b136f097bf55235e896f14b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630145808, "uuid": "ea37fac4-993c-49c8-a3b9-a9452423dbd7", "comment": "Malware payload (Formbook)", "value": "6a48a1bb2cac5fd1bcc700d2aa244bb2e68cc5f675c0adea8a99d25feb0b2be0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630145808, "uuid": "34e247e7-9f69-49bf-96eb-0490a25e9bb7", "comment": "Malware payload (Formbook)", "value": "916ba9deff328d8883dc2575a3c48c4b8f86b359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630145808, "uuid": "bd13a74b-88ad-4007-83ab-061342968adc", "comment": "Malware payload (Formbook)", "value": "b5e1dff5254487adeef22054646ced82b524fa2f6d2350d6bfa26e15a2c48f7a7f74e4d69516f2a6fe674ffef0538a82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630145808, "uuid": "1a5c9480-6686-4e39-9a6f-e40da391adf4", "value": "T190F42C7F19BDA2279175C6F58BE38827F0108B6F3110696476D343264326A7AB4F336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630145808, "uuid": "2780a10e-90be-4392-8253-7d20ab087044", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630145808, "uuid": "56ebe294-3009-477e-8a06-96b397ae7527", "value": "12288:zUpOJEqPeu6bYTReSqs9dzQl3BkobD/gZ0z:YpaEqPeu0GRks7SBzbDG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630145808, "uuid": "b002a35a-8308-488c-a54c-e7d4f7a18cff", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630145808, "uuid": "54c9f8c8-883b-4e3d-9d6c-72cf521c0752", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630145808, "uuid": "26a444a3-cd0d-4490-8e19-007cf40898c5", "value": "QUOTATION 2021.08.28.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fc93e1-07ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630132539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132539, "uuid": "2f9893e9-e18d-4b67-8c84-3201782e1aea", "comment": "Malware payload (RedLineStealer)", "value": "4ecb4fd37a47ccf14c30fcd09762950e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132539, "uuid": "9ab2823b-92dc-47b8-b383-dc0d02297109", "comment": "Malware payload (RedLineStealer)", "value": "6a98a737d9e09962bf50a9bc61c845f64fd0fe9cc3630fc0636eeb14f749b9ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132539, "uuid": "3cabf1a9-dadd-463b-9637-cc5a844a0280", "comment": "Malware payload (RedLineStealer)", "value": "33367d3335e8bf37508747e7c7b398b1a6a7da1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132539, "uuid": "2892e03c-31e3-4d8f-8f10-88456c2037b5", "comment": "Malware payload (RedLineStealer)", "value": "2af03ecf1d50dfe634e9d3f3be7f3b8d6fad0b436f1d3e9c38519206e58d44beee198e5a2f47643c5a2840d50f569643", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132539, "uuid": "111fd3a2-1f9a-4746-baee-9eefd00c524e", "value": "T1A1F5334464429ACACDF9C4B5C03584531734ECB939B952B25358BBFECAFF522A22C367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132539, "uuid": "1db7104b-b91b-40ff-a6b6-2aa42f570c52", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132539, "uuid": "e6c60a76-d6a0-497b-ac71-819b8edca661", "value": "98304:r6UuyNRtp+WDdpWE/juGk2PFM2CJ603TJ+Sdc:rfjLppf/jLkIXK60kSdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132539, "uuid": "425c01b4-c789-4bd3-ab8d-a5bc36ddeb69", "value": 3400104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132539, "uuid": "6df0609e-6c6e-4af6-bd4d-db560b747d95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132539, "uuid": "661e8d39-986e-4d60-a38e-367bee83c333", "value": "4ecb4fd37a47ccf14c30fcd09762950e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc38a22d-07c1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GCleaner)", "timestamp": 1630128974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630128974, "uuid": "9cf92716-271d-4b61-90b5-257171b14e8a", "comment": "Malware payload (GCleaner)", "value": "78563a66f06fd8e6132d1ee4c8a5ab2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630128974, "uuid": "808a1d2a-36f4-4f8b-8d01-788cccef656d", "comment": "Malware payload (GCleaner)", "value": "6afa5829ac5dfbb7098a32cef1dca23e5bbdf9a1bc0805670451eeed534c5636", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630128974, "uuid": "9b3aef21-1789-499c-a969-c161d0669307", "comment": "Malware payload (GCleaner)", "value": "a2c487251cac61520c3156b46b80460b95a00859", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630128974, "uuid": "38f4f442-d984-47d3-bf53-802763a8306f", "comment": "Malware payload (GCleaner)", "value": "a5fa724def99af7784b011d1f2bddb5009ae4b51e376bee359fb541c01d2122d441c85558c1d85ba4e61f6269d240f58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630128974, "uuid": "39173301-3295-41a3-8091-b62b6f29cc78", "value": "T1E224D01136B1C173C5D32A7448EDA76226ABBE616B71D6873F142B6E3E322D0563D383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630128974, "uuid": "25fb503e-7eb8-4c38-9f99-cdc7516e3126", "value": "d3c9c233147536fd2cb825c3f3ce75bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630128974, "uuid": "e3814e0e-1db5-45cd-96ce-087030616a2e", "value": "3072:PbnNYGHU9936I0sKY565sQOuU2y8R5FNIzsI5/DuT61m:PrNYGHU9d302565sQxU2ZUsI5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630128974, "uuid": "66cb44fa-0a6f-4591-ba0e-715e8608600f", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630128974, "uuid": "5b11a0ea-474a-4e72-b393-409a7edfaf9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630128974, "uuid": "f7611908-f4bd-4fc5-a223-5e67f5818b55", "value": "78563a66f06fd8e6132d1ee4c8a5ab2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ba9c29-0835-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630178433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630178433, "uuid": "33d0bcc0-89ba-4de5-83a6-d1b499f02a10", "comment": "Malware payload (RaccoonStealer)", "value": "b733113bb83a06a284ad068e277d6fc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630178433, "uuid": "aaf69dbf-4d0b-4f56-b55a-472e5caa2428", "comment": "Malware payload (RaccoonStealer)", "value": "6b1bfe99b9172556bf604f1635b3251f8087d016e6c401330f2d8bd7910694f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630178433, "uuid": "d967d900-9e6a-453b-b07f-a17d941981d7", "comment": "Malware payload (RaccoonStealer)", "value": "f499ab81ad87b7f813afbff1d532d06e442dbaee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630178433, "uuid": "f2eeb52c-2bfc-4047-b848-265254861e3d", "comment": "Malware payload (RaccoonStealer)", "value": "9b4fff7246a135a712bada2d160b4ab07ecfc210932c30b9bf9571d2a86415487413d35006b38dbbc64138a0346d84bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630178433, "uuid": "a4929f6b-1c13-4a03-bd2d-95545f19efb4", "value": "T1D7940219B5B2C076C5F6997A4C1CE212332FA920AA7182C33E985F4E3F711D15A7D3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630178433, "uuid": "68c41b8f-dc32-4584-96ef-3701a922bcb6", "value": "065a584d0d50807005a7c41fcb9adea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630178433, "uuid": "0a66064a-1a18-4fa1-8e41-c7a377c58edc", "value": "6144:Y0xZtwxCOcu85iF8qLLBVl9ZXnik1ex0BeR1ooFJaRIWTkPD59NZXGd3ty0IWsIh:YUZtw4G85w8G9W0G1xNO419nyt8Hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630178433, "uuid": "346c4649-87c1-4ead-bfaa-2620b08c2c05", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630178433, "uuid": "2fda0f39-ff5e-4208-adc8-cb077c910320", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630178433, "uuid": "2ab02036-8649-4de7-be1e-68bd4418d1a0", "value": "b733113bb83a06a284ad068e277d6fc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e15142-0814-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630164269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164269, "uuid": "38d10217-a6fd-4d06-9e33-6177a786358c", "comment": "Malware payload (Mirai)", "value": "f9da410c963472253fe23f0ec3b6ed07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164269, "uuid": "87501338-54c1-42e6-b931-bedd1e2c0082", "comment": "Malware payload (Mirai)", "value": "6b4c5e7f06280a9d1a1dacca85230cc74ef96547ded93bab9e839dc2658f3a5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164269, "uuid": "37320eb7-dfea-40bb-9ade-c5a0de1dbda0", "comment": "Malware payload (Mirai)", "value": "df6706c3c0df9b6cccb025ca183024c0d61691a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164269, "uuid": "60b9b859-53c4-4a10-b408-7bd51fd11e28", "comment": "Malware payload (Mirai)", "value": "f3ba5704ad99a172b0a6f1288c0f055b02834b43cfb1eda3681228480b6c22cee712c8712d079ebaa35e4f8ff6df2a2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164269, "uuid": "ad4ff08b-a473-404b-871d-d24c23158852", "value": "T170635B97F840EC7CFC4AEB3B85130519B230B36606731A67A367BA076D361E45D2BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164269, "uuid": "4a2a7c9c-0cf9-4106-9dcd-ff0398557c49", "value": "1536:MiZU+Y9yKSqcCb/CT76x8ZqcTuTplk7CAKG3n8lUuHmjP:M+6AGc8M76ZNkOAhUGjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630164269, "uuid": "0d06e322-410e-446f-8397-bb58297d65c9", "value": 69268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630164269, "uuid": "f0e64fe4-1231-48bd-845e-45d82b93e813", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164269, "uuid": "a3ae0954-5dd7-48f2-9a56-41d16878741e", "value": "f9da410c963472253fe23f0ec3b6ed07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ad9f29-0856-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630192956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630192956, "uuid": "ae604e9e-1be4-4e6e-a3a0-602779bf454c", "comment": "Malware payload", "value": "3e8694561136ab4c87c591378ac8c1db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630192956, "uuid": "18390ebe-5ba0-468f-9b29-f3e605eb6072", "comment": "Malware payload", "value": "6bdea6ef5b3764a68cf05a361624a222184ea9495c639d9c9b37dc91f2a3d745", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630192956, "uuid": "5646142c-df3f-47d2-978e-42f8f20bdf12", "comment": "Malware payload", "value": "4cad15cdf06f1f19913a902f00001d8ad8375764", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630192956, "uuid": "a81a5366-d5f0-4a87-8815-834f88a06f92", "comment": "Malware payload", "value": "c3f10acc667023c11002e871678af927eec466179857bff10bb63fa2b3f58dd8adf1f5e3d876cea4f4cef28d06a4e76d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630192956, "uuid": "c7a5d7e8-1093-4d56-a4e3-377d6b86a7de", "value": "T114D5332036E881BCC6151973DAD09FD2C2B6E7591F728C7773A8167C6F7DA868432B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630192956, "uuid": "fa69de42-542d-4b60-be91-2dc815b7858b", "value": "e00de6e48b9b06aceb12a81e7bf494c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630192956, "uuid": "c2f6a0a1-6cdf-4cc7-9e60-0da30dd4776b", "value": "49152:LG5UfgLEPrxfau3beezAx+AkIo6qnBsDUCilzNdRqcFvyb3DfE6:LG5QgLEFCWbeeAkttBiUCilBn+E6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630192956, "uuid": "108e1e82-9480-42dc-a2a0-d5683b60a2b5", "value": 2920192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630192956, "uuid": "1370657d-8d4e-4d7e-907d-5fd899c58eda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630192956, "uuid": "82dbcfb9-5be5-410b-91ce-d38939a27ac8", "value": "setup-vlc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc02389-081f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630169403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630169403, "uuid": "f6b94af3-d165-4e18-ad9f-28e1af510f98", "comment": "Malware payload (Mirai)", "value": "0fc75f84518bd03949e6f516722385d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630169403, "uuid": "eaa897c1-7aef-46d6-99ef-09bd64cb0aff", "comment": "Malware payload (Mirai)", "value": "6be9b9fb84b614ca1cc1a3d0ae578a4d109c5dd0cf0530747e23271da2c3e007", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630169403, "uuid": "d90b7bbf-b274-453c-8df3-21cc66b6e182", "comment": "Malware payload (Mirai)", "value": "38f0cd9859eee15b03783fbe5ec67876684236d3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630169403, "uuid": "40f3b765-5f6d-4712-9c4e-f03e61956392", "comment": "Malware payload (Mirai)", "value": "2c99d767eaf7f2a494662e5257339229519819342d5a35abd59a8ef17851bfbdb77a724d9f269749c565b7134924be9b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630169403, "uuid": "d9143af6-10cc-4910-9e96-3f4ce5f89a3a", "value": "T12F03F106A2221951D5A32572FC6CD805777BC3FDD56F3A3401AC832538AE6439BFAB82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630169403, "uuid": "3e817a48-3b8d-40e6-8780-0fe8b7e67dfe", "value": "768:DxRteLv2kDo/3VUdYe1lYMfaRS2nATaYVf8gW6K9q3UELe:92J4V416Mt7BW6/Le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630169403, "uuid": "fe17a968-51c7-48d4-a428-9da0041976ca", "value": 39440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630169403, "uuid": "bbe55bee-06df-4913-9867-0c4d3ad8d6f1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630169403, "uuid": "00a42e3f-8db4-47f6-9f6d-75ce6e9f8145", "value": "fbot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1539b5-07f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630152007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152007, "uuid": "1262455b-0ec6-46c6-bb93-104508a98fca", "comment": "Malware payload (Mirai)", "value": "d0eafd8ead88632931004ade6291fa9b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152007, "uuid": "410a7ace-2128-4b5c-9629-c9d7c1658c68", "comment": "Malware payload (Mirai)", "value": "6c8260c03d4775e32655c78c019bdab8a86a7f28beaacffa46d573bbe06df7c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152007, "uuid": "0ccfa486-2dc2-441e-9c11-4376c937a8f0", "comment": "Malware payload (Mirai)", "value": "588ea4bff8bec8d4c1b447cd207342f52485eb1b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152007, "uuid": "c807fe93-167a-4c1e-8b8e-a74b679bc4c7", "comment": "Malware payload (Mirai)", "value": "8b0f5823d2dd429ce296f42f419928b791a6441bba03de79f666613c62e0872ca97a39992de7881aae10fd713e143a1f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152007, "uuid": "60ca962b-550a-4046-9c75-8a75195571de", "value": "T11CD2F1EEBAD272AEC044607704658D4C96F82C765B9B89836DDC75DEEE8712D1370B0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152007, "uuid": "0dec7127-9698-4fad-968f-410113ba7350", "value": "768:rzW8IjJ/d/Ti+/oFoGKG0wYLiCHtkx/oEIvYPmGVSUE4hImY8Qi:HWRZTi+/oy7FHsji4cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630152007, "uuid": "77441aff-7074-4025-9035-786581845c15", "value": 30844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630152007, "uuid": "727559a3-4bd4-4c97-8e3b-fc484e849a48", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152007, "uuid": "bd71374a-eba7-4891-b519-ab939eb41c55", "value": "Rakitin.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb127b1-07f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630152005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152005, "uuid": "17a2021d-7b47-4b4d-8658-0fae174a52a5", "comment": "Malware payload (Mirai)", "value": "1293de62ebfc3593d1110f3d0dbc5080", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152005, "uuid": "9acba093-7fe6-42f1-bd38-2a78f418788c", "comment": "Malware payload (Mirai)", "value": "6cb92db827be616f8ae6cece994b3f0262faee3d060be70feae691ae1ec7f744", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152005, "uuid": "2d04aac3-be0d-4948-8695-842831fbf80c", "comment": "Malware payload (Mirai)", "value": "ac1b46709f630c1210385f0c11016e8fbe47e973", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152005, "uuid": "88f11b60-96f9-4719-ae09-a26f70d7813e", "comment": "Malware payload (Mirai)", "value": "56e217117577f9054dc0b4b210da5984bb4155f8f0e82f0d889869c66a4751368d4e5e1cec0167ec741911200acbc14b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152005, "uuid": "aa73c11f-89b2-4f59-a39a-218c19cfc7ba", "value": "T1854302309573F2F2E6B45D360F4E99C9AF0E5D75D0B703895B4A026498E6D07BBB40A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152005, "uuid": "c76fa980-e88c-4708-bb02-80fb120da920", "value": "768:DdXkAhpfWn5/mjdRDil0dyz04DlJbY4zUuRy9Hs9q3UEL9DWBoKtzRr8YDu+c+yw:2AIWelsyztlJnzUoy9VL8tPTW+yq/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630152005, "uuid": "fe713172-a0a7-4b67-a058-d980ae37758a", "value": 58144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630152005, "uuid": "ab468e34-4b15-4052-b08d-f2f96a77650d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152005, "uuid": "e98e1b8b-8bfa-49ad-b54e-0df010fc62c5", "value": "Rakitin.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59da84e8-0834-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630178148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630178148, "uuid": "6c155024-0357-4fa3-b566-af26f1c46011", "comment": "Malware payload (BitRAT)", "value": "5e7de1a3b9d27f2b003f57671ebbd4dc", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630178148, "uuid": "d8abcc50-e261-43d6-9c4b-22af4f71756f", "comment": "Malware payload (BitRAT)", "value": "6e2510a76f130a0a009432183ed26d35d328cf34e8b4c9655327a9a8a89b8dd7", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630178148, "uuid": "c5bfd36f-37be-4932-9dac-39097a8e1262", "comment": "Malware payload (BitRAT)", "value": "8f26306c1bd5d61977cd90dbe843752a36b6e751", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630178148, "uuid": "d4a02906-508b-42cf-a7a4-0bb6b0fee19a", "comment": "Malware payload (BitRAT)", "value": "71c6c8873dea7fd3bd933c8361701de792d3d6f22c4e4b6fc02d2a5c265150d49dc79bc9027712b438d2d038c497d84d", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630178148, "uuid": "06be3f9d-9efe-4ab4-8d97-fe59ed5c3d47", "value": "T128F5CE3C98FD2927C066C6B6CBF8D427B404DA9F3226ADA554D757264353B8330D3A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630178148, "uuid": "2470796f-4927-47f3-bc63-98ab0b42d31b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630178148, "uuid": "3671de6c-0353-4844-b563-cf228dbc735b", "value": "98304:nQJfSTwwG0lPHCwsteuUwl6ORy2apSRQ+yqFB3:nQwZGGfhzwFEwa+yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630178148, "uuid": "ff2d861b-8336-426d-b629-7693e8591578", "value": 3621376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630178148, "uuid": "d2a8196f-4623-46d7-973f-beca7e4cf987", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630178148, "uuid": "96ac4a1b-efce-407e-8d4c-ca52c6824d51", "value": "8f26306c1bd5d61977cd90dbe843752a36b6e751.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d99835-0829-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630173603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630173603, "uuid": "f3ecc073-513c-4256-9036-6ea5890ad5a8", "comment": "Malware payload (Mirai)", "value": "1a10212d79fbad6e15fe38b5df3a73b3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630173603, "uuid": "2f2b9003-9632-402e-85b3-1fb6509cb7e4", "comment": "Malware payload (Mirai)", "value": "6ebe12c90eaf51201603297522b45ae34e174f71dc9e5a77f15cb36e9970634e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630173603, "uuid": "bb62d605-5463-4d0d-97e3-1561bc52cd27", "comment": "Malware payload (Mirai)", "value": "1ea653376f2a32e35d1d8426184ad99c371f8d7e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630173603, "uuid": "8b416931-8bec-47f0-ba8f-2e79be8674d2", "comment": "Malware payload (Mirai)", "value": "0c2d1dd8f6f0a3ebf206d36275c77f266176b1df167d982fe78c49f90e6625dbbfe38d8ab248fb038f6854f0e30bbd90", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630173603, "uuid": "8851698f-cd69-4822-b1c6-b23f85f87cf5", "value": "T183E33B86FA409E13C0C61776BAAF014A3322E755E3DB73068D185FF43F8AA5E4E57606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630173603, "uuid": "e3494ff9-a9b0-4011-94c4-cc3b8e126e46", "value": "3072:0rMrjDKMlbid2wnVMdO21MzcdTcLdVaTneYxbhAGpVyfa90tM/9V3Jnr:04rjDKybid2wnKbVUdVaTn7phA1fa9a4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630173603, "uuid": "d94898aa-72df-4152-a85b-e4945b432c56", "value": 150354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630173603, "uuid": "9690809c-05dd-4ea3-9027-1bbebab96f05", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630173603, "uuid": "05da1646-b593-4cfb-b933-db80756fa640", "value": "1isequal9.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809a1767-0842-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630184226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184226, "uuid": "8c0e4aad-7976-4eae-aec0-700a005bcf55", "comment": "Malware payload (Mirai)", "value": "1781016efd79e26c87dcbb8ebf7e7d6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184226, "uuid": "dc33640a-cb5b-47ba-ac2c-96e750adf575", "comment": "Malware payload (Mirai)", "value": "6f0e0d2ddfda9a75a7fc5500f5d5c74f647b0aea1fad44f6f016ed7c56434a5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184226, "uuid": "93bebeca-fec4-4230-83eb-ed5fa015657a", "comment": "Malware payload (Mirai)", "value": "fab36e45a28ba0b58c214e9c826fc19ee979e267", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184226, "uuid": "f383afaa-692a-491f-a73f-d8bae37a6ddf", "comment": "Malware payload (Mirai)", "value": "f13d1cd887316dea7dc6a2748f060266719054fb2d9d7c386539316395d8973370e83976b21c0d5ecd81022ceba0ac06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184226, "uuid": "d357692b-922f-409d-8cdf-3f1a5a8682e8", "value": "T1F5633B4272280F47E5A249B4253F1BE093FFED5024F4BA88694FDB5A4639E761086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184226, "uuid": "f7e59c72-cf96-4d22-bea2-15039be17504", "value": "768:rtbRcTIqx+TV7Rn0/qPhTS1qBeaqPfH3MZfD9OwhOm7SGa6swxH5R+h2xMBS62Os:4g7q0TS1qBp2PMvOLwx36EZIJut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630184226, "uuid": "3eaed418-fc99-4238-b16c-af3585586c76", "value": 66808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630184226, "uuid": "f2ab509a-08fb-4131-a41a-ff7b26df78f3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184226, "uuid": "a613c0e7-9a95-45a7-b65a-0927eb1ed1bc", "value": "1781016efd79e26c87dcbb8ebf7e7d6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddae24fb-081b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630167631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167631, "uuid": "5974ff5e-7f4c-4567-9c5d-9b16276ee779", "comment": "Malware payload (RedLineStealer)", "value": "99e98c0d5122c38e1fc3885092111fff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167631, "uuid": "0ef201b1-a235-4fa2-b993-d1685b8d68ac", "comment": "Malware payload (RedLineStealer)", "value": "6fe100707f04edd5edab46ab148ba902e609a418d6e29fe3dddda0a8a5bb2fd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167631, "uuid": "4e816b3d-568a-47a2-9949-898a1a58c560", "comment": "Malware payload (RedLineStealer)", "value": "93afab714d86aa97cc706a0726cf7bcec36cdf07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167631, "uuid": "3b9f939f-2efa-4df5-a6b3-cba2a9c0e1bd", "comment": "Malware payload (RedLineStealer)", "value": "896572d57a84ee405078f10a9172ad29d622477cdf35781dd456482d89e317ee8ff2dea9622f53cf9a6814da3b022a28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167631, "uuid": "ca59e914-1984-4cf8-9ad9-482668751a0f", "value": "T166D4DB28657FC019C4E7EEB12DDCA4BAD99A94E3640D763311B4A33B8B11B84DE0F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167631, "uuid": "df900cda-20ec-4213-9df6-8e4d910ef573", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167631, "uuid": "c38c2b22-ce80-400a-aa56-b8833941be98", "value": "12288:ZClXHzC7b94xVEXTVp4D6Owv3cEShbRh+MPjCa7jhxTGUZWds/C8vifHyd+:EdoHP4DRx7V+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167631, "uuid": "a4c3cd67-3ffd-4c06-8596-909a92b026ab", "value": 645504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167631, "uuid": "7703d3f9-190a-466e-8fe4-eb79f7f90623", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167631, "uuid": "45b1eba2-f323-4a43-be79-6ddad12b46da", "value": "99e98c0d5122c38e1fc3885092111fff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fddc646-0800-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155877, "uuid": "b44cc074-e0d1-4ad7-a711-d8592d6c90ac", "comment": "Malware payload (Mirai)", "value": "3ed87b56ef037639d56351b21d5aff94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155877, "uuid": "e65886b8-017c-4771-aa6e-74fc7c3b1d95", "comment": "Malware payload (Mirai)", "value": "6fea037da5b9a9d4b16a28d66d1452dd5e5b9abe9c615169c969696f0ccb91cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155877, "uuid": "03dfb21d-2298-467d-8a97-6f32f33ea6e6", "comment": "Malware payload (Mirai)", "value": "63ec2f50966c760b93fc7ce39808ef5a4cb22800", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155877, "uuid": "9e733690-29dd-4d99-bea1-a26404710170", "comment": "Malware payload (Mirai)", "value": "bc38c159b33ab6bf514a23f39a570c5abfb093ab707b64ac1f510eab2bd9d5a021d09eeb1bf4f2e163a6300ed38b2fe9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155877, "uuid": "b71fad13-b87e-4728-a999-7a6a1a5db0f8", "value": "T1D1B2D0691A0DF8B0D2708834ADAA93C725DF0EE9D1BA363336D44B597F459433C792C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155877, "uuid": "a392b8f1-8293-4712-974d-312ed0a29c22", "value": "384:qrR5Z6gtWkY+iTULFUycBswe573K9VAa/SM7OYIjPmMJ4yGZymlhymdGUop5h7GT:DoWkq0FUEwelR7M7Ajt4Mmls3Uoz9GT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155877, "uuid": "e0892653-6426-46f5-a071-187f7bd2cd4d", "value": 24184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155877, "uuid": "1593eb5b-d4a3-466b-83f2-31b617faeef5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155877, "uuid": "b80191f9-f998-4492-89b7-b56cc509595b", "value": "3ed87b56ef037639d56351b21d5aff94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ce9015-07f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630150754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150754, "uuid": "80518082-92b6-4e30-a705-bed3ede635eb", "comment": "Malware payload (Mirai)", "value": "bfa6c48f9ac45bb025c5109e941d53a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150754, "uuid": "65e085dd-cacb-4a29-a8c4-02a13f0210e9", "comment": "Malware payload (Mirai)", "value": "709d96fbec0c6ff3921c41041d747ecbf305dea5a5131ef871133dddce0cc444", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150754, "uuid": "504d9795-8bbf-4664-b7b5-73568dc616ee", "comment": "Malware payload (Mirai)", "value": "2ad608b93c44b4f27555045879667284e83dc09d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150754, "uuid": "4ee61f3e-d0af-476a-a8d4-650ecfa7a326", "comment": "Malware payload (Mirai)", "value": "d9a01ebd7b0e16e47f17d1f6c4066cf130af6df97d4f8fe3c78ce73ae97909c69eab8d8cf51a897d7c7bdd44e85523d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630150754, "uuid": "d59df886-9a0b-4e9c-b492-902375e02f79", "value": "T155432925AD792E26C0D8B57E11F78724F2E2220E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630150754, "uuid": "354456d3-a2cc-452a-b751-f61b6b28f691", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCD8:eL0AxvSHfymp0xgunvCkV6vTMDauv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630150754, "uuid": "7409b6a6-5e14-44aa-b1bb-250432c84742", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630150754, "uuid": "8d8c238e-e1c6-420f-84d6-558aed3e9c46", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630150754, "uuid": "240efefc-63a2-4219-8be2-daed0938df14", "value": "bfa6c48f9ac45bb025c5109e941d53a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3473f9d5-07ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155321, "uuid": "acd6f305-9179-43b7-930b-f4e62ac656a2", "comment": "Malware payload (Mirai)", "value": "d587fea1189c37faf351b5c16917aa5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155321, "uuid": "1b1a905a-9ad6-456b-9bfe-9fe4fbb70dbc", "comment": "Malware payload (Mirai)", "value": "71fe19d51451484b6d2424e3b6ad94b9f5362be08e0e511c4719bc87e061adff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155321, "uuid": "dc00eafb-ac22-4b1a-b0f7-17b30f4af1c6", "comment": "Malware payload (Mirai)", "value": "ada2341067ef4da66b584bba0f59410c619e05c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155321, "uuid": "54e421dc-378c-4b6f-82fe-bbfa929be15b", "comment": "Malware payload (Mirai)", "value": "ad7fbf68214806a06e424bf955ecbada4f193d0a9f641193a1ef0b7348be7a9a669436346d04e0747d755603ebfb0c87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155321, "uuid": "80af619d-4528-4506-a2d1-5523f6557bc7", "value": "T125E2E00EF988BCC0C8BC4E3E958D6BA11F4C6095B19F4744D7088D005F6959FBA9F979", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155321, "uuid": "c03efe2d-6417-4513-9428-b0f58cf2f886", "value": "768:trRKG+yWmYI0mgk+ziBcszEngW5q+b+3KgPBYsWa:tEGfbH0x7rJgWkC+66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155321, "uuid": "fa613ebe-36d5-4663-8324-6d7bc56d9896", "value": 33988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155321, "uuid": "b9a2bc1d-314e-4883-91d4-cb86b6bf6ae1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155321, "uuid": "b64d41dc-4c27-4c60-8f64-174aaa508da0", "value": "d587fea1189c37faf351b5c16917aa5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90271975-07c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630131853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131853, "uuid": "4ed2f483-9243-414b-b5e7-94d14ef9d779", "comment": "Malware payload (RedLineStealer)", "value": "666efbbf0961e0bb0cd4d7a08765121e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131853, "uuid": "332b94eb-e3ca-4a47-8e9d-724ac90be92c", "comment": "Malware payload (RedLineStealer)", "value": "72419701cb0c2edae18a01e70e8ea37d2acbfcd3559fc7999c16a05d05176d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131853, "uuid": "0beda3f2-a991-42d7-85c0-e1adfea336c6", "comment": "Malware payload (RedLineStealer)", "value": "8a078de2475a4217c52876244ddb44000f8a2f43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131853, "uuid": "03d6863f-237e-4148-bb9e-bb308f6d9e11", "comment": "Malware payload (RedLineStealer)", "value": "eada379e5846ae0cb547f5b14c2f7f36df0a72125e5350b7bf92582938100e6fea5e1dc25dc9b8a6ad75041f85130cf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131853, "uuid": "2a0bf67a-f19e-4a9e-b0bc-4d32da3da6cf", "value": "T18174AE30A791C035F0F712F499B582B865293EB1AB7490CFA3D516EE17386E8AD3174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131853, "uuid": "f001263d-6872-44b8-bb8e-8804ba27adeb", "value": "ebf21d5f80ce6d78a1158dea28ff74e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131853, "uuid": "911caf5b-5303-4827-89d1-3501bb615ec4", "value": "6144:C4pNiHLT7Cy3f+gW3d2ODUYK+fiDdyh7ZIAjAdOfwatXicZauF8:jirHCAhW3RUNOipOZIAjXfNis8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630131853, "uuid": "a4184170-4223-499d-81ca-e3f9b1635c2a", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630131853, "uuid": "7eabfa3f-af12-4cc9-bbd7-2e90628f6ddc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131853, "uuid": "7c72742b-61fc-4f10-9e66-5ad86e6158bd", "value": "666efbbf0961e0bb0cd4d7a08765121e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bd61cf-0849-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630187405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187405, "uuid": "a3c2bc11-f5b3-4f79-ba31-c47646bc5332", "comment": "Malware payload (Mirai)", "value": "6e35c3b98b4ac512b9383101886ad614", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187405, "uuid": "ffa79ec5-ea7c-4267-be64-a7156fed5740", "comment": "Malware payload (Mirai)", "value": "74338039f48b75d5c143e69bf70d91918f005e9d504c754463e4152280aa9d31", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187405, "uuid": "0c578846-cb3b-444b-be16-858ca037c2eb", "comment": "Malware payload (Mirai)", "value": "8a7f957fde6ff35def4c62866af5e4c3d9ff270f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187405, "uuid": "73bb04e1-a379-46d9-84d1-61280dc84cce", "comment": "Malware payload (Mirai)", "value": "7138e54a53ab275f9f4c4981dc17f7f01b72c315b26708ef0cc241aa0b2b7f1cf20222b7c222063fc9805cc79133a7ab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187405, "uuid": "775fb777-e424-4ee4-9339-2da31626d07d", "value": "T108534AC8A5C3E5F5EC001D79307AABA1AA73E53F2039ED9BD39E25739942243E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187405, "uuid": "fba7d4b8-d821-4393-8e06-264078d29b4c", "value": "1536:b5VYYpXIqVkxmxRvXMFnKiacjGKO18Hq6PWRORu0+j/iMAm9:diYpROxmxhXMFnKlMGHCHqlmu5/uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187405, "uuid": "0ced7690-8b23-41db-886f-6df027e599c6", "value": 63664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187405, "uuid": "002fcf85-1a8a-4c0b-ba47-d3e2ffa41450", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187405, "uuid": "0698d16a-f1bb-432f-a431-75887f3147d2", "value": "94VG.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcded8b-079c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630113136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630113136, "uuid": "5bcf57ce-0de0-4167-9a44-ee197074fbac", "comment": "Malware payload", "value": "a4d1aef9ba64ad4300c744297795bc42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630113136, "uuid": "608225f0-86d4-402f-9e4d-adb760304384", "comment": "Malware payload", "value": "74cf2e1f4dce793dc8bc01b3d1691e102c08bb15a3c65bb5c06a48baba0e1fb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630113136, "uuid": "a4724af4-fd17-4962-b09b-215bd4d2f966", "comment": "Malware payload", "value": "be899148b1549b1cec6e2eb9db0f94e700fc0334", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630113136, "uuid": "ef67a43e-622c-4d12-af15-31f18dc12f99", "comment": "Malware payload", "value": "2b0352b6e82dad712f11d7f798b70db8ae3c2615a0109a8665b8a34cf04b6fedac8d37d6d41f599120fe9fbe5a10264c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630113136, "uuid": "ea12ea50-deb8-42cf-8193-b71b50edef71", "value": "T11235909514C4AFE7DCB6F4FD8EEAE016FD121650C1E5854946C0084A0AF93F3A6AFB39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630113136, "uuid": "25a34ac1-e867-4328-9d97-ff98a5831ddd", "value": "65819c91413f83b464d6a3d119bd6467", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630113136, "uuid": "6b55e51f-f4b4-401e-aaab-2fb487b9eeee", "value": "12288:9fHnu1hxBOwTdG7MDsDbQg779SweGIvdZOyjGU+G0VCspXMl3A6Gnzq9PBa8nT2:pHK3OwTd8MQDbQgHgUIv1jGUXuCs9qW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630113136, "uuid": "d9ac2354-c158-407e-ad00-1c155ba35c25", "value": 1089665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630113136, "uuid": "a309743f-5f90-486c-96df-05630359cef0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630113136, "uuid": "8a1d0983-e46e-4c13-a908-821f9c35635a", "value": "caf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f6d368-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630167701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167701, "uuid": "410c1a71-ef39-47c3-8179-4524647d6870", "comment": "Malware payload (Smoke Loader)", "value": "5cc61bd14b963a21c2bdd6dbfe5e59cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167701, "uuid": "c17b028d-a5d5-4532-ae4d-280e0232d8dd", "comment": "Malware payload (Smoke Loader)", "value": "75396399dec99fb23320c38dd0c84504be4f8ae1501a32f7f7d16eb0a8d0f9c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167701, "uuid": "b6939b21-3329-4e33-a00a-0b632bfd1686", "comment": "Malware payload (Smoke Loader)", "value": "ce635bd44c3e3dab6b4e0c1b2a33e3e1454ad9e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167701, "uuid": "e6eca2f6-71bb-42ed-9c9e-307ffb1bc0df", "comment": "Malware payload (Smoke Loader)", "value": "932d9311ad953228ec979377c2e981119ef2b9fbb89886d631bb1cc193c4cfb79a6f6b3a2ccdeaaabe88ad5ac3e38ee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167701, "uuid": "82861e21-44dc-46d9-9f6a-84762317a236", "value": "T182D3AF1136B0C572C5C718758869E6A1672BBD315F71C98B3BC8476E3EB22C0B63D2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167701, "uuid": "83e234e3-2908-47f9-9e60-51d58fc33a1f", "value": "4f5dc64597ca4f695b16cf6dee89f692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167701, "uuid": "96de8b54-e6fc-4227-b060-6baec239876a", "value": "3072:ywSo2wol4ajGsTYolK5zj3nsI5/DuT61m:JJqZZw7sI5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167701, "uuid": "f77e2138-3e9c-416d-9e5d-1a1f8c47db84", "value": 140800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167701, "uuid": "6ffda11d-59f7-4deb-98bf-455a0c14a878", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167701, "uuid": "74a77c55-b98e-47f5-9108-a53f4e4be3fd", "value": "5cc61bd14b963a21c2bdd6dbfe5e59cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac45564-085a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630194604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "d173d427-2e3c-457e-a9ff-ab68b78e88d1", "comment": "Malware payload", "value": "525ff5a7030c5de8baad6d2222c1bd1d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "943f55c9-d39f-42d6-a2a3-f925c077a525", "comment": "Malware payload", "value": "7583eb0b5de3934b824f0daf9ab322649fd67dfb8621f4c5f9c0b91536ac8113", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "255db2ee-49cd-4dc6-96da-4975e098ef8a", "comment": "Malware payload", "value": "f5729cd166ebd7a59ab98c29a2b0d8266e903aed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "d3c9c826-edbb-4dca-b63c-1d7423fa3e61", "comment": "Malware payload", "value": "b0344ccd1a9e84592f806fd726ee2e2c1d1de16c446b92e77095f13a2d297b76d0fd98faa44985a8580462883e5b6aab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "808432fa-35b3-4522-bcb6-3d809a2c6086", "value": "T124A3842A3E21EFFFE568863107F35E7097D5629226A19386F25CEB181F6128C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "4173f84c-85e9-49f4-99c8-1c01b13211ed", "value": "1536:S7j+1TfCq+LzIfK2rKIfmaHy6rfV2D3nea2bS1jxlrimW+zWBSirHzai:VR/fymd2D3v2bS19pimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630194604, "uuid": "82e52623-1ff4-421d-816c-a0b76395063d", "value": 104712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630194604, "uuid": "4c70152a-9f83-463c-9f05-29af801e8f72", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "d47a0c7b-9fdc-4fa3-92aa-9d57cffaa2a1", "value": "earyzq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08200fd0-07f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630150093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150093, "uuid": "322cb73d-3b4a-4b08-ac82-5b9298daa14b", "comment": "Malware payload (Mirai)", "value": "aa62fae7114600360a1badb2bfd4ee11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150093, "uuid": "9d108a89-a1da-4c71-8908-271cbf41a75b", "comment": "Malware payload (Mirai)", "value": "778f1ae0a2258f702204ab9420a84b9652ea5ef86531113faf656fba15473b5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150093, "uuid": "d01a8f2c-5439-42f2-a9ad-62d53fc28458", "comment": "Malware payload (Mirai)", "value": "2368804e71c907ffd7a5126d9e67ca1acf7ec56b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630150093, "uuid": "dc514f81-0afe-4f86-88b2-57bbec497361", "comment": "Malware payload (Mirai)", "value": "37fcae7fa6dbbbffa14202edf66406bd92c54d0878013748cc1f2abc7194f4f5a450193bb81385f59efee1ff55cc6894", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630150093, "uuid": "3e14f7c3-8551-4337-8d45-49c62e2e4424", "value": "T14BC2E1DFB4967985CC1C5CBC21DC56D11669A2C7234B9F0837203DCDAAB645EF8AC8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630150093, "uuid": "4b9db5c1-8f83-4a34-930f-cda721c3187e", "value": "768:MLCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdB/WV:oCrJgHiOJrfwmQrcts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630150093, "uuid": "fde6d65c-2c59-4f8c-9f61-064f675fef1a", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630150093, "uuid": "245a9189-e1b5-41b8-8ca4-5acc17fb9b71", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630150093, "uuid": "ce560763-6300-4adb-a4ac-f2f5c4d33074", "value": "aa62fae7114600360a1badb2bfd4ee11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8306d7-07f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630152010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152010, "uuid": "62ab732f-f9c9-4c78-bc23-a9af719bcd2a", "comment": "Malware payload (Mirai)", "value": "7919106ede63d94973fb2337888ab62b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152010, "uuid": "2728f0d9-d99b-402a-b702-5c79ae840d09", "comment": "Malware payload (Mirai)", "value": "78a20b2df6fe2388de78e5fa43a157a52e455011e4f152da9e3ac9bf43796605", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152010, "uuid": "0792d0a6-3305-4959-a52f-6179bc4d1196", "comment": "Malware payload (Mirai)", "value": "523429c2410a38e74f87b44d0e7a21f8397e8061", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152010, "uuid": "1350d6c8-73a1-42a8-b591-3067a6b9605e", "comment": "Malware payload (Mirai)", "value": "aa9752894f23089d3c71e53130585be357fe78867d95995fb9147271167db240f8ec5e08bac33fc4c3c44b65e3b94a21", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152010, "uuid": "ddc52bb9-e388-4ba0-b17c-30c8078dda04", "value": "T114E2E1813ADE7FF7EA79D436E9250207C9974E78D5EA3C723240C295B1C36CC29E1986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152010, "uuid": "fea85104-f71a-4970-ba7a-9be09fbcc360", "value": "768:mCauXufnXx6BNWvaVXPsT6XJlqvZgm1X7hCchPHns3Uozo:mC/Qx6DWCrXfcZgMwchPazo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630152010, "uuid": "2e18cba8-972a-47be-844a-ee6ecdfc844f", "value": 33076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630152010, "uuid": "8c6ca9e0-63d7-437a-9562-eb4631144ad8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152010, "uuid": "d1be2b7a-07e3-4d0b-86d4-56500c867b12", "value": "dark.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bff9ca-0845-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1630185336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630185336, "uuid": "494ee0b8-e70a-4f27-9da1-536cc03a331b", "comment": "Malware payload (DiamondFox)", "value": "b54032fc01363b6a3dc2378196c4bc4c", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630185336, "uuid": "f627cebe-c15a-4942-8701-6ba6bb47b7c9", "comment": "Malware payload (DiamondFox)", "value": "79d64ca8a0ebef312050fb2a06a68d246aa0acacb30764da9af8fdbc5f821d0a", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630185336, "uuid": "2b563cba-8564-4d6d-82f2-77c01e0fb1fe", "comment": "Malware payload (DiamondFox)", "value": "c8d3b054ace51f4d59d5f774d690b92b672ac593", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630185336, "uuid": "8f0a9426-3d44-444e-861f-8b25ecfe0f3d", "comment": "Malware payload (DiamondFox)", "value": "0fb721c980a343c5fe0b0c3a5362d10e16533484f0df89a400a4b2cdfc9932fcbc733309599674b3831010e6b554b359", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630185336, "uuid": "cca3bc95-4751-4360-96a0-81305667138f", "value": "T107363345770C40F0EEBBE4F1941B6BF24D97B60AC27C35227335CA699E4898E21BE476", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630185336, "uuid": "87a23850-99b5-4e3f-ab25-ee8bbcd9b764", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630185336, "uuid": "dd117192-3583-4008-b772-76bb916aeb6c", "value": "98304:yurQAZvwDAU9lMnvJ7Y1f8kPon/ox2agN1LwZ+x2vc8DHI9MdoB:yMEDflMnvmf8kPIoyN1LwEkPHI2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630185336, "uuid": "e6a84c7c-ac04-45f4-88cd-0325a627cee7", "value": 5046573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630185336, "uuid": "ccaacfdf-af0e-4460-81ee-e8cbc8df7f48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630185336, "uuid": "7b122f3a-b8be-4c08-b76d-fd1642f44622", "value": "B54032FC01363B6A3DC2378196C4BC4C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615bf076-07c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FickerStealer)", "timestamp": 1630132204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132204, "uuid": "6e524b4a-0a03-4fd7-9f83-81e9198684f3", "comment": "Malware payload (FickerStealer)", "value": "27041b8e37dc80cc783f807c639c2e0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132204, "uuid": "ba38e09a-aa17-4742-93c0-f20530aff3ae", "comment": "Malware payload (FickerStealer)", "value": "7aa03ed6935a820850ae6a10b4e8715123c0cf79412925a56b7c55a04b4929a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132204, "uuid": "baa65dba-9c20-45ec-94a0-490b2803b6f3", "comment": "Malware payload (FickerStealer)", "value": "c4a0ff2bfa649764291378b2a4a46903145b90c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132204, "uuid": "6fa5a84f-0971-42ca-8044-60f56c102cf4", "comment": "Malware payload (FickerStealer)", "value": "7c21a02c4cef8d6f86a637e11b7376ee14842c7c10cdf632c03206e70f8655b43be674c271391bd912b58b540af1a471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132204, "uuid": "902e6eb8-2dc5-4712-9553-251a9c7e7757", "value": "T126B47D3055F45C29FE9622FC45AB836AA73D3EA09732C3C7427265F58B235E6E970342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132204, "uuid": "a4a67019-dcc8-4c3e-94a4-194efd7c1ce0", "value": "ebf21d5f80ce6d78a1158dea28ff74e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132204, "uuid": "f4bd9769-b796-4428-a602-31f79e3b1579", "value": "12288:plHHjTbTHrU9RZ8V0lQhJdFPwvLmGe0EXaW0rN3:TH/vHga06hJdpcCGhU63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132204, "uuid": "f7155baa-f70d-4b54-9136-6fc80822a8bc", "value": 515596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132204, "uuid": "8a445507-afe2-4572-90aa-18c2bf4cc98c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132204, "uuid": "e1f515f0-daf8-4018-b22d-5dde8449bc84", "value": "27041b8e37dc80cc783f807c639c2e0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c363983c-0823-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630171023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630171023, "uuid": "487e359e-5eba-4610-98bd-5e229cab9c91", "comment": "Malware payload (Formbook)", "value": "628faeeb6947bb6c169a95026d62826e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630171023, "uuid": "d38971c1-fa2b-4b31-a903-4091b002c675", "comment": "Malware payload (Formbook)", "value": "7da12f9f66e5a7ee4f9a6a025c6c3a1464ea85d0d805d2f7e85537c24a4ad6c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630171023, "uuid": "0eeb72c2-1236-45b6-8243-3adedae487ac", "comment": "Malware payload (Formbook)", "value": "b30dee07345f79718b537d96ad4b8d450c26c980", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630171023, "uuid": "9204f807-654a-4e6d-be89-6ab22d2c595b", "comment": "Malware payload (Formbook)", "value": "14bca96f5c02463459b8810cd51f3a83777a2a25ec13577b6d04b015b732dddd626bc4d6be2682662ee82ef835c0e292", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630171023, "uuid": "966144a9-893c-4bd6-9d48-13255e339f16", "value": "T105B412253BC7663FD7AE4AB8657C0229937A8477A583E3C30EA5C1E5A16F3ED12045C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630171023, "uuid": "609d341f-c7ac-49ca-8d17-575d27540dd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630171023, "uuid": "caeffaf1-b0b4-409c-ae6e-709b9686be6e", "value": "12288:szhoi6+4T615AgbPza8yZ2o/Ke4FqmFlxLVLIFb8z1:/i6O1KIzaR2o/Ke4EiLWM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630171023, "uuid": "675ace2b-8e20-45cb-b25a-216c5b2db52d", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630171023, "uuid": "78925a21-42ee-404e-8325-addf0186997b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630171023, "uuid": "6a7347a6-4d2d-4461-8901-a076b8724aed", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6861204d-07bb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630126203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630126203, "uuid": "4f276e9b-00aa-411d-a83f-4522ecd6da62", "comment": "Malware payload (Mirai)", "value": "53d20354132d9b4531fe1234002f7a8b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630126203, "uuid": "2c3b1b41-3c83-409c-b01b-3f11693563e1", "comment": "Malware payload (Mirai)", "value": "7db57524744fed7869b62b84e6a448967e01dc268da0fef5310cc1c9acc06452", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630126203, "uuid": "aa1f988b-7e26-448e-a9d2-13c1cb37e09c", "comment": "Malware payload (Mirai)", "value": "bccffcc49719c38b4e102b1ad5afc859e7607af6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630126203, "uuid": "b9c213ff-dcb1-441c-b0b2-967e6472a979", "comment": "Malware payload (Mirai)", "value": "0537184cad1f165bc637841654f16804f2da7a680243b5c9e7cd82d3ba6de71fdf0835d7d7cd3ee1f11a65d710000216", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630126203, "uuid": "fdd8de6e-5ab7-4cf8-958a-0a7a7444ee2c", "value": "T17E736EC4E683E4F2EC06467430B7FF328A76E1BB5166D983F3E49A33AC51142950769E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630126203, "uuid": "c2089474-c6ad-4f03-a627-92b72a212f9f", "value": "1536:Gy4NIZUUNwipWi2U3oQt8ztAFRnpuCrne8nOl6GuSLv:GMnNwipWi2FQt9FRpHnZOln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630126203, "uuid": "7b6f01db-7092-4fba-98af-e0fd4b18f7fd", "value": 76852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630126203, "uuid": "f58f4433-09ea-4140-9523-906d1951add0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630126203, "uuid": "da61e0eb-5ea7-442a-9934-ccc90c75d412", "value": "BinName.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d482c0-07fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155005, "uuid": "0077a83d-534d-4bfe-b7c2-83006eab7bf1", "comment": "Malware payload (Mirai)", "value": "272094e2c6f64ff8a353c8286c205627", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155005, "uuid": "9eb5dabe-90e8-47b5-a3c1-2f30a8e65a27", "comment": "Malware payload (Mirai)", "value": "7dc10b302b8dbd63ca48c300b79595e6c50bdd1f21b46a71a49b3d1f890340ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155005, "uuid": "1db53ed1-778d-41f0-a9a3-06675f1db83d", "comment": "Malware payload (Mirai)", "value": "7cb08977381f5e0f6eab241b242750e627b0f3ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155005, "uuid": "390bb9bc-b864-45ea-b857-9bc39468a611", "comment": "Malware payload (Mirai)", "value": "937c717038730a93a0e42d4871a5dd276ea8ead25a3a161c4ecc021a55a7048a80997741105f053065a88372496cbd37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155005, "uuid": "4854a2ef-e57e-4c18-ad0e-e7070dd94011", "value": "T15FC2E132C95B1095C86D467B24AF6E4E18B1F6ACE19585F7F8CE0A7DA4C21343F643E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155005, "uuid": "06b86655-dbe8-45d6-be09-b356a134139b", "value": "768:DC/su//JOqvstwXbo/XaBQ7V+9cnbcuyD7UHQRjY:DC/suuwroSyJdnouy8HyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155005, "uuid": "4a4cd1e1-52fa-436b-a5dd-daed21e226d3", "value": 27948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155005, "uuid": "992ea507-87a0-4c86-b658-8aa19e3f5357", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155005, "uuid": "8d860ed8-41cc-431e-914c-f0a9274b8b17", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7734b0-07c1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630128971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630128971, "uuid": "a4973eb6-44f0-4609-a270-48675d341230", "comment": "Malware payload (Smoke Loader)", "value": "447701ded182bf3533ebd005afda6b75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630128971, "uuid": "ad2c48c0-ef9e-4aff-a5a6-692a58de0407", "comment": "Malware payload (Smoke Loader)", "value": "7dcba4df8e7c0c82d4b5bd2206215094e0833125181f6d66d18e1dda33899b15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630128971, "uuid": "d4ebf63b-6fde-4a92-a785-95fd3582584e", "comment": "Malware payload (Smoke Loader)", "value": "03a338f2e77a45ca26dda8d231d44216f3f07ce4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630128971, "uuid": "85eec9db-d81f-4583-a765-199475e572bf", "comment": "Malware payload (Smoke Loader)", "value": "a7337ff9b7e01083e79799ce827486a528094647c306ccdb7f7e6be81d016055f7d94cbc66acf386627d4126150c31e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630128971, "uuid": "a12ec755-c670-4ca4-965c-fec05e9953b2", "value": "T138E3AE1676B1C573C2C219728829A6E0263BB931DF7CC487B748579F3E712E0962E397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630128971, "uuid": "262b26e0-fdb0-4abf-ba2c-f3581a14abad", "value": "d3c9c233147536fd2cb825c3f3ce75bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630128971, "uuid": "aae85ccf-f44b-4fc7-bcb9-c2a2e79dc918", "value": "1536:jiMStSJsIkd+eUOkiCFYuX6EHRB/fShDYVzTTbMHLvunK5kIQdWsjk5/Npj6T61g:OWXYuXhxMhDa2vunK5kzwsI5/DuT61m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630128971, "uuid": "76766ba5-fc8e-43df-9bbe-9e6abc313c1a", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630128971, "uuid": "d78a3b53-b5bb-4d04-98a6-c3531af2a012", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630128971, "uuid": "7ad96d6b-bf47-4a7a-b75d-2de5f3b9ce4d", "value": "447701ded182bf3533ebd005afda6b75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cfb923-07c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630131861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131861, "uuid": "220d3094-35c3-4853-8279-4ff78f537faa", "comment": "Malware payload (RaccoonStealer)", "value": "69713961cf33a17d5f313e4f541f6443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131861, "uuid": "4035e126-a0ee-4f76-bfa2-6083e8db94ed", "comment": "Malware payload (RaccoonStealer)", "value": "7f2e91f56f3d65721aec23a3aa1133d23c0329bbfc89f365201a3bfe4345a983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131861, "uuid": "80a3774c-3430-4290-aba8-6a87a66018a3", "comment": "Malware payload (RaccoonStealer)", "value": "9ffffeea42ebb025db914f64348629f6b786ab51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131861, "uuid": "5e4b0f5e-4082-4a3c-af57-9c543080eef4", "comment": "Malware payload (RaccoonStealer)", "value": "0d151525688a51db73ec492885f8956a40540e5c9d0a919f3362dff2ab4f6882afdd0e3ab7270d92e89ca15bcb5dfc94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131861, "uuid": "25b7fb4b-948c-4cd1-9637-e62b4fe3d1db", "value": "T161B4DF30A791D035F4F752F499F58378B92A3EA16B3450CF93C51AEA1A356E8AD3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131861, "uuid": "f41ba123-f0d8-4674-a218-71ae8743ca32", "value": "ebf21d5f80ce6d78a1158dea28ff74e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131861, "uuid": "8be674c3-2501-49ab-a049-71e28c36691e", "value": "12288:4MbcH9BzNLnYW+bKfIHHBNW7TNp8CHW9/GKcIGi:/bcXpLYyIHHerS9/GjIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630131861, "uuid": "74f5c007-0c3f-4d1b-89d3-4cd58137e797", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630131861, "uuid": "4356b2f3-9106-41e8-b89c-d8c0ff101728", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131861, "uuid": "773efb02-2ac8-4b09-af16-e7087e270879", "value": "69713961cf33a17d5f313e4f541f6443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62add31-07ee-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630148211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148211, "uuid": "a309bde2-9e45-449b-a790-9288d0899d2e", "comment": "Malware payload", "value": "99f4738248cd52ed80f45b4536645125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MATCH CONSULTANTS LTD", "colour": "#1AB902", "exportable": true, "hide_tag": false }, { "name": "NukeSped", "colour": "#FD42CD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148211, "uuid": "c3de0efe-b1bf-4e01-8f50-4d8a4373f900", "comment": "Malware payload", "value": "7f614448fc2dadd4bc8a8e495e53d1d05c13d7202eb519b687f9b0c2996b4bef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MATCH CONSULTANTS LTD", "colour": "#1AB902", "exportable": true, "hide_tag": false }, { "name": "NukeSped", "colour": "#FD42CD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148211, "uuid": "4f9aad03-eacb-4348-8c0e-99bc72ce493d", "comment": "Malware payload", "value": "86919455877d6eed0fb4244f3583a61c83ac8412", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MATCH CONSULTANTS LTD", "colour": "#1AB902", "exportable": true, "hide_tag": false }, { "name": "NukeSped", "colour": "#FD42CD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148211, "uuid": "56667cb3-a394-41a0-94b0-3ac5fff46728", "comment": "Malware payload", "value": "e66f2a8cf8d9d872bd04bc8d909f8ed2a9791a9f00aa20c15df9678258e789a181360719604a9c81e3a1ef58fff10a5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MATCH CONSULTANTS LTD", "colour": "#1AB902", "exportable": true, "hide_tag": false }, { "name": "NukeSped", "colour": "#FD42CD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630148211, "uuid": "35cb755c-5e3e-49ee-8832-2be11423e861", "value": "T192B5334F6D933CC0CEBB9CF40185A17560E20F31E7B5527E92BD905A251CB2EA7385BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630148211, "uuid": "8e7f5288-5920-4dbc-9512-c28c270c5187", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630148211, "uuid": "a9ab323d-1fa4-4f83-ba72-d3983f29a40d", "value": "49152:qjeoROvJaQNs/LX7ECI7xMrMXjjBKJuNqxON7oULTDIUb:ce+Ox7eLX7xIRUuExGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630148211, "uuid": "bc40af9c-bae5-4c32-bdb1-09a02fb6c5ea", "value": 2431688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630148211, "uuid": "7f94cd1a-874f-4bb3-83bb-5ba7315896bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630148211, "uuid": "1a48e2b4-e3d6-4a35-a13e-fbe9121b13a2", "value": "csmgr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b407daba-07ed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630147805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147805, "uuid": "3ab75634-fbc7-48d9-a490-797b51fb81e8", "comment": "Malware payload (Mirai)", "value": "3da71b2eb2a79f84bcf6d2c9a387381a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147805, "uuid": "8d6bfa21-2b0a-490b-8aeb-ecae93c274fb", "comment": "Malware payload (Mirai)", "value": "7f9f5266ae3827fcac7e437dc6c7eba4857201a0c4a5e56c7e4cdfa3b6b86a59", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147805, "uuid": "1e48b609-d274-40b7-8d3c-77a88368d9db", "comment": "Malware payload (Mirai)", "value": "2a7cd5aee09db224961bbdb670c0eb9e4717c182", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147805, "uuid": "2517ab88-4f1b-41e1-b73d-396ad3b21aeb", "comment": "Malware payload (Mirai)", "value": "437c48e3ba97a3d8723be0c7ef72824ec46246e4205f328e8f9b601e1e910119ca429f9cf07f80e673fdec7515a2d2b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630147805, "uuid": "c0cd0407-016e-4dbf-8786-18985a3fbbd6", "value": "T1AEB2E195D6FB2BC3C2919335D0BC8A4DE1731AC00746450A5109729F92E760F8BFB3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630147805, "uuid": "e51c2ae9-67c8-4518-9b69-a8751574d6e5", "value": "384:MVDKKQOcRpmYLdn6RBOFRFt5rUFX1DiSIlCo3AnupCFNqnrrd1NEZgO8UXWozPLc:w/QOC0Yhn6ROHWFlAcwNEFCnNBxcwcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630147805, "uuid": "c437d558-8ab0-49c5-9b64-c5df8573b4a4", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630147805, "uuid": "80eeb609-f1c0-4327-a431-e61d644fac2b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630147805, "uuid": "34e03ba2-50d4-4e55-ada2-b200bcdefd9e", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bae668-07cb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GCleaner)", "timestamp": 1630133290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133290, "uuid": "62ee3f16-1ebc-4c9f-87c1-96664e4ed042", "comment": "Malware payload (GCleaner)", "value": "4f369314f4e591d357b36c29118a8484", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133290, "uuid": "9620d7b1-7484-4a15-b780-7278d7985f35", "comment": "Malware payload (GCleaner)", "value": "7fc7bbda1f57d0c876e7457efc6e832b7646446dabda8583891e16a8ed53fc15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133290, "uuid": "1f721299-273d-4dc0-a654-2c843fdb0461", "comment": "Malware payload (GCleaner)", "value": "dcd5cdfc85e4843e75f3396a3daacab1c12e79b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133290, "uuid": "f36fcc70-96c3-4746-a776-7bba2c105ab8", "comment": "Malware payload (GCleaner)", "value": "e3dd9c4bdd4bd9a67b2824343d73d19602d2159088b7d34760b97b1241ccd75ae77c1d242b355d91500fc52be7c96b2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133290, "uuid": "11a330dc-2309-46c5-bdf6-68929a2de815", "value": "T18F64AE30AB90C035F4B722F489B58379B5393EB1672490CF92D52AEE1A345E9ED31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133290, "uuid": "5a5633fa-5051-4d59-97bf-117eba8fc302", "value": "ebf21d5f80ce6d78a1158dea28ff74e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133290, "uuid": "62828ac1-9a06-4bd0-bf17-acec8303bd46", "value": "6144:94DY7pRLT73yZF9ZO/t2Km0IEn10MCpU3qPRHTgoeKnq97/5Ot/kdPC:9p9H3WRO/c0L10MyYqPuoGlBkkdPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630133290, "uuid": "5aa0c249-a764-4e9a-8472-88c1017ca820", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630133290, "uuid": "4c86f0c9-41ed-4cb6-b7b7-60634c475100", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133290, "uuid": "986bb62c-dad4-4dd9-890b-f6cabee835e1", "value": "4f369314f4e591d357b36c29118a8484.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fed72c-082b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630174469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174469, "uuid": "df6439b0-146e-428a-a0e6-28e7890d6ae5", "comment": "Malware payload (CobaltStrike)", "value": "7c4c76623a11ccf45df83ce768d36c58", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174469, "uuid": "e21267ac-a8b7-43e5-8197-9bd95021dd12", "comment": "Malware payload (CobaltStrike)", "value": "7ffcdfcac7c74e41ccbd5fe6f96a73fc347a28172c9f682d9ab8b4f8c165e732", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174469, "uuid": "64a0cc99-ad36-4861-808b-de03cac1f72b", "comment": "Malware payload (CobaltStrike)", "value": "731007dba421502237d86eae2b38a804c5259512", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174469, "uuid": "ff239beb-0b2a-45e5-9fae-1c6353d75945", "comment": "Malware payload (CobaltStrike)", "value": "da1a8a9d473dc6fb05f54179439d3d001785d18ae8c6acb63130607061d40f9121a862f2e7a4a52c96ad3ed15220c338", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174469, "uuid": "851024a8-217d-47e5-9d1b-b59b35bfb2fa", "value": "T1B324BEF8A87B0DA1FED4563D997C2CEC0FAB78DF034211FD9A8CB435B0556880AD1999", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174469, "uuid": "2d8319e9-8885-47af-b12c-989d50966736", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174469, "uuid": "6003e207-228e-4ff3-90cd-dcb04fd152b9", "value": "3072:Qn0XHqgE8YzAMDLuspafV0Yp1cR6abXs85ExRHLdN501aYhlDL5ZGQnuQMQh:vbrGAMDL6fV0YzEsK2LPSakz4QuQ1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630174469, "uuid": "cf2d1ea7-2bb8-45cf-b288-ef0dd62b0404", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630174469, "uuid": "862f79fb-eb42-40bc-9878-5d8cfe92fb9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174469, "uuid": "2efac3c3-7f38-49ce-a27a-0836d3abaaaa", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdbff71-07ee-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1630148032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148032, "uuid": "db0fbe5a-09c8-434f-8139-48262799ac6d", "comment": "Malware payload (Cerberus)", "value": "fc4f4dfb9f312af032672ae77bc769cb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148032, "uuid": "ffd86bc7-4f6f-4d20-804a-eefe3dfc1c75", "comment": "Malware payload (Cerberus)", "value": "8045102c0180c6f41b28893a69939004924d8dd9fa4d54a804c69fc5788b3d9f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148032, "uuid": "a66ec109-34b9-45f5-b5b3-d8db9623ea78", "comment": "Malware payload (Cerberus)", "value": "5bd3060d874aef477e63e898285c32bd4a29b0e4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148032, "uuid": "0fbb3553-03fa-4f31-b707-69d701ac2211", "comment": "Malware payload (Cerberus)", "value": "c5a2b433db3c685b1b06697b39730cbc8d51e3171304fc7edb4f9742ffd68960fdfd6616d2b08a07c89c4b37425d07c2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630148032, "uuid": "4d575dd5-0d97-4356-b91f-c291f49773db", "value": "T19FF53365D7839C1CD917817040C62D8AF57274BCC6D36AAE1AF90068BCEF985C726EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630148032, "uuid": "41f0d02b-f2de-488e-a92f-ad06b4cf2d1f", "value": "49152:PiZZX+J5IR13eGL93TFr4cMXeOpPfr649MYHbbz5C7pcUO58QJ9v9qQtMOPN7+2j:TInPL9jFr4cwhT6gMyo7Q5TTMUNCPLpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630148032, "uuid": "7b7c5c3f-61a2-4937-8617-3cf8c1cec4a4", "value": 3351851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630148032, "uuid": "75e0de78-f7cf-450f-a74a-27676ad4100d", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630148032, "uuid": "8f5ce5e4-02c2-415a-8878-a1a1cebc40d5", "value": "Gizli_Cekim_iFsa_Videolari.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4e521a-07bb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630126206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630126206, "uuid": "26e5e66f-edc2-46c0-bcf3-d3a3d8853c76", "comment": "Malware payload (Mirai)", "value": "eda16851bfdf5b20c0c1c49f8bcaa401", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630126206, "uuid": "7577473a-47d6-4a7c-8c07-f93ea05dcd7c", "comment": "Malware payload (Mirai)", "value": "8256978065f4f4fb0e0c3bb8bf9c45d7fa0ca04010543d27d301e5a78f7b676e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630126206, "uuid": "b153a929-589a-4b23-9629-7660ee650a06", "comment": "Malware payload (Mirai)", "value": "8617fa5a8f2f32cc70b643868608dccc5ab678dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630126206, "uuid": "b5ca9c23-98e0-4ffd-a045-27b68bc569aa", "comment": "Malware payload (Mirai)", "value": "a9313734e2ddc1d2eeace4456073271b9f180372676cc57b90f7b8d6e52e60f16ac4b1cee0da85eca951a53a9c3b1f52", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630126206, "uuid": "2467b36b-76a2-4f66-93d1-9a4d9c1bf22b", "value": "T16D834A95BD918A23C6C422FBF62E528C372553E8D2DB3103AE311F6536CA52F1E37A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630126206, "uuid": "452c04ac-9d7b-4ff2-a54d-4e1eda228513", "value": "1536:4r07+ARQqkscTtKJZwr1n7RKOD+99P0B9rPE6xn2KM+tjEaAJzYYBw6Guca1NWC:4rsQRsEcJZwrZDLBCy2am5FBwG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630126206, "uuid": "85b2e24d-ea41-403d-8059-eee4e9a131c4", "value": 88676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630126206, "uuid": "17a3da69-cdda-44d4-9ba7-c6f0b17bf7c3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630126206, "uuid": "105ad952-a27c-4ace-8e91-f234040efa2c", "value": "BinName.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36cffb08-07ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630132562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132562, "uuid": "3217d7ae-871b-4220-9a95-104555bd33ca", "comment": "Malware payload", "value": "6f2ab131c8f72433aa1a70b0401a820e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132562, "uuid": "3c03df16-21e1-4b6f-8507-3742ae6739fb", "comment": "Malware payload", "value": "841377de0b079aadf7e486a293d2a285f3e2e2a91cd6ba6bc3c423b8aef41c4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132562, "uuid": "66a7ec85-787c-474d-bc8a-c6bf76ef6303", "comment": "Malware payload", "value": "f8f196740a584c0fac15344c217c0e6386bd8d7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132562, "uuid": "0168defc-c4c2-45aa-9cb8-097994a553a9", "comment": "Malware payload", "value": "052cbb39cdf958152871db82918a0424f2b6314e64952577f51d31b7cb23dbea8d85007271f29cd13fece6f2d9af2a94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132562, "uuid": "e275709e-af3c-4f7f-ae1c-f11030ca7f3f", "value": "T154B533D52DD41219E9E40B3131D282AEFFA96938CC7FB6B844471133D79773A807B86A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132562, "uuid": "19a83c1d-71c7-42a5-808f-6741a41b6083", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132562, "uuid": "446948d8-49f6-4165-813f-e2e79a3fad10", "value": "49152:i05Plk6SJKS9O5nJfS44DCS8W9s0pOocNA6Im8G:iYPRaI5JfzvY9QhA6Dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132562, "uuid": "4c8730d8-273e-487b-b24f-54e0873b36a6", "value": 2303365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132562, "uuid": "80a5cfb6-2974-4cc8-a9de-e4f12de0072f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132562, "uuid": "b9eef608-98f4-4b09-b5be-6ac4f2edcae6", "value": "6f2ab131c8f72433aa1a70b0401a820e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85b3124-07c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630131920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131920, "uuid": "bb4ff12e-6c6c-467c-b79a-fcd13ff76da3", "comment": "Malware payload (AsyncRAT)", "value": "66051b5b99155147ef07daa0ca713759", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131920, "uuid": "81cf07cd-ee77-44db-bf66-30787d701164", "comment": "Malware payload (AsyncRAT)", "value": "84cde5b3cca04584373101e1cb4a4f991e6ffcc3463be77bad7c08b03b2f828f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131920, "uuid": "92480a0c-65db-4e05-8bd8-febea0604b48", "comment": "Malware payload (AsyncRAT)", "value": "5784b09fe9086374b6b7fb234c731b38fc97dbde", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131920, "uuid": "962555ba-f53e-49c1-a073-2b091b1f3f02", "comment": "Malware payload (AsyncRAT)", "value": "8d740091ed56b1333cd789261d85da4db6dab1bc6efef2ef5c73a5a2ff74401a1c3e1d4161c93ea6fa43435720686c2a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131920, "uuid": "5b5e71de-71eb-4edf-862d-c80ac92c26c9", "value": "T19F23D105BDCCD433DBB846BE196697460FB5873A5097E78FB84C5162BF023A616232E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131920, "uuid": "b6e55728-28f8-4590-8a19-d470c2df6f7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131920, "uuid": "043020b0-0ee7-4b5d-b104-1304ba76431d", "value": "768:YR5G52fTGFg39tjsmEq/1QAs+9jOpldjVNQ3FBa6MABNzbC1kqE5rIVV8ZVc6KN:Sgcfj3nsmEqNQj00jBK3FM6MABNzbbEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630131920, "uuid": "5ea8bbf0-74c0-49c5-b491-771fe4338222", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630131920, "uuid": "7fdb1861-411a-40bc-bb3c-423e4ae6dd1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131920, "uuid": "af129c26-e8f4-4f84-b181-5b0814ae34b7", "value": "66051b5b99155147ef07daa0ca713759.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881525f5-07c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1630131839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131839, "uuid": "94bb556d-e9a7-4cca-a16a-5399493a4b83", "comment": "Malware payload (TrickBot)", "value": "07c60de3ec3c5bdfd5b518ce6cb580b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131839, "uuid": "86acb299-0af8-4ee1-ab7c-008201dcdb46", "comment": "Malware payload (TrickBot)", "value": "853fc3d10d574ec5e10595bf8ec5418e0899fc065d59ebe417ba6a95a27211e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131839, "uuid": "a29b4b32-3175-4879-b602-4cd6017eb095", "comment": "Malware payload (TrickBot)", "value": "c6a4f8e6782367280d164ded1f6eb03b5be88b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131839, "uuid": "69f68c8a-b640-40ba-8ec8-5ee52c2b26da", "comment": "Malware payload (TrickBot)", "value": "8a06db94f8f1625f44aec7bf5ef249cecdbab76f809bf348ed38728f543768621b9ab53eee49128d37a28d22dd447716", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131839, "uuid": "53ee1a05-468d-42a0-af34-cea8d453c35b", "value": "T1230519D0634CCA7FD6C33130F3A61633D2538B4E1AAB919BEB58F59AA86E5467413307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131839, "uuid": "c590aa7a-d57f-48d2-83f0-1e555a2d45f9", "value": "884c251bdbb51e23564add248435ff5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131839, "uuid": "deeabb25-31c1-4c81-ae77-c18f382fd117", "value": "12288:QFuLe4nHJm79H5b51MKd3GydYLMcOCWvnJi7:QFF4nHJovZbnJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630131839, "uuid": "269ac455-194e-4b70-a594-158f3d8ad26c", "value": 839733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630131839, "uuid": "f51d0198-6562-4b76-beb6-06047f2aaffa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131839, "uuid": "5d7e42e3-c2ff-458e-80f4-a239ee179c2a", "value": "07c60de3ec3c5bdfd5b518ce6cb580b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbda9cc5-07c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630129833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129833, "uuid": "41c40439-ca9e-43dc-bac3-60715112467d", "comment": "Malware payload (Mirai)", "value": "17b107c1304c0caaa3cc6ed9edeb9172", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129833, "uuid": "4ee6d7bc-8499-406f-8efc-9b3d8cc50bc8", "comment": "Malware payload (Mirai)", "value": "88ba392cc7deb5fb38e26e21922d6ea15b0f136461fe9af18a005db411a87b0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129833, "uuid": "3e4cda78-5831-4c1d-9994-c9daaec757fb", "comment": "Malware payload (Mirai)", "value": "290b929c42c931a6a52c813f391c797fd14aab77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129833, "uuid": "c1ed9453-569e-4d9d-86d7-c2a6f1428e7d", "comment": "Malware payload (Mirai)", "value": "480be71bf76a835cfa2e64c2810af9e8c85126bf22ee1dc6062b6a68235a1f1e530857f06d48b4170cc379aee165a557", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129833, "uuid": "a319f34a-17d2-457c-a027-06d0d2ab7429", "value": "T1AA931A95B8918B12C5D522BAFA2D158D331217F8E3DFB213AD205F743B8A52B0E3BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129833, "uuid": "67de1e6e-1983-4a91-95ba-80fb7c093109", "value": "1536:UZnc0HypqDeiKSfJEFpAaFAM1OSMr94JMBOm2NSKqWI+E510e5Q9+QQMLizR+GvY:mAq6imAMpm94JMBX20d3+E3TPR+Gvaau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630129833, "uuid": "fd642a6f-90ee-4de1-bfa5-5b75c3666a86", "value": 95828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630129833, "uuid": "c949ca8e-5bb4-44da-8cb0-0fd2135c7f85", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129833, "uuid": "8b0a790d-faf7-4c16-8af3-844312620c5d", "value": "17b107c1304c0caaa3cc6ed9edeb9172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3336d4fb-07ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FickerStealer)", "timestamp": 1630132556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132556, "uuid": "7b2f454e-b183-4be6-a9f1-b72db55086e8", "comment": "Malware payload (FickerStealer)", "value": "0a64aeba3831090941ec8bdc233b8f5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132556, "uuid": "b360cd42-ef63-4020-962f-f068cbcd8666", "comment": "Malware payload (FickerStealer)", "value": "8a29bcbf03060ef20fc961aa70d4befcad90449cf6c957d758dbbd0fb78af57e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132556, "uuid": "571103ef-440d-4257-9845-2dc1ed65427c", "comment": "Malware payload (FickerStealer)", "value": "714d910aee7b092440552922c00c07149963e99b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132556, "uuid": "bd5d50cf-06b9-45de-9725-292c6c46328c", "comment": "Malware payload (FickerStealer)", "value": "61aff3c9cc9764fcc26c6583bd461ffb5f73159f48745694935bf1cfae8500c772ce5ff8df70b99b067e76cd47862578", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132556, "uuid": "faa7b3ac-38a0-4949-b3c6-02b011f5cdf9", "value": "T17BB48D3055F45C29FEA622BC49AB436AA73D3EA05B32C3C7427265F58B235D6E970343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132556, "uuid": "0aacbfb0-6777-409a-b7f2-ac638bb3766c", "value": "ebf21d5f80ce6d78a1158dea28ff74e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132556, "uuid": "4cc3ad3d-6cad-4d0a-8f21-5b3692419039", "value": "6144:p/VPiKpzTdVJgQ0YkCUfc9h0RPsjyOs9d/MIXmzVKLzmmXAqXaW0rLFb56dpLN47:XHJTLidCr9hOPuJwZORKnm8AqXaW0rN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132556, "uuid": "0c42e593-a03c-43fe-9690-2913dad8d3a7", "value": 516620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132556, "uuid": "f64bd875-170f-42ed-b193-473851246a3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132556, "uuid": "30d2814e-d65a-4561-8e44-9f96e06d16d1", "value": "0a64aeba3831090941ec8bdc233b8f5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4936c208-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630167812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167812, "uuid": "fa84571c-a0ea-4a71-967b-1b9cd337f044", "comment": "Malware payload", "value": "38f4e988d7167d7c97d2b7fba02e9d4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167812, "uuid": "09d27874-8f30-43ba-96f5-512a0273e0ae", "comment": "Malware payload", "value": "8a7b19bcfc41dced633a3880d9023a550e168fda680f91448fcf1ef532c8b16f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167812, "uuid": "415ede8f-ad3d-44d7-a11f-c23dd6fa9acc", "comment": "Malware payload", "value": "edb821e31311e2694eb5abbb43acac127f163fcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167812, "uuid": "bb02556a-1163-450a-8f14-093f1b4ab949", "comment": "Malware payload", "value": "e99c67a7d774fcc1ec2a19362716f9e249506d264c244d7310b47ee36b930e58543bad1b87458134d8c53cbaaf77ff11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167812, "uuid": "f711fbc0-95b8-4ef5-878a-7a34a9096a85", "value": "T11973D0326892C072C58278F18569E6B1BF7D5A712376EAEF1B6924311F309C1F23C59B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167812, "uuid": "f764b3c8-9041-44ae-a6c5-e6f6b59ee1fb", "value": "1536:XdEF2edRdyrkl6QVtNkhshw/6ox9ORQz0Z:XQroQVtNMmwCmAQwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167812, "uuid": "8b942fd5-53d2-4176-9564-9bb7484de3ae", "value": 77932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167812, "uuid": "253e82b2-2975-4381-b08f-c282231f24bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167812, "uuid": "99f2e190-920d-468e-aced-7eaaed502a67", "value": "38f4e988d7167d7c97d2b7fba02e9d4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852bd3b5-0841-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630183804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183804, "uuid": "55b1fc90-e60a-4a74-82a3-21de8cdada15", "comment": "Malware payload (Mirai)", "value": "d1e43cfc3ab6dfd8d10a1f7f1659d53d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183804, "uuid": "1dbb07c6-8e23-4cd6-8e11-9296c05605a9", "comment": "Malware payload (Mirai)", "value": "8aa1c5046e3d32dd9e378e421db5f07ff87c5986985c7cdb27eca0b774d07547", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183804, "uuid": "8253e033-93a0-40dc-a4f3-b0bb300fef6f", "comment": "Malware payload (Mirai)", "value": "a9d5789591a77780b959dfa899812f68b247abd0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183804, "uuid": "d008cf37-c61f-4f7d-8b28-50bda0cfd701", "comment": "Malware payload (Mirai)", "value": "7e9800fb2811874107c0637834c21b52ba47c0bbc4fa856bf409cc0e8ea637cc3b37438aa24e5e8cc15121e4ee6cd768", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183804, "uuid": "3db8f8d0-6c1d-48ea-a132-9c790f60f84f", "value": "T1DEE34C46EA818F13C4D5177ABAAF01893332A75493DB730699186FB43FC6B6E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183804, "uuid": "efd98ef3-4909-4e1b-ba8b-b5b8353b77b4", "value": "3072:qJs9NARj5/Icu+NGtKfS6LLUgMv3kigvNO6bl7XgwxQK3gSLOfM/9JJLxh:qJs9NARj5/IctGtK66LccO6bl7XNQHSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630183804, "uuid": "24f6123d-0eea-4c62-a74f-56d06b7d2e89", "value": 146283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630183804, "uuid": "ef3f6dc5-ce45-4743-b5be-19b0c54b6635", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183804, "uuid": "fd695d01-7a95-46dd-a4e5-cfdacce7f72f", "value": "vcimanagement.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3630b8e8-0795-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Neshta)", "timestamp": 1630109798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630109798, "uuid": "72ef3691-b291-40f4-a7ab-685cce9cad14", "comment": "Malware payload (Neshta)", "value": "d276373be7d76a1f038774a143269b17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630109798, "uuid": "a7221214-1a7a-44ab-acac-6d2a15b020c7", "comment": "Malware payload (Neshta)", "value": "8b1949f624ae24ef9dcbf1543b10bfa591eee33e72bd50a5b562de993a0ab42a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630109798, "uuid": "d3bd03e0-96b0-4861-bbae-9dd52829bd37", "comment": "Malware payload (Neshta)", "value": "9b47f8b3f5e10ca67a6aa944f4de5bf6d622a949", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630109798, "uuid": "19c0a21b-18b8-4c0f-aced-6689ebd0c023", "comment": "Malware payload (Neshta)", "value": "efe0a76b0642c2a8721a3a6fab507e984c5a9994a640e193f46fa888d7f8ac98a31d0849c131822ab4eb24c66ede9bb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630109798, "uuid": "7788512b-d6c2-43e1-816b-35ebf8e6ea8d", "value": "T1DEE47D767AA0487FC35A2BBD9C2F74A9B4117FA03D26F64523F43E841A383853819767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630109798, "uuid": "8a9356fa-26e8-4241-bbbf-c0c6eb73bee3", "value": "7f96272d7334ea5c5b0f297a4213e926", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630109798, "uuid": "0e8db44d-5a07-407e-9ae9-8f1af8c3d32b", "value": "12288:Z+i50uK9LCFU3c7aaNip0zoIysLefr8ZRhp:0E69LP3c7HM0zofs6fri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630109798, "uuid": "2db763fe-6516-4d0b-8479-d3fa86febe83", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630109798, "uuid": "6699f9f9-9cab-49a1-8c03-808d6aaca595", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630109798, "uuid": "d782f17a-a379-4878-bd2c-5d09468669ed", "value": "SKM_C335019110710.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaaef5b4-085a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630194604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "7b4793a0-6747-4cef-8117-fc7b5fae59d9", "comment": "Malware payload", "value": "50af5508a20eab1cdd0c3381e53eb973", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "1308a86a-e18d-411f-97e2-b461b63b4a90", "comment": "Malware payload", "value": "8cb8304100c86c4d4632306ca0f5e3e48817b7e1c33aa6ade9bdfb17011cbc0a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "8d5bcfc6-d63b-4f5e-a0fb-b859e66220c1", "comment": "Malware payload", "value": "34e3c36d9a7a337ed75e2ff704d6163fdde3e0bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "0b6092af-2df8-4c2e-bdc9-88cfdd11435c", "comment": "Malware payload", "value": "2ada5a192bbd3547bb836e5299980ab6b4d92be5cb63635bf4467fdfb0636825f4172e47cf9ed665ab7f8ba071aecf33", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "839f93ac-f276-45de-95e1-9e6efbe91803", "value": "T1ADA3D717AB51CEB7C85FCE7306AA460120CEE55612E46B6FB274DA6CE74B94F08E3D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "1e28517c-2ac9-41d6-b024-ed3fbdda94c8", "value": "1536:0GeTzI+eXiKbmTYWZMbZMPtAw7p7sXjYggpv2ymOimW+zWBSirHzai:0oc/pOZM1p7Nggh2ytimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630194604, "uuid": "d126bb6e-4691-466c-bb49-6f3ac6d4f0ec", "value": 104824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630194604, "uuid": "d8c705cc-9de4-4303-869f-4692907be843", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "78c14359-8e62-4101-9499-804912845323", "value": "cemtop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc4e90e-0835-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630178745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630178745, "uuid": "faa96932-1682-4f38-ac6e-1596487070b9", "comment": "Malware payload (RaccoonStealer)", "value": "598c83cc40aaf692d9a8555aea770ea8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630178745, "uuid": "9f8486c2-1279-4243-a32d-3e15cc5f9996", "comment": "Malware payload (RaccoonStealer)", "value": "8d2c7c32e779c7cc0969cebfc00d711daab9bc03c99c31a271abfae36d63e05e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630178745, "uuid": "f6f279b1-3fac-4940-803e-f05cf8c2e73f", "comment": "Malware payload (RaccoonStealer)", "value": "43a606296d0350b4dd0dcca9a8098b26288f9744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630178745, "uuid": "ef7d10ed-a16c-4e3c-b73a-ba5fbf502d7d", "comment": "Malware payload (RaccoonStealer)", "value": "80631dde1acffbb559b9a33dd3657956489e5f47ea29fa6ac5c2c4bcbd0cb21803c703773667ffa04ec8161d5d693e2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630178745, "uuid": "52a2bb15-7aca-4469-9acd-d6ff18a4406e", "value": "T1F4A40104BE70C0BEF9D2C9754C6DD680AA3F78D31A65824736884F6E3DB22D0591EAD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630178745, "uuid": "3e85cd9c-13fa-4deb-b295-7110141208d4", "value": "065a584d0d50807005a7c41fcb9adea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630178745, "uuid": "d9447772-9763-406e-96b8-8860eb0cf5c0", "value": "6144:/vaJEecn5clFAaYUqGMAU6n6XQbpqcHFYSD1v2LUsMo7iw7ZypGy4HwhZU9sI5/:nanc5+ArUqiUerbEcXDdGqq0Uec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630178745, "uuid": "cad81c11-2a43-422c-83b2-4cf658873beb", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630178745, "uuid": "493f6e53-cde6-453c-a0b8-b97f5075f4bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630178745, "uuid": "5c0a5fe5-c36d-4a1d-a733-5872345804b2", "value": "598c83cc40aaf692d9a8555aea770ea8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2fc4364-0799-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630111806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111806, "uuid": "2acdde37-aac2-4ab8-afef-b883f0a235f3", "comment": "Malware payload (Mirai)", "value": "c164c99d86e7cecd4e495d23c616c21b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111806, "uuid": "1a0dfb94-ba8c-4ae1-bc4f-789c2a2421a9", "comment": "Malware payload (Mirai)", "value": "8e5a83c63b80e411953fac0c77d44bd2066c4eeffa3d3b7319dadd15fdf80c0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111806, "uuid": "ae98e689-c44d-413c-be92-f9a7b6066ab9", "comment": "Malware payload (Mirai)", "value": "82e303e6acac6c012e280a526359917a73828f53", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111806, "uuid": "bd6bdfc6-a46d-413a-abe7-1f9f20122ab2", "comment": "Malware payload (Mirai)", "value": "50d004225071903a813443e2bb1906c17b1e3c4c4751bc4ce61dcf51e69935d7ed28a347764181bbb38865e1078bf364", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630111806, "uuid": "ec9f6596-9c41-485f-83aa-ffcaf12752b3", "value": "T13BD33B86EA408E13C0D51B77FAEF41493322D755E3DB73068D189BB43F86A9E4E23649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630111806, "uuid": "1e7a5fbb-3322-4d8f-a424-a39750a0c3f3", "value": "3072:QybUEGniGQYtOR7aCgk9mrsplDKZUmQBKXAVanJX+F8Jyve4hL5AJI4+3jJNx139:DbUEGniGQYtOR7aPk9mrsplDKZUmQBKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630111806, "uuid": "09ddfccb-6e72-48ea-8aa5-68c113ce0379", "value": 142651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630111806, "uuid": "4db5c9db-4d42-4ea1-b848-ab726597f54b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630111806, "uuid": "261721a4-8fee-4218-87d0-adea06107b5e", "value": "pandora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea3a5a6-0807-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630158775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630158775, "uuid": "53b912dc-c078-42f7-b313-d2bf39b9e93f", "comment": "Malware payload (AgentTesla)", "value": "11839f22fe69c8f4ac427b8f8f9663dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630158775, "uuid": "06fec92f-3a00-4f1e-ad8c-f45544f51972", "comment": "Malware payload (AgentTesla)", "value": "8e910467d10490c47d7e4b34a8e39d037523adfc292e0f28390a80526b5c93aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630158775, "uuid": "c655c2c7-9222-4262-b1cc-7ec45f1352f8", "comment": "Malware payload (AgentTesla)", "value": "2101bbe8a62286ebbe90c63f818ccf6533eacf9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630158775, "uuid": "c7a37419-f4bc-4b4d-a6aa-840b45d9e622", "comment": "Malware payload (AgentTesla)", "value": "4384bef74f8b02f0ffd9644daa735959871071c397625df10613d700c111f4fe66e293f22fadb8936fb6ad3757ecc7df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630158775, "uuid": "c1433597-d6ce-4f6d-9078-36e59d4aa4f9", "value": "T1FAE40A7F19BDA2279175C6F58BE38827F0408B6F3110696476D347264322A7AB4F336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630158775, "uuid": "1e5dce5f-bff1-46aa-a607-a64863cb806e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630158775, "uuid": "91a98e0d-e431-4454-a353-72b6f4c1f273", "value": "6144:gYpeBJw8cLr9J0HyPSGMK4TmCLJ9UkDcb+7p2wR3iFTEmlrDEI42FCRlkKIfx8:gYp6c/9J00p7YJ9BDcb+VzEFbv63Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630158775, "uuid": "d444ff7e-66fd-43d0-83fb-0e999af79703", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630158775, "uuid": "ed77dde3-14d3-41cc-ac04-715e470ada8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630158775, "uuid": "2b91eeaf-23da-47d1-9263-923278b7110f", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d521e2c0-081b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630167617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167617, "uuid": "5d354603-21f5-46a2-9b93-82ec30a9686e", "comment": "Malware payload (RaccoonStealer)", "value": "b6bc146e7e2f88afc9b81dc6cb4e4c54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167617, "uuid": "d542b7b8-851c-4af2-8418-4c699b021129", "comment": "Malware payload (RaccoonStealer)", "value": "8ea7e098522cb46482fad73b8abf73f6c74f85d5e42953eb5353d5bfeb9497d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167617, "uuid": "d70a0587-5095-4ef9-b1a0-a64ecd9b36f1", "comment": "Malware payload (RaccoonStealer)", "value": "dbd03a9b751c8aadad427f11840faf58e82b0fc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167617, "uuid": "c908cd1a-2f79-467e-b354-f4e77cfd9885", "comment": "Malware payload (RaccoonStealer)", "value": "409b5391e650970ef0a13efde8f6306457a456514feabf057c4c849b2e3928b54e8be54f066bda57be7d95e2ad78ba3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167617, "uuid": "97b35d66-91a4-4009-a85d-cc466fc7c83f", "value": "T182940246F6B5C872E1E35A329C19C261266FBE615E654A8B3EC81F6E3F311C0470D3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167617, "uuid": "17fb3b87-7e18-4346-8fc9-7ca82d30301e", "value": "d3c9c233147536fd2cb825c3f3ce75bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167617, "uuid": "f5d5c679-5baf-4e76-9c56-fcc61d2fe297", "value": "6144:cQst6TSjD99W5FZN5NSWStmYKO5q/tqJSCbmkO17oURR1jiUb0onp8g3I4sI5/:C6TSHy5d5o91KO5QtrMm9UUsFYGgYpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167617, "uuid": "26a4ffed-eb03-4171-be6b-b7efae182aae", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167617, "uuid": "cc727aa6-5eea-44cd-9dcf-b3b921c94569", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167617, "uuid": "7bb4ec2e-276b-47c4-8fa1-39ce1e3cbf12", "value": "b6bc146e7e2f88afc9b81dc6cb4e4c54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e973a095-0840-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630183542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183542, "uuid": "cdae6a53-a734-4bb9-91dc-f21e431f6d5c", "comment": "Malware payload (RaccoonStealer)", "value": "c4d2a516f477955b84295a0fccaa65e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183542, "uuid": "05e02326-4d29-422e-af59-cbdf7679e371", "comment": "Malware payload (RaccoonStealer)", "value": "8fde287fb85261eb4310761676c383c77e0909b4f5af762e123d49242047b400", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183542, "uuid": "54eaf980-7dba-48d1-be17-d64217abb6c5", "comment": "Malware payload (RaccoonStealer)", "value": "e4117a0b5da7801a1333d059dfd1507e7108ef34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183542, "uuid": "3dc88825-b65e-4dfd-94db-378e2c6113ab", "comment": "Malware payload (RaccoonStealer)", "value": "885e67258fe604573f81b9499bff90470476836082f4e899bbb3cebf4fd03fef043c2e28d14eeff98b98839343bab538", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183542, "uuid": "6cd6c9bc-78e4-4ba8-a0f7-9576bd7f8688", "value": "T121940204B2B0C577C4D75A748C69F6512A6FF9116922C24B2F888FAF3DB32D1892D397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183542, "uuid": "980ce98c-31f5-4204-81db-5f7a61943a1e", "value": "235a7442cece4fa6e5f46d7a23e8afc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183542, "uuid": "c98efa1a-016a-410c-9ea1-db03138a827d", "value": "6144:VvM4aB2X5oNrDYw9qXZGgZrQ91bHRnfkRakNn0HOe23ZmDBiww/G01oXFsI5/:RM4o85ouzZrQ91T574n3aBiww/N+ac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630183542, "uuid": "ec88b212-02e6-4447-a6b7-db1398299bba", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630183542, "uuid": "32c2e705-1874-4471-bb2f-823f4e0e7208", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183542, "uuid": "e805b84a-ff1e-462e-a922-b2eadd5b3945", "value": "c4d2a516f477955b84295a0fccaa65e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13caaec-07cb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GCleaner)", "timestamp": 1630133304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133304, "uuid": "d500d91b-578b-4a27-b94f-fe4ff10666a6", "comment": "Malware payload (GCleaner)", "value": "598b7115d194a9d058b4b09288c583c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133304, "uuid": "88e5cf50-d089-4ec9-8f79-5d610bfd0a49", "comment": "Malware payload (GCleaner)", "value": "90218287a2349091c5221723b26ee73e101b51f5ef99dbaa23d8c19f83c58f91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133304, "uuid": "99e3fe23-b18c-464a-b2e0-0483e2a428ae", "comment": "Malware payload (GCleaner)", "value": "c2539a41cd44cf10b57fccdba69d908951181268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133304, "uuid": "5befa1f8-658a-4e9c-88a3-45beb701d8a8", "comment": "Malware payload (GCleaner)", "value": "0b3189ca8dc45ca8bc6fc0f9b10211997736334b27c7d8d46a9b137a81be36c8d898302473744d361f65da025ee9f340", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133304, "uuid": "9e34db50-b6b6-4390-bd07-02dc5e21a19f", "value": "T15664AE30A790C036F5F722F859B68378B5297EB16B6090CF93D526EA17346E8AD30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133304, "uuid": "f4ba6f83-7844-4fc0-9347-379e244919cd", "value": "ebf21d5f80ce6d78a1158dea28ff74e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133304, "uuid": "b4512797-1c27-46ee-af1e-b13e09c40233", "value": "6144:O/w4aKpzoKNJPiFCT5UfXxvTfiTzb2AR6VkLh2SLwKteWfIRo:0vJoAFb5IxvLEnp4VkZzsxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630133304, "uuid": "42b64a29-3f35-4ecd-bd0b-82a8222d2a1e", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630133304, "uuid": "ec45e462-dac8-4da0-8d16-bd2b6353bf80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133304, "uuid": "ec24ab9e-d9ad-430d-bc10-c00e503bc1f8", "value": "598b7115d194a9d058b4b09288c583c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee49d0f-07ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630132576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132576, "uuid": "d6650591-c88a-481a-8be5-5f5a9ef98f98", "comment": "Malware payload (Smoke Loader)", "value": "070fb1bfb712c264018ed5c4ef4cef91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132576, "uuid": "d569ea27-258c-4461-9fe4-49645aa3dbc6", "comment": "Malware payload (Smoke Loader)", "value": "905aebde47e76935d38d77f4c632be824f643014c898e76563626544dfca71d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132576, "uuid": "1bde46e1-513c-4a47-b244-2231d4f3a5c2", "comment": "Malware payload (Smoke Loader)", "value": "531cda71391f5887bd82a1cd023cc8422f897e44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132576, "uuid": "9ba0e766-7f1e-4dd4-ba8d-4c97bb420dc4", "comment": "Malware payload (Smoke Loader)", "value": "00fe2e1da6712f04d956bee0ed94500f8e3f5f0b1120a2e8dbc13c92bb232424196a65d1c7a005afc49446fdf282d749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132576, "uuid": "572fc54c-7ba9-4914-a004-9bcde5a70522", "value": "T126448C30A790C035E5F712F859B6837CB9293EB15B6490CF93D42AEA16786E8ED30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132576, "uuid": "5d1f5f75-4220-40c2-9268-8240ead45982", "value": "e68f2e15edc1c604720a74f10b8483a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132576, "uuid": "fb4aecfe-045f-4b93-b629-551adeaa10a7", "value": "6144:q/IZsObX/tvy+yRM4xtyvpaNX/1rg4PcUDg:Vs+vtvlyRrtyBatVglKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132576, "uuid": "776f6893-38cc-4c93-96f0-85c6fcc4d054", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132576, "uuid": "701b9244-a607-488c-a652-237abf4578ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132576, "uuid": "1d765e5a-3e61-480f-897b-afbb4d8aa83f", "value": "070fb1bfb712c264018ed5c4ef4cef91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44735b7d-082f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630175964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175964, "uuid": "fc78055c-0b06-445b-915a-45d04a35dec5", "comment": "Malware payload (CobaltStrike)", "value": "d13c8e751c0dd299977406a272aec08f", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175964, "uuid": "e8c2de7f-0d22-4a4d-889c-74b3131f6524", "comment": "Malware payload (CobaltStrike)", "value": "90ba202a83166b1c6bb3fccaa5cb64c92cc810f27b52dfc0e543c432803b79f9", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175964, "uuid": "a7aa3139-7277-4e01-82a6-6a04ca192edb", "comment": "Malware payload (CobaltStrike)", "value": "6ab62d5f5b18578379a8a77c958a3f0dd5419512", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175964, "uuid": "53776f96-f2cf-4813-83c6-e31e734d5db4", "comment": "Malware payload (CobaltStrike)", "value": "698c85798df123fae3f274845a29a6cb06665e212bedba4026677bfc95491d95f9a932f3bd6abf141dca3f1977ceb00b", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175964, "uuid": "fd2a1336-1770-4792-92de-1aa2a4c8b8ee", "value": "T18224DFF5A94B2881F78AB474F177B9ABEF79B46B8C021285C1374D46C209B6003C7AD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175964, "uuid": "b3201a38-ce3e-4115-8e86-44d5e1b7624e", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175964, "uuid": "dc7437b2-259a-4dd4-a1c3-74f886615d8c", "value": "6144:8Vhd+40fN0Zh7gDd5728bBS+s9hYi8TkK:8VjTYmfMD7hbBe8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630175964, "uuid": "66f44924-4c6e-4fd8-a58e-d7da02081bc7", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630175964, "uuid": "ae576418-1c51-401d-baa9-e51baf96c4b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175964, "uuid": "41b07ccf-4e28-4ec3-a0d7-4b380d22eef4", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96125908-07fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155056, "uuid": "6cd0b079-369d-415d-a771-5e8c5ff90b34", "comment": "Malware payload (Mirai)", "value": "9bca87a930e02137ba6fc1eb71098b69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155056, "uuid": "50e78598-a91a-48b4-8a6c-0003c622899e", "comment": "Malware payload (Mirai)", "value": "91c5afe811996357d190cbe9a9a2ce9ccaa2d1116339f1c1906410ff58a9d644", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155056, "uuid": "82dc898f-51aa-43fc-bd63-22d9d773b231", "comment": "Malware payload (Mirai)", "value": "e8e244f865ae6fbf9199373317649d6b9b861d2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155056, "uuid": "283d58a8-ace4-4599-a774-7a086207b8e6", "comment": "Malware payload (Mirai)", "value": "8dc2d0bb207e13c5e554a260829aae28780de43215a24641344374a30244a1b81ad7b08847b9ece6911a99d5fcadd72d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155056, "uuid": "ccf998b2-d7c2-4c2b-8fe7-a81e22c0c36b", "value": "T141831B8EB4414E2CFD8FE9FD55214E19A920321156830B16B6ABFDD37F722E9CD42D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155056, "uuid": "b0b473b5-92d9-4bd5-a175-aefa1f5af35b", "value": "1536:NV3mIDvLI50hQufXhxx7IIeg1prF4xL4sbvgPEUedm1yn8r:NY4LI5aeIHprM5jgumwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155056, "uuid": "6c684116-6939-4aaf-b12b-87d6d7161f19", "value": 84392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155056, "uuid": "c59b1f78-d907-4d5c-b04b-73dc155f0012", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155056, "uuid": "b02e7efd-65e4-4d1b-aece-490681bda403", "value": "9bca87a930e02137ba6fc1eb71098b69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a1167e-07cb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GCleaner)", "timestamp": 1630133285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133285, "uuid": "7e994811-5cd6-4624-ad8f-b70639b373d2", "comment": "Malware payload (GCleaner)", "value": "a98ec0253594d14cada3f9c0b0347720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133285, "uuid": "a4fcb2f5-de7d-4155-9442-871d3d92b6e1", "comment": "Malware payload (GCleaner)", "value": "92b7baea3245ab0127160bdaec0b6f05901740bd40bb3adc21dcca4d238cf097", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133285, "uuid": "e229398d-d26e-4628-af5e-54b8b7f40bed", "comment": "Malware payload (GCleaner)", "value": "9f56b49690cdd9308b729d6ba6fa4134c89e61fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630133285, "uuid": "40fff4f8-2c8f-436d-bff9-010610a8487f", "comment": "Malware payload (GCleaner)", "value": "cd203c249d800f69b291949fd98d6b842a31600cf0f7be06294ac181c9947031adba72a426eab0b9cce236d6f99aa458", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133285, "uuid": "1872f99e-8471-4962-ae8b-e4e64e5eaea8", "value": "T10624E02132B181B3C6E76A7849FAB761226BBF21BB70D1873A55171E3E323D0453D297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133285, "uuid": "45a0ee29-4ab4-404c-936e-d41848c2d556", "value": "d3c9c233147536fd2cb825c3f3ce75bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133285, "uuid": "e5669e74-007b-4384-be1a-7f4d52ef3a11", "value": "6144:dvqJpuyzOtLbcloC8ZzleQ7O5YTPQsI5/:dvqJ5zOtLbcCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630133285, "uuid": "7e11b7bf-8d78-4710-8f56-ab7a2cc4cd90", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630133285, "uuid": "4f1fe5f0-f178-4ca6-90f2-d5c3b76e0c42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630133285, "uuid": "d4ac2bf0-610c-468e-af56-79c5d2a740d7", "value": "a98ec0253594d14cada3f9c0b0347720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5d969e-07cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630134957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630134957, "uuid": "8cd6631b-d6dd-485c-ad85-fd71a898c668", "comment": "Malware payload (RedLineStealer)", "value": "a2ff41cfe251ba7521ce0be494798774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630134957, "uuid": "62724e9b-5748-4a3e-90eb-fd9bfdb2ebb2", "comment": "Malware payload (RedLineStealer)", "value": "9437a1dc8b4a0944f8c90073b8bbcdb5b04501c55fde59d479b4d3ffbcd96620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630134957, "uuid": "f110564b-31c5-4cef-9e7c-587b64e93dfa", "comment": "Malware payload (RedLineStealer)", "value": "e384708408b6d62a18c8c6e67534a3bd8fd46722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630134957, "uuid": "2d35a7fc-67ab-423a-84e2-6f7c64e63009", "comment": "Malware payload (RedLineStealer)", "value": "c2d7d12197800e07a0a8c92ca859e1d91a2b23df8d8b6c56315cf23b578bf9715b5ad8491e1f65ae886f71ea67152e8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630134957, "uuid": "4c152b23-6041-44e5-a1ec-321b3c590312", "value": "T131B5FF83E0DB2929DBD73337D925F5711917ACA068A3ACAEE20CF1554735C62FEC2A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630134957, "uuid": "d33637b3-e364-4907-8815-263b022aa78e", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630134957, "uuid": "a33807a8-5592-4941-87da-4cedf66f85b4", "value": "49152:Ap3UPg+gCtskWWKK+o737xtug6NWgl+MSpV3Pduk:Ap3kLgZWz5Jtud0FP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630134957, "uuid": "1f88e35f-b2d7-49db-8204-243d91c4cd59", "value": 2312192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630134957, "uuid": "b798fb50-b48d-4dfe-9716-32ce988587ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630134957, "uuid": "8aa71ad0-a423-4cfb-9c4c-35499299c8dc", "value": "a2ff41cfe251ba7521ce0be494798774.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c06f62d-07a7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Lucifer)", "timestamp": 1630117673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630117673, "uuid": "82089880-f740-4418-853f-48dedcc48ea8", "comment": "Malware payload (Lucifer)", "value": "208a2ef666ce5f4de711081ebb1bef06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630117673, "uuid": "48bf46df-e80c-4552-877d-8daeb98009b8", "comment": "Malware payload (Lucifer)", "value": "95c423069fe3bfedf9334097a63af5866f79e7f2dfa2ab2490bcfa9b0840700c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630117673, "uuid": "f57dba0f-d3aa-425f-a051-bad9ad8c2605", "comment": "Malware payload (Lucifer)", "value": "84da12fce158d40def6da865d18b20a9f4cd791a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630117673, "uuid": "9c6f9b84-7ded-47ce-a002-f67fcc1445ce", "comment": "Malware payload (Lucifer)", "value": "d486114566c04752a9d2b79168599c9f70a65f39df86dbdecccc4a8e9fd53dec765b8c3f90febfbf1f8afdb906836bd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630117673, "uuid": "5ddfa1db-9a2c-4b6e-b5b9-d0a10d103a47", "value": "T19125903C29BD222BD1B9C7B5CBE0C837F0549DAF3111AA6464D78B6A5356E4235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630117673, "uuid": "a3b58497-cea0-4c4a-981d-aad8edbbb55b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630117673, "uuid": "fc1c322c-4616-46cf-b3cc-49e319eb87eb", "value": "12288:by9Bwgl7Qe5y5xSe255gRMbAu407g5pXYvdnaFB0SB+1AIWq74D:kBwQ7zU5xSn/wzV6mYv87+1X4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630117673, "uuid": "2f1ac98c-cb25-4a86-ad5a-8afc5b400349", "value": 1001984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630117673, "uuid": "ca1bc3a4-1528-435d-8a6c-3ca51d06d843", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630117673, "uuid": "af07b460-3fb3-465e-8d39-b3180a4fab63", "value": "208a2ef666ce5f4de711081ebb1bef06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22fc0b3-0799-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630111804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111804, "uuid": "21f31811-8133-4d67-bd06-3b2c3704d9a0", "comment": "Malware payload (Mirai)", "value": "e4529826e2c28e88712384f0d6dcb300", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111804, "uuid": "c8a80ab2-3d6b-4364-9d45-cf8ac2799e92", "comment": "Malware payload (Mirai)", "value": "96c3dc57e3041544e9307c551f38096afe2f56ce46b3fb031180e85b59d04e35", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111804, "uuid": "94f33a09-0be3-4955-972e-055070f192ab", "comment": "Malware payload (Mirai)", "value": "b045a21a9d8edca592e274933d6efefba735284c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111804, "uuid": "9c3c007c-64b8-4674-94be-b2ff4b14e91a", "comment": "Malware payload (Mirai)", "value": "4b479511f2a7e780e416fab3d70436b87d1ef87e14f522d3fbfbca86afbb469b10c341ee39cf122fc9ff762a52fe52f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630111804, "uuid": "c9aef13c-f11b-42db-a275-59d9c85fe011", "value": "T13C532AC8A0D3E8F5EC14097D307AAB629E73F13FB076DD9BD7E85573A801602910666E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630111804, "uuid": "dec2913f-7998-426a-acb6-df71d8168c4e", "value": "1536:IZlpWlXJcf4slZQLkAl+tV+xSWY/Pfd+700ngkMse:I0XJcf4slZQLkAl+tcxSWY/Pfd00+dMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630111804, "uuid": "54834d38-97f7-40eb-b637-58b398127339", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630111804, "uuid": "4992e6e7-8c24-4eff-9943-fbf0d9692d61", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630111804, "uuid": "5de9b54d-0a00-4d20-a535-8877a7be0196", "value": "pandora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc40f3b-084b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1630188059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188059, "uuid": "be93400a-26aa-4d46-b4d8-2d51c5bee3cc", "comment": "Malware payload (Amadey)", "value": "2b05bd5f01ec91055ec3235fe0308758", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188059, "uuid": "7515b4d4-4952-4258-b972-d5002ef7df24", "comment": "Malware payload (Amadey)", "value": "98012c9a8fe074b5514953c7cf7d70047a44bec639dda73d39d67283897465fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188059, "uuid": "7f90fd26-0a75-4b7a-af37-2a1f66b939ae", "comment": "Malware payload (Amadey)", "value": "8fed0199247388c88870e20b15581353f7dc2ba9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188059, "uuid": "63e6a78c-1471-42e4-abc7-194d3e051ea1", "comment": "Malware payload (Amadey)", "value": "895d3a1caee6b03a9d5a70e47ff8cf7a1eed94ad65c767951a2ac96cd27d58f2d73251e4b7a4b4804535b1b1b551a6b9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188059, "uuid": "01bcb65a-fc17-41b2-8fb3-b8ffee958fe5", "value": "T175454512E7A3476AD59DF3FC5B18F2B04168AEF66A0385C337B0F5E679E1D818618132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188059, "uuid": "6570667d-6804-45e1-b228-eb9029c0a6dc", "value": "667e6d0f434d248524103ade13b913e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188059, "uuid": "47f4a9db-c196-4740-bfd5-d8499ed6ba71", "value": "24576:+SLXMkT/pY/feR4IQfPsNTpNOC4r2U+73ux3Sa:t8kBY/M+8N3adMU3Sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630188059, "uuid": "f96d7510-ea40-4e0f-afa6-a248bfc08b42", "value": 1232410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630188059, "uuid": "718355a5-d96a-41af-8995-db21f3abbb99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188059, "uuid": "635bb90f-fa51-49fd-96b0-cf2fa5ceeca5", "value": "2B05BD5F01EC91055EC3235FE0308758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12770c75-0843-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630184470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184470, "uuid": "b4c6c768-7ad2-4335-b3d2-db54ac49d142", "comment": "Malware payload", "value": "07a44954fbd515ca58162d09495c4774", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184470, "uuid": "aaf40266-5529-4221-82a0-07ebd6028ad5", "comment": "Malware payload", "value": "983d975770911453c3a9b71b84ef43cdf0dd86ee4390de16751a72816b93619a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184470, "uuid": "b6876d44-c8b5-4237-a84d-b8607340b100", "comment": "Malware payload", "value": "912459d8341c6a347d425eeffce583459af6e6ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184470, "uuid": "7387acf4-80c1-470e-bea2-1fa41b3004fa", "comment": "Malware payload", "value": "62fcd11cb59dc86bb07956544a64f0b239eef9f5788b49cf224c40d9e5f06c0c2789e851dc0057ec260f0783a43fdff3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184470, "uuid": "3edc21d7-e66c-4599-a628-ca26ae6b9af2", "value": "T12493B30ABB740FF7EC6FDD3749A92709158C650A22E97B357930D818F64B26F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184470, "uuid": "7d3604c5-4ef8-4f61-a613-01c3d3f42d8a", "value": "1536:zahaNVXMDW/JwtjzYvTIqI3Lk/0B/BXsZiaBLTe:zahGVQWmt/Mh2TXs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630184470, "uuid": "01306b49-4373-42e5-950e-15637001ec8e", "value": 92444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630184470, "uuid": "8d4da98f-01cd-43a7-9efa-faa5c66a5846", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184470, "uuid": "823159c7-a08c-450f-8926-b5a4a23d8a91", "value": "07a44954fbd515ca58162d09495c4774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8a39ad-07f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630152010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152010, "uuid": "378dfc95-d526-4e8c-90c9-963de6f57c23", "comment": "Malware payload (Mirai)", "value": "0efa309faedcb49ecc77974cb4dbabb1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152010, "uuid": "88f0264d-9d5d-4005-ac9c-8e7a6420fc10", "comment": "Malware payload (Mirai)", "value": "998da458715c9e18ae586db920484ef3f9c3fcb1951dd659c7e7a4821980282f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152010, "uuid": "1f2c62d4-e3fd-4e62-9e8c-68ef1d32e807", "comment": "Malware payload (Mirai)", "value": "7f636c187dc93299d1a4f672ab5dd9f3e46cdc6d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152010, "uuid": "9fb25d2e-bfc5-4930-a41d-d348b295019a", "comment": "Malware payload (Mirai)", "value": "cfee37470c43323cdab7e0a3f4fc7a25b9e0eb991444a56f11572cfd0ad4caa980555aa3f46601748238fb4dc55b61ac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152010, "uuid": "c8283b95-ee5e-4802-96bb-4447394fae0c", "value": "T1A6D2E19E6A5B9941D9311036E33E0D82E6D70EBCF27915B1D15D241AB3414FAE478B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152010, "uuid": "5ac2df14-72e0-4096-963b-35572333d120", "value": "768:vcjQBkEBr7YbXyi8vqQNB6qr7K7+r/b45n57Es3Uozd:vcjaBr7YTyJiMkqS7+n45n5lzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630152010, "uuid": "141cad7a-96db-459b-a4fd-6357166a49bb", "value": 31104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630152010, "uuid": "fddfba54-1cea-4bfa-80f6-ab4a82ab9821", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152010, "uuid": "5cad6a00-15ad-4505-8acf-95d42fbd99f3", "value": "Rakitin.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f009095-07f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630152011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152011, "uuid": "1476d4af-3b8f-435f-b719-92096d784313", "comment": "Malware payload (DanaBot)", "value": "99e58ef9d3f618465d5006d19881e091", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152011, "uuid": "eef8752f-f9a8-40f7-bc3e-135ce3c1eeae", "comment": "Malware payload (DanaBot)", "value": "9a4537ed41f8307c11b5c85e70ed82573e3fa7f424178eb7f15c5b4d4d72cde5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152011, "uuid": "5de482a9-4f45-4894-a5f0-92fb3cbc78fa", "comment": "Malware payload (DanaBot)", "value": "d9bebc4c86cc20a3e3147dfecf56aac64c0c9c3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152011, "uuid": "a0f376a6-4fc0-46e0-8aa1-608bd306f0bf", "comment": "Malware payload (DanaBot)", "value": "7a189aa5ab671e959fa3fb54b2a6dacf3b5f3ba2e64dad136e74d917374c70433b8e7c7a58cf219aba4c721a1213aca8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152011, "uuid": "24c14605-b430-47a1-85b6-7b103a17bcbd", "value": "T1F635123273C08C32C025FA3D69D1AD94167EFA317E91B80A2ADC45AFDCEB7419815A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152011, "uuid": "cd523da8-706b-493b-9f82-3216dd78f6c9", "value": "0db41ef1d0838062c008ff4132905031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152011, "uuid": "a4590a5c-704f-4227-bbc7-a17a209692b2", "value": "24576:GZngGrZHlNsQyeq+8O6pd+zjzZAV7ca17QowyQTLzhixN0CDm:GZgGlFOQyeqZO8rlc4Q/ZLziNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630152011, "uuid": "7408d66a-ba87-4b94-b64b-74511fdd185b", "value": 1060864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630152011, "uuid": "747d49c4-85a8-40cd-8bdb-de8aa7536a45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152011, "uuid": "1c0786ef-aebc-42ea-960c-e4b39f1965f0", "value": "99e58ef9d3f618465d5006d19881e091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5df29bf-0829-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630173604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630173604, "uuid": "d92af9a1-57e9-4727-83c8-e544f9914144", "comment": "Malware payload (Mirai)", "value": "2663fb061bc2f62cda8f152bbbdf0e12", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630173604, "uuid": "0418862e-b4ee-435c-83a4-cb9bc12e7704", "comment": "Malware payload (Mirai)", "value": "9a6833482a2f87664e53dfabf2587f9c2f62fe643a8e7a3ba982e05a46476e40", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630173604, "uuid": "cd3bd5b4-796e-4d47-bcd8-3da435f0eef5", "comment": "Malware payload (Mirai)", "value": "31dc1682730838efe123271def3393dae7e93e6e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630173604, "uuid": "e6643dd1-366c-4f6d-8a4f-55a9ed79c752", "comment": "Malware payload (Mirai)", "value": "b8c33ddb17975acf823ded5c6fd5fcf6721735b1dbfad3e275708457b4bebec970f61d41a5e4c72ac2ff4965bbed6f66", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630173604, "uuid": "d0664c33-0172-440b-9650-282a2f01e7d6", "value": "T187632BC8A5C3F8F0DC150A3D307AABB25977E13F6139ED9FD7A81966A941302D4023AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630173604, "uuid": "c6c40bc6-7ca2-4a6f-8b40-0e77d37b8339", "value": "1536:vXuL5MVqr3MOWaunK2ULfJNCCEez/XfUS2eBH0h9zg:veLqVqrdhun7ULfJ8Nez/BFJQ9zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630173604, "uuid": "82fd161a-7898-470e-9aa0-4114f6607e61", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630173604, "uuid": "536f9e91-b379-44fd-a6c6-821b21893905", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630173604, "uuid": "42257472-f75e-406a-9e02-5bddc5b7d083", "value": "1isequal9.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4447260f-084b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630187990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187990, "uuid": "553ca30a-1683-423c-bb5e-5c0028d0bd73", "comment": "Malware payload (Mirai)", "value": "e037dd203b458d0d59684e2154efc8b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187990, "uuid": "a0f0bddd-be3a-41c0-b495-f1e00e59cad4", "comment": "Malware payload (Mirai)", "value": "9af511d1ca0efbca71c1f396c92a2406b9413d4228b5ff346e22549d92a06f63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187990, "uuid": "1f21a1a1-6e51-484d-bac8-c7435914f07d", "comment": "Malware payload (Mirai)", "value": "95ba15e1ce1a3577fb03c99eeb3b29df5c85f729", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187990, "uuid": "94ca28c1-5c23-4ce4-b782-3256c0f5b2a3", "comment": "Malware payload (Mirai)", "value": "8d6641755e134b516cc7e48a9431374d8e129d6cb68db120c0f491ecb736650552ef0296992ebe3d15a4ccac4ecd0994", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187990, "uuid": "3f486684-4559-4258-971b-2480c4d8f4f3", "value": "T1DAD2F1B5AFBB460FF48A233C5E5EDCD925AC78651BB9464A06401A633138AE1A7DCCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187990, "uuid": "8e3163e3-30c8-4394-912c-74c87c305dff", "value": "768:xN8fWlfoQmQAXV7E/QciiRcLprDKTJazqg:jMNXFl76N4PCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187990, "uuid": "5df0399f-0414-451f-ad4e-2747f6509999", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187990, "uuid": "f17ec2a1-283c-4d38-9f05-12727106350d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187990, "uuid": "2e261db1-6ce3-4939-bb99-15b2db7716ae", "value": "e037dd203b458d0d59684e2154efc8b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8c03b5-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630167873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167873, "uuid": "461989c9-31dd-4414-97f4-2d309af3af17", "comment": "Malware payload (Smoke Loader)", "value": "1b43abb98536a1786f52929f9644ed91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167873, "uuid": "b04f4f17-90ff-4758-83c7-9f28de7f74a7", "comment": "Malware payload (Smoke Loader)", "value": "9b9d871a16182942e162ffd30d27b37822a105bf3946082593ab9e3f2a3e5926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167873, "uuid": "e9bea895-a296-4858-8a67-b334f05e6358", "comment": "Malware payload (Smoke Loader)", "value": "7fcf00f99004c2535bc14b57f4407d2f6a1460e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167873, "uuid": "1090543d-d5fd-4a22-ac8d-e298e50851a3", "comment": "Malware payload (Smoke Loader)", "value": "91c9d046c35d1bc68c4c210997ef4c08d700ab054bdc36fd3ea6e870ba324868aba7acb8c4039479619e874e1796ea78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167873, "uuid": "6792d00d-7f38-47f8-9802-7aaf68676053", "value": "T12AE3BE1532B4C573C5C21974846CC6A12AFBFE316B748A9B2B48676F3E731C1862E397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167873, "uuid": "5f2be808-9c3a-4827-8b01-68c8e23eca8d", "value": "d3c9c233147536fd2cb825c3f3ce75bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167873, "uuid": "9f873a73-ba5d-49f9-b109-1d098485330f", "value": "3072:sRf36pQM4Hc8s50cyiA5XPZsI5/DuT61m:sJ6pQMIfEgXPZsI5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167873, "uuid": "06b76243-d925-4ff4-84b8-a27c7003321c", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167873, "uuid": "c34d2021-255a-49c8-a384-363beca29035", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167873, "uuid": "bd0fd576-3e7c-4bc6-b7d4-9826bbf86981", "value": "1b43abb98536a1786f52929f9644ed91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b270c0d-084e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1630189236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630189236, "uuid": "f39279ef-1809-4a0b-a6cc-808bfa6a79d9", "comment": "Malware payload (AZORult)", "value": "1458dcb3ea4a20489e6e4f2d3ec45cdc", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630189236, "uuid": "1134c9e2-b0fa-4936-bc2e-d4acec3b4f2e", "comment": "Malware payload (AZORult)", "value": "9d4a0a8ffa11fc953750c07bd6997bcd23871fe277f65b4113e197b779aa24f0", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630189236, "uuid": "b6405db9-8895-4dc1-8f01-b7fe51924205", "comment": "Malware payload (AZORult)", "value": "21e0d10541055082ea3c64cba7a6d7842e1d6a0b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630189236, "uuid": "31eb7d72-3fe0-43f8-b282-c6871a1561ac", "comment": "Malware payload (AZORult)", "value": "5e91ab2d9461e0c4c77a3d32f2c6bb3e5ae5e729312046f4327eb9c740fc27ca22ca9d60b324f2746343fae09c1f2b53", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630189236, "uuid": "69773249-7b64-418d-9c69-fabca9ae75c4", "value": "T1FBC37C1769750993F04509B04AE199F40B7EFD237582AD0FEB86B90908F2ACB5CE1B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630189236, "uuid": "da1c34e9-36e0-49fa-b48c-6799a4c38e79", "value": "ca357d1c9b605d95e9d31e67e1c53033", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630189236, "uuid": "f0d78a7c-a4cf-4b8b-ac3d-34a6d7921c00", "value": "1536:EBazeC5jLqxMyhz4OyjDwdFNIhoGYu0Fl89e0Od69bxSiRYg8ltxMvCiuQE1:EBeeCIhoHwdFNIh3Gl0RQJg8/xdiY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630189236, "uuid": "5e69402f-40e3-41a9-aba3-66372f6d8570", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630189236, "uuid": "3fd359e3-ec3b-43ca-b0e9-ffc1e8824d85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630189236, "uuid": "7001ebd2-27f0-4bdb-b374-70ef57932921", "value": "1458DCB3EA4A20489E6E4F2D3EC45CDC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a94b77-081b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630167678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167678, "uuid": "25c0a108-fc99-48a4-81b6-77c0404cecc4", "comment": "Malware payload (Formbook)", "value": "070d41e335777ab3b16cc6279d259537", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167678, "uuid": "81ab7d05-98f4-4b7e-98bc-6d5f6b0cb0c9", "comment": "Malware payload (Formbook)", "value": "9d5847197dc6764bc3ef98ab27c48b41b156f64da2a26798b2f3814682ce4a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167678, "uuid": "7477be7f-7801-4b9f-a944-9c3172ca0084", "comment": "Malware payload (Formbook)", "value": "5a8ab78096f21b3402a29be56bb6e51256b4e317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167678, "uuid": "d67eccd1-0722-423b-b823-125fa795a9c7", "comment": "Malware payload (Formbook)", "value": "f92bb3628d965943546bcaab57a1eab73cdbdac138cad573c7df02ca955bffbe46f6e21de7889b46e0f6305151621107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167678, "uuid": "6034410e-5666-473e-a983-7d68b1afac7a", "value": "T166F39E32D742C030E2B251F5F269177B893E0D353258A0AAE7E11AE16EE45E6F42D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167678, "uuid": "380aca37-cbfd-48b3-8a60-422f53183516", "value": "3072:4ZB836lFxBSzS1oG/bRrAb99o+7/Og9R/QJ1iF+XnbJQqYhf:4IyKKoGjNS99o+DOg9R/o0+XbJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167678, "uuid": "9c0f9bbb-9631-43dd-8756-0c1e2c5fd7e9", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167678, "uuid": "47a86928-d6f4-4c13-bc9c-0715fd22f889", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167678, "uuid": "eeb93038-6abe-4f3e-a786-ee13e2ef3c24", "value": "070d41e335777ab3b16cc6279d259537.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6dceb44-084c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630188638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188638, "uuid": "304c3639-46ab-43b8-9091-82796105b4e3", "comment": "Malware payload (RaccoonStealer)", "value": "39d25090fc9295fda3aebd680b33c4ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188638, "uuid": "2fc97af4-9e59-4353-bcc0-85f64a56c4ca", "comment": "Malware payload (RaccoonStealer)", "value": "9de4c4ea8541a897ad40111d20ef352dcf686ba20b008c15e80ab373e0ca068d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188638, "uuid": "7950063e-c8ab-4269-a33d-5eecb1b6f366", "comment": "Malware payload (RaccoonStealer)", "value": "96099e7ef532a49f7a99bb050b403400f46b9a0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188638, "uuid": "46b86f57-4f56-47c3-84de-670f45297d2d", "comment": "Malware payload (RaccoonStealer)", "value": "879e2c97b39625b41415c0907a19c94b233fea21cbb33966488c973866fd13ddd3012f81546455505cabaddf202849f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188638, "uuid": "4476b7eb-6a4a-4051-8471-7b10b6367003", "value": "T1AE673367F19CA43ED06D2B310572A85028FBB7AAF4167D5763E0C48DCF664C10F3AA66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188638, "uuid": "61638081-9d7e-449b-b635-e32f881ef5ab", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188638, "uuid": "8699fb6e-4f5c-49c6-be3e-d9990af68432", "value": "786432:WFG9At9dMFTfmw+AcG6zTay4QHxo8y36d9ALxR2K0y:WpjVQz6zT14QRoLmA/N0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630188638, "uuid": "15d9636f-740b-410f-bd25-75690a4ed73f", "value": 29873698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630188638, "uuid": "962145b1-345a-4d28-b670-cd2b437377dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188638, "uuid": "3e1958e4-b792-437e-b574-60552413832b", "value": "39D25090FC9295FDA3AEBD680B33C4AC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9ec145-07c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630132037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132037, "uuid": "c05c2cbc-41fa-4c80-894e-9c2644159ea5", "comment": "Malware payload (Smoke Loader)", "value": "de8eec5e746361f7c402d0a4bc04bf09", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132037, "uuid": "bb9864ff-744c-4803-8cda-94670ae98635", "comment": "Malware payload (Smoke Loader)", "value": "9e3579db31758c11f1d09c73e2c06c39fe7cf69ce89ff91e4f9bb0aa65ae9160", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132037, "uuid": "cb55ecfe-fb03-4ff6-9227-647c0809c16b", "comment": "Malware payload (Smoke Loader)", "value": "c5ba3ec5f43673802fcad86e7ba633183f3f8a3e", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132037, "uuid": "fd6d55ee-bf6c-4590-b147-608a762155ec", "comment": "Malware payload (Smoke Loader)", "value": "5cb5a7fe8651a24b4729487f96753a8572808006c6dc832dcb27a9bb775ecbccf6abb17bf3eae06eb2e41e08c41e6dda", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132037, "uuid": "deb6e949-a423-419a-97f8-cf9d17e6c620", "value": "T1B4449C30A791C039E4F712F499BA83B9B5297AB0677440CF92D55AFA0B346E8EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132037, "uuid": "93f9d1de-bb6d-420f-9e3f-2c56eb3e668a", "value": "ebf21d5f80ce6d78a1158dea28ff74e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132037, "uuid": "9b24c169-bb29-4345-a61c-6860e91c61b7", "value": "6144:F493JJLT7ZyKylXlzh2McEY4OQErwb0uOq4ic5dhlr3r:gJFHZ9Ulz0ED5EEooZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132037, "uuid": "29df0e82-fcd9-4da6-bfb9-13291cd97c61", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132037, "uuid": "dfee42c1-b254-41f6-9a88-48ea34441e80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132037, "uuid": "bdaf2b27-2693-491a-a01a-32f543ab9964", "value": "de8eec5e746361f7c402d0a4bc04bf09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488a211a-084b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630187997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187997, "uuid": "c36ae38c-a056-4da7-9012-d85e86af2320", "comment": "Malware payload (Mirai)", "value": "7f158cc851fa810af2f3a3752ae7e812", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187997, "uuid": "b3619225-91f9-4232-9b61-fa4b9604a231", "comment": "Malware payload (Mirai)", "value": "a14e3d200f836a9d098f6570b0f995ec6a1dc9849f21f4c6cbfaa32f62b07284", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187997, "uuid": "57e272a0-637c-47ce-83b1-73df5ca96026", "comment": "Malware payload (Mirai)", "value": "e4b4afb36f9df1796464446704a6ca7c3995e1e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187997, "uuid": "b6b6136d-a897-45c0-894b-2765a045ea75", "comment": "Malware payload (Mirai)", "value": "3652afa1b712ef7fa7e49633327563fdca3f405bb60ce211fbd48d78a60b9f05ea829ec388b31bde4d12b39f93f6009c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187997, "uuid": "422ee2c2-0ab0-4272-b03d-fc4b838db471", "value": "T1B533F155B4047421CA303637E8361197FF4A1BFEC2E63833456943E8E8E95A33AF6C96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187997, "uuid": "4bb6d1dc-f7d8-411a-8977-b60f117fd29b", "value": "768:BMte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLrzvxaO9q3UELbOsY:BM84ISRX63dZQbS5rzZtazLIVmWjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187997, "uuid": "6c9bcc47-c398-4d3a-afff-a8e8090e8f62", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187997, "uuid": "a00e3e71-6075-4fb8-8761-00e72c97bd68", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187997, "uuid": "e260f184-e85a-4f89-ac99-3b10af8e4ef5", "value": "7f158cc851fa810af2f3a3752ae7e812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb97d2a-07c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630132013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132013, "uuid": "85e397e0-d0d4-4d21-af7b-d12399423934", "comment": "Malware payload (SnakeKeylogger)", "value": "030cf693e971644b7c014b2bef895c40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132013, "uuid": "30ec5def-1c49-408b-af00-37c39429aaff", "comment": "Malware payload (SnakeKeylogger)", "value": "a1588613803bbed9e0f4ae3f526aaacbbd2b6cba0d1b5c7f585403c0770e0788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132013, "uuid": "a0080d6d-b7fe-4b84-95a5-a9ff711721ef", "comment": "Malware payload (SnakeKeylogger)", "value": "547357de1e6455352e67633e438a400a0243a28c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132013, "uuid": "aff4efb8-f15c-408e-bacc-a4aea5c224af", "comment": "Malware payload (SnakeKeylogger)", "value": "1ea9b804551ab247d653568f6b99fc99fdb27e7c9f25982ebefbd915676cc4e39aff17ff5adff88b49730f0a65ada2e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132013, "uuid": "a3184e4a-8b50-4eac-8feb-40c988d86988", "value": "T11945B83DAD252533E7BA82F8C8860D4EE69414CB22734DDF42D2A7893117657B6FA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132013, "uuid": "440de609-d4f8-4da4-9c31-6d9f511deb83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132013, "uuid": "c57fa87a-ffcc-430c-bbd5-19e4302cba10", "value": "12288:gsbK4HtLGEUBXeu0BU5SisIid0kph+QrA2r79gEflEGD/XnyP112PdsfLosmoyJi:gspMwm5nS5D+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132013, "uuid": "8581808f-06df-4c7a-8aac-73dc7aaefbad", "value": 1262080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132013, "uuid": "508ad6c3-222d-46ff-a701-6648eced1e0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132013, "uuid": "3fc19dfc-ce72-41df-9cfe-c9b69bd358b7", "value": "030cf693e971644b7c014b2bef895c40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987b6403-07fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155060, "uuid": "ecffb997-7e8f-4a55-9a58-bd50ea39bac7", "comment": "Malware payload (Mirai)", "value": "9d39819054b587d99dcfd5a77e167e98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155060, "uuid": "c041882b-1a5e-4a60-9933-02d6a998e3bf", "comment": "Malware payload (Mirai)", "value": "a1c0173a5d3bf2553f8ce13df182a08c6bf1046b00b81c6019b3b0499d49a952", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155060, "uuid": "c7a3c539-ad0f-44ef-8654-c2e7fa56b33f", "comment": "Malware payload (Mirai)", "value": "6db0d4dc56829566d61826ec29b561de141ca2f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155060, "uuid": "eb567186-0a37-49f5-b802-f47ed0d0e68c", "comment": "Malware payload (Mirai)", "value": "50772c8b4fbe2389a97c1823baa0db4964f56310db9ba8db631fb930edad890f2c1e1ae2b2ad232f09fe082fb4109386", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155060, "uuid": "1f5fee61-009c-4f0f-93a3-a51ae2aa9231", "value": "T12453BFA2C9542D68DA154A747810CA749333F42487872FFAE555C37CC0279EEF1AA3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155060, "uuid": "187007f4-8772-4941-a527-89b545a809a0", "value": "1536:5aE242P22uINT5xAB7diyydq5QKl7hhc5fUCHpmfyu:5T242P22lT5xA3Tj53lw5fUZKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155060, "uuid": "d23d97d0-c06a-4840-b1c4-945d1d78c194", "value": 64312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155060, "uuid": "32a1cf34-e230-4970-a915-e6ac5b676f38", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155060, "uuid": "29b670ce-b6bd-47f7-9152-c867ea00cda1", "value": "9d39819054b587d99dcfd5a77e167e98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e859b2-082c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630174626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174626, "uuid": "1f31511c-c95c-42ae-ac5f-9a3c9fbdbe6f", "comment": "Malware payload (SnakeKeylogger)", "value": "aea6adfba6a5a177f26cd2a1eb97f0e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174626, "uuid": "79155d8d-cd2e-4493-a23b-2e8336a5cbc5", "comment": "Malware payload (SnakeKeylogger)", "value": "a1ef7c34fac1d166d47f99112a77e8f00f229c78f3a248da9ef005387997001a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174626, "uuid": "6517d4ae-ccc9-4762-a141-4cfee4704ede", "comment": "Malware payload (SnakeKeylogger)", "value": "ea4073537a6c8c842f73cb415cd865f78e6d0817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174626, "uuid": "64905564-a2e4-497c-8975-c7a191f7d403", "comment": "Malware payload (SnakeKeylogger)", "value": "feabbe54fdc1f6b2453a90475ffd344e7d08ce7bac6786ae3c52b17efe137faa383a9690c2ff447099503d245c13c107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174626, "uuid": "c6cf7a1a-6ca2-404d-8259-ef43d9ef0a45", "value": "T11225663DAD292533E7BA86F8C4864D4EE69454CB26334DDF42D2A7893007617B6FA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174626, "uuid": "db5de460-a898-44ec-bbeb-66ef7433ce85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174626, "uuid": "6ec7146c-c555-44e1-a5e6-d3bbea7092cd", "value": "12288:fYhbK4HtLGEUBXeu0BU5SisIid0kph+QrA2r79gEflEGD/XnyP112PdsfLosmoyy:2wFLDR43j0DEF8v5zUBrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630174626, "uuid": "b58a309c-8dec-421a-a35e-7b9bb1b219ce", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630174626, "uuid": "27cc36b7-b904-471e-950c-eece616e2117", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174626, "uuid": "1cd7088b-ee7f-4862-98f4-517d60d8ba07", "value": "aea6adfba6a5a177f26cd2a1eb97f0e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a756dec2-0814-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630164534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164534, "uuid": "e556431a-d181-400b-9dc5-780006846f45", "comment": "Malware payload (Mirai)", "value": "449fb8ea681e5c00880fd10c2dc3edf8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164534, "uuid": "d1dfb0de-7124-43dd-b528-bc04e0850d07", "comment": "Malware payload (Mirai)", "value": "a2698dac15d0f75ddecddb8a41e3db6162a6c96f907de1123360cb4908469c29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164534, "uuid": "db1d1b66-8b6b-4ba1-9f4b-098cbcb04b95", "comment": "Malware payload (Mirai)", "value": "ca3126450afbb3c84eb2d554883e1e62534c20a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164534, "uuid": "20854231-8ae3-403b-b59d-82ee1b9191ce", "comment": "Malware payload (Mirai)", "value": "5d94ccf5ebd1528fe9cb5ee9b5c780e017ac6c7b9703c05461af5f326746a5a68defcec5d8d70df0a0d2cf6f4a26f904", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164534, "uuid": "0cf9704e-67f8-4129-be46-4eb13076b1c5", "value": "T1F673EA492E318FEDF6A9823587B34B20A759338523E0D28AE26CEE015F7034D655F7E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164534, "uuid": "88a27cab-316e-4cd4-9de6-6f5a5129b7d0", "value": "1536:FPrm5FCfoRRjQZkMRDsv1MYDrEIyx3wdRjaCKoy7K0XqDKKN0eaBwr/K9y:Zm5FCwRRjQZkMRDsviYDrEIyx3wPaCKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630164534, "uuid": "d9199687-b174-47c3-9a13-a3ccec7e3e58", "value": 77292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630164534, "uuid": "4347d7a5-db0e-4420-9056-5c30e7696de9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164534, "uuid": "4e6beebd-c427-4166-b2f3-6ab6470cd6ed", "value": "449fb8ea681e5c00880fd10c2dc3edf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8b9e6e-081f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630169406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630169406, "uuid": "da762f75-3445-408b-8058-e5ab74ea7506", "comment": "Malware payload (Mirai)", "value": "6da9a828e5b11d121ec30e4bb2216b4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630169406, "uuid": "ae9da6c4-280e-4bc4-920d-b177658a5bcf", "comment": "Malware payload (Mirai)", "value": "a2cc1bf8651cac60a3b81a0df5f9884281a1fd398a3233f72189033f9f57b5e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630169406, "uuid": "fb502ec4-b825-4cb8-ae49-0ac02ba65c45", "comment": "Malware payload (Mirai)", "value": "3941a196861c8569c874f34af9317377f2578b16", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630169406, "uuid": "5eefaee2-2a58-4054-bfda-5621aa32949d", "comment": "Malware payload (Mirai)", "value": "7222e4ffaf8c7d4d4666770601188a989233a114cb49060fa8c176bc7058a8da5ea6ece9c3b0ee35b06df097408971d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630169406, "uuid": "27364585-e8ae-49d2-bb6d-086f34a99ddf", "value": "T19BD2E13067057860C875483D9BB847571BF720DAE6EAB6301F41553497D720862B8BFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630169406, "uuid": "59913ea0-03ec-4b47-9eb3-2c46a4429571", "value": "768:n9f4FKCpiH1QlKZ13b5iRW2qqZeJ8uUTDE6I72jyvHs3UozS:n9fjCpsqlKn5ji5ASjyv6zS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630169406, "uuid": "db3205b3-3056-4e59-8bc0-d9b74c804a00", "value": 29908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630169406, "uuid": "d101c19f-8ce2-4def-a815-9aef4e397119", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630169406, "uuid": "87087332-efae-422d-9334-323e852bc399", "value": "fbot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497a8eb9-0813-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630163947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163947, "uuid": "01c40a4b-9277-4d6f-bb79-1069ea3b7a12", "comment": "Malware payload (Mirai)", "value": "c19ba85383a7c480edf875e859bd41a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163947, "uuid": "b3ceee2f-6ac0-47d6-a0d9-74376f078c41", "comment": "Malware payload (Mirai)", "value": "a4ebbbc8084baa812393fa4a121aac1b88a4e3edaf341c1d563cb241adf71412", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163947, "uuid": "48ffec0d-dbbc-423b-8306-480f9956490d", "comment": "Malware payload (Mirai)", "value": "ea839711840ae051a1b714ec19c22e5f810e34bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630163947, "uuid": "0f9c0f55-5b4f-4e3a-a72d-9b2a161b2871", "comment": "Malware payload (Mirai)", "value": "f192b9ce9f05670436f8a20ec9fb8047187bafd8f255b83cd48995c09f4af47af6355daedbdcc3d98dd693c9f970aa49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630163947, "uuid": "bcc8372e-e20d-4a5a-a7d6-4aaf393a29b4", "value": "T1A9034B99B9D34F2AC5E15B7ABA1F233C331A93DCC2CB3303C41867943A8951A5F6B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630163947, "uuid": "a32d07eb-89bb-49f8-b3a8-e672fbdadaec", "value": "768:5hgMauH5HKAqfpnuDd16lHHhbc4t/GD4WAyNcg6/K5c:WZAWhuJ1ub/GxXNcf/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630163947, "uuid": "b6669d60-ff52-4184-b0d1-ebe9d9ab597b", "value": 40280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630163947, "uuid": "f02af049-eb94-45f0-a82e-4f8b1fb77eb9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630163947, "uuid": "29bcbaa2-65bd-4797-ad75-7ffa1b169cd6", "value": "c19ba85383a7c480edf875e859bd41a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b423aff-07c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630129214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129214, "uuid": "b16ce0ff-620c-43f5-92cb-33aedc7ad619", "comment": "Malware payload (Mirai)", "value": "caa2e3dd6d879b4c0e1c9935f713c8c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129214, "uuid": "db49c8e7-af71-44f3-835c-d2e9a5708e29", "comment": "Malware payload (Mirai)", "value": "a50f4ef8533fc26c39ba323664e1800b3a9f1f7b8b5813feca61bfaaf5eba166", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129214, "uuid": "f9295d06-4e26-4e12-99bd-c495c01623db", "comment": "Malware payload (Mirai)", "value": "6d6f6265d9d19c428a5a521c4d07e8be4f24b2db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129214, "uuid": "012fc0b4-3bf1-40ee-8937-f4b47048c3d8", "comment": "Malware payload (Mirai)", "value": "03dc51cd8dc673995d4f94ad06dab0114a52c955f8b56a26d9bb3b642f79ac54081e44dea3356e36344bb94120d86f29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129214, "uuid": "b1315b84-8486-46ef-9f09-557b6eafa219", "value": "T1DA732956F8915A2BC5D022BAB66E628C333163E8D3DB3113ED6017747ACA01F5E37E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129214, "uuid": "991770a0-9cff-4f12-ad8b-6eeebf51a2fd", "value": "1536:d/WpThZ7X6b0GgjM9ITXNJctMUVMDKyx+pIxnRgRAQaP5zEI/4d266Guca1NWxi:d/W9zC0GgjXTIi++IwRHPhAdbGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630129214, "uuid": "a08b31b8-1dce-4e7e-9f9f-1c52e81433f9", "value": 76644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630129214, "uuid": "368f9cda-5569-43fc-a51d-b932d69be4a9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129214, "uuid": "cb8baa96-09c0-45e7-ba40-e82ac6844d3d", "value": "caa2e3dd6d879b4c0e1c9935f713c8c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65fb29f-07c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630131890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131890, "uuid": "cd30628a-88fc-4c3d-b794-c37d4468f720", "comment": "Malware payload (AsyncRAT)", "value": "d9cce325c03d67363466fe82850dcbc9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131890, "uuid": "1729cadf-2040-4088-939c-e64c6eb31f83", "comment": "Malware payload (AsyncRAT)", "value": "a6b2a3131669d745ce097d784a1e227b0e80cb246ea364ef9301cf7887ef1d8c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131890, "uuid": "0c4299f6-9b5e-4bee-b066-0e50ec701ac6", "comment": "Malware payload (AsyncRAT)", "value": "0f71a9a19d65280751376d5c6d5c05681e8fb628", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131890, "uuid": "9211d976-6ab3-46e6-aba3-8af2fed74026", "comment": "Malware payload (AsyncRAT)", "value": "e78c9827540b439f5663cbe009a0a6df7591d0bce695adea9acd12d83ea637b2e696f92bb92beba320faf216f93b211b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131890, "uuid": "91d2d146-d9b0-45b4-8757-c121eee07468", "value": "T160A415909EEFDEDEC26F623FA04A5C9205DEC3064757A2E58F464E31B3842279C561E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131890, "uuid": "712a17b7-efe9-41e9-8e76-7b88cdba8f96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131890, "uuid": "a6284ad7-9099-4c1e-b2cc-e06c6b80c0c8", "value": "12288:7HKmGHcjHd6/FthMnPsYF8WyaAvS7wXF29ITXDwT2U:zKRHcA/rKrdyLXgQsT2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630131890, "uuid": "8631518f-99c3-4040-b57a-b23ca6a83e5a", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630131890, "uuid": "363b4708-8878-4e8e-99a5-08fe1a0e5160", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131890, "uuid": "efee3795-9d12-471e-9e91-6d294f0a496e", "value": "d9cce325c03d67363466fe82850dcbc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36e72cb-07ed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630147804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147804, "uuid": "56ebe4cc-72ac-461d-ba1d-ecfd8f5dcf41", "comment": "Malware payload (Mirai)", "value": "0a124588fec217811185c50fa9c01b6b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147804, "uuid": "8fb333c4-9506-47d6-9eec-88a2f53d7ba9", "comment": "Malware payload (Mirai)", "value": "a80bef6a3904dfa4829e8943933b863fdadb40ca4f084a739c620957af161010", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147804, "uuid": "fab4a44a-04dd-436e-93e6-b49f31b6e056", "comment": "Malware payload (Mirai)", "value": "a1239ffbf3e5d3e23e11df6a47b857ad89738882", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147804, "uuid": "067f33c3-57b7-4bb2-8d13-2cdbbd2c9689", "comment": "Malware payload (Mirai)", "value": "d12b2f69cc79f024ecdfbf1ab2ff3de67d49ce98122c668c09425e7cbf20664a556577608faf94e26ee0ca78cfd49dfc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630147804, "uuid": "f5f8b891-98d0-44cf-a96e-cc077c75d50f", "value": "T1A32302432097BA03E0345CFA45638C8DB65AA6BDB17E7BAB25440E154C35DA2FCB18ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630147804, "uuid": "5cdc8cc9-625d-4e0a-9169-c53abb34a6f4", "value": "768:nK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFVt9q3UELWt/iw+kvBGg6+fYtrBHY:P12O1LCNguovDPH7TcrQLWhiw+kvBGgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630147804, "uuid": "fb21c3cf-5997-4e82-9f02-7b41dafa615f", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630147804, "uuid": "037229c4-b5fc-4874-bdeb-7381af6ac6d6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630147804, "uuid": "a9ea4c53-1206-4efd-adc6-822455e63cdc", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9708ead-0827-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630172778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630172778, "uuid": "d5cb4398-ff6a-4dda-afc2-58f58ca2f493", "comment": "Malware payload", "value": "b1e4153112eeffbb94901eff279b4906", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630172778, "uuid": "7d927e38-d221-41ef-8c84-80a11d62f3ad", "comment": "Malware payload", "value": "a85c22187f9954c213838e6e503745e9c13011cf0b9291ee22f7778ef75c8eb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630172778, "uuid": "89482b30-6f6e-4954-9cef-e307ba713238", "comment": "Malware payload", "value": "a1dc1956a01e650fe179b8c262e09e2af8f2e2e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630172778, "uuid": "59ea1b99-4199-458a-bbc3-ba7e68c6e080", "comment": "Malware payload", "value": "1ea8efebad4a9473eab8ba8ef6de4d6732b0595635287ea6b1adfa9ed6bc491b107e1c021e48e13d8a8fc762aee2c1ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630172778, "uuid": "23ead6c4-a242-42df-b16a-dd1fa3c8cdf6", "value": "T18014F96877817A5FCA6A9C72C4E11C6053B0E1671723E747608322FC8E1E7DEAE495F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630172778, "uuid": "8a0eb6ce-2312-4a95-8c91-b3e9a11c6f12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630172778, "uuid": "6110a970-4ced-4d8f-aee3-30f9eee207a7", "value": "3072:QIoy0yDKxuIP6Np04JIO/GRXFriIJ0VZhyKNIk/FKxQ6Y7h/FdBR2BI4Wb:QIoN/PD4J1/GRHJeZhyUIktKZY7h/FdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630172778, "uuid": "0c3a15ec-47c3-4b21-8535-a8108ba2214f", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630172778, "uuid": "b82f8f02-a5e5-4a47-9934-e618b44330fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630172778, "uuid": "e45aeb11-31de-4f5b-be51-13ad490c0274", "value": "b1e4153112eeffbb94901eff279b4906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "137993b6-07f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630151830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630151830, "uuid": "77be6168-89c9-4ae6-acd5-bf058c2ef498", "comment": "Malware payload", "value": "0caeee67a5584228d24c033dd8f4b2da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630151830, "uuid": "bb637869-e0de-4907-90ef-d6775617eec5", "comment": "Malware payload", "value": "a85fffc4f45740bc783406df43d854ddf74937094dbea3e9256fa9e9dcc8a7ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630151830, "uuid": "12d89ef9-aef2-4fb1-9ff6-f0a0d19e6792", "comment": "Malware payload", "value": "dcf69a59ea1556b92ece62f03bc2e0fdbfd86a2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630151830, "uuid": "2128cb50-7fb6-4925-a74f-22ad86c61cdb", "comment": "Malware payload", "value": "960217a5685738aa5f999452adcb6b44c757c939533fc9575b8ae3977141ba5722ec95a265baf436b7cc6380fd892178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630151830, "uuid": "58bef7bd-ca49-46f3-a95f-82b853c9aec5", "value": "T18BB53351CBDE4A61C08D78BE485B0FCC47F43A1B1D3E63DECA41AC4DE5A4B236CA9691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630151830, "uuid": "fadef7b6-e7c7-46a3-a2d8-76c39e5e9fae", "value": "5aa94c7fbfc01c9462c4d62e06efe88a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630151830, "uuid": "8f619ef1-68da-4c5c-9799-79a9d4bd8e30", "value": "49152:8iKJjNaAg/APv0hLPnvPmH/jaSZ3YAdnT9eXnhgixGdas9XKAAvy6:8iKJjNncA8jvPujNZ3jdInh14hXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630151830, "uuid": "ee58346e-32d0-4ca8-a7e1-7ce221b1d9eb", "value": 2287360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630151830, "uuid": "281112be-94f0-485b-b0bd-dfa1945c6187", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630151830, "uuid": "406c5cfd-d3a3-4840-ba1e-247a922ad085", "value": "flashplayer_install_cn_fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad01ee6-080f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630162204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162204, "uuid": "6875faaa-f63a-4b0d-992c-202436a342d4", "comment": "Malware payload (Mirai)", "value": "319dbf3214b34497b918382b4e7f971e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162204, "uuid": "d63a1254-6370-4f3a-b42a-7cc764c160cd", "comment": "Malware payload (Mirai)", "value": "a8a0d8a748246f1d1bc54ccde10b9673bf8f7b1d2cdd467214b1e8659ecfe9ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162204, "uuid": "87c008d1-ae14-4e2d-b7bb-facd0dd89d84", "comment": "Malware payload (Mirai)", "value": "f443810ea5bef04cc6c453725c024d727248f236", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162204, "uuid": "26a8e0d8-5ea7-427a-bbc6-5596c6f7d840", "comment": "Malware payload (Mirai)", "value": "d7044131104d7c4c210ba827681880022774d2135ac9572bb613f9bc6d359741c849b045b54dc4be366746824ec4d0e1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162204, "uuid": "663f2b44-04e0-4bc0-8e0a-39b3de27fae4", "value": "T138438EC96B87C8B5EC124B7A10BBDB3217BED62A1115F787D35C9631ED03602E61B68C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162204, "uuid": "3b09ec17-e272-48ed-83b5-1608b9814365", "value": "768:zH/oo5qjn3aDJ0h/xa/XvelQyMFS4lVqKPChIGSOevqO8ifSAKlhIH:zHwo5eIHvveKyMFBRcRSTvqwfSAK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630162204, "uuid": "86c5c752-0542-48ae-b799-4c552a84a288", "value": 55312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630162204, "uuid": "1772e7f8-aa70-41c4-b9a6-592606bb8e6a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162204, "uuid": "774a4162-904a-40d8-ad85-dff67975c8a6", "value": "x86-20210828-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70d1ca4-0843-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630184746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184746, "uuid": "ba4979a9-ba0c-423f-a732-ea3ea3bdbead", "comment": "Malware payload (BitRAT)", "value": "b8f76d9cd83557379f3fe8b5dd080f9a", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184746, "uuid": "8510ba57-17d1-4e7e-9351-357871261ac5", "comment": "Malware payload (BitRAT)", "value": "a92eb964d56ff8dccb926598aca597a6244d10334f264aafcba9752a30dbe9b3", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184746, "uuid": "b41dba6a-c936-4c3e-bb05-b8a198d99d84", "comment": "Malware payload (BitRAT)", "value": "5420b910b3230a670a79a6193fc76a7864a51967", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184746, "uuid": "c57c8fa5-501d-4118-b149-9983f0a47faa", "comment": "Malware payload (BitRAT)", "value": "9740228dc79077643ad73e33d9b408e4514e925f9bda7c98cf4b569210f33223e4b5dd457d3a54a386006eda3e6eea71", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184746, "uuid": "3631599f-ebb4-4302-b7bf-bc70fc493c8c", "value": "T169547C30AA91C034E1B712F855B683BCB93A7AB16B3590CF52E11AEE56346E5EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184746, "uuid": "1cb701bf-88f3-4d09-98da-ebbfc34b53b6", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184746, "uuid": "40a0d4b3-06ad-432a-a4a7-e9c882646e07", "value": "6144:4+684/smLIj3cTEmfkBxyueYSasa62jcNSDCa76gPp6o6RnQC9Tt:E8GsmoM4l5g52jASDXd6pnP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630184746, "uuid": "c27d85c0-a043-4299-bc20-0fa69a91bfb3", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630184746, "uuid": "cfbb6258-170f-4729-b93b-0bd2b2529183", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184746, "uuid": "ce3fecf7-5649-471f-8561-62d0a609079f", "value": "b8f76d9cd83557379f3fe8b5dd080f9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b35688-07c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630132164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132164, "uuid": "11b0c332-eb3c-4bd6-9519-55f33f7c1cf4", "comment": "Malware payload (RedLineStealer)", "value": "0400deb0385271fe8dfa6f3e04634e35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132164, "uuid": "8e97a5f8-166d-4587-a630-8343cb0a11f6", "comment": "Malware payload (RedLineStealer)", "value": "a98d15a56f875c949b20cf5ddc275ca9161e4451486afacc5f097a4ab300a5a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132164, "uuid": "5621ed86-be15-4630-992f-555c20d70faf", "comment": "Malware payload (RedLineStealer)", "value": "cb800548cdf39a6d7a6ad4347d7b109b32a059e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132164, "uuid": "0c9a7289-d15b-4c39-aa6b-82c6499009b5", "comment": "Malware payload (RedLineStealer)", "value": "c160ef3389385d60f22350055877a20a3ce5f7fa878ba08650ba6e53ab9c489fbf7e0ec01b88ad8b043709dc6a4aaec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132164, "uuid": "a0f6d3b2-af3f-44f0-a41a-63bbfc301881", "value": "T18F74BE30A791C035E4F712F859B683B9B5293EB0677450CF92D526EA1B386E8ED3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132164, "uuid": "10813520-a83d-4724-8a5a-a5898a4385ff", "value": "ebf21d5f80ce6d78a1158dea28ff74e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132164, "uuid": "24758de2-36f1-4f93-bdef-2f7afad87592", "value": "6144:V/OdypKpzasFJTB6rzZ8f51q+88ll78Ne2gEXpNIZqlJAb5ozhoHr0Kc0su:6TJaG1MZC1q18rIN4EX+q6Mh3j0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132164, "uuid": "61cac9ca-12e1-4044-9fc5-9df395189188", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132164, "uuid": "5358d480-d867-4959-ba26-e1414701290a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132164, "uuid": "fa4c2137-197d-4ebb-8db6-de3b47a9a1c4", "value": "0400deb0385271fe8dfa6f3e04634e35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288a5f7b-082c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630174629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174629, "uuid": "f52d95e6-d875-48a0-9379-e402be34bac1", "comment": "Malware payload (AgentTesla)", "value": "344a0bdb12347da6f51a1b1f72322f84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174629, "uuid": "cfdec07e-b0f5-4695-b024-a444471624e8", "comment": "Malware payload (AgentTesla)", "value": "aba57641d78a1a42badcc96adf738e022b1cf0b673e95bf6a47b4c8532ed98a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174629, "uuid": "6bbd5b5f-7217-4f14-a13e-57f4c3129f52", "comment": "Malware payload (AgentTesla)", "value": "440518e7db26d475cfc34547071b4f4923cd2686", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174629, "uuid": "ab20e32c-5a14-4ba8-a1a7-d0653bf48dad", "comment": "Malware payload (AgentTesla)", "value": "0b5764030af3ebf082f7656586976ec09e20a117d3ff91871e5fc3ab91025d0a8c44bc6797f82fa77287d35ecaec8f1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174629, "uuid": "c95461fd-1655-48d7-8dbf-a484320ad374", "value": "T10435B93DAD292533E7BA86F8C4864D4EE69454CB26334DDF42D2A7893007617B6FA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174629, "uuid": "761f8e4f-4ef6-435e-89a7-a9cefff2887d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174629, "uuid": "c130cd09-79bc-4459-b9fe-e49c17408b04", "value": "12288:GE9bK4HtLGEUBXeu0BU5SisIid0kph+QrA2r79gEflEGD/XnyP112PdsfLosmoyF:6w2T9E+6/Necp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630174629, "uuid": "1fdb0c5b-024a-402e-9930-ad7250b62243", "value": 1128960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630174629, "uuid": "ded9c3ef-d212-4c7d-bbe6-6655f0f31d1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174629, "uuid": "caeccac7-39eb-45ca-bc4e-c237997cb285", "value": "344a0bdb12347da6f51a1b1f72322f84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8d5aa3-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630167868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167868, "uuid": "da368f10-807c-41ea-a985-12580d4b28cb", "comment": "Malware payload (RaccoonStealer)", "value": "dd887717779d5bfd4f78471908ee887d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167868, "uuid": "8b0fa9c2-15c7-4431-b38e-f604028036bb", "comment": "Malware payload (RaccoonStealer)", "value": "abe7144e537cd80c762392c34798f3a6a197acf4c60b7ac371ae2288a170267d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167868, "uuid": "6a78d1be-15f1-41ef-85a0-cd8055683f53", "comment": "Malware payload (RaccoonStealer)", "value": "2244802ad08415dc4550b86b599fef61c1dd0453", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167868, "uuid": "386d0ea5-1343-497d-bb98-f8f4f9a60288", "comment": "Malware payload (RaccoonStealer)", "value": "fb51a8e99bd31c29ffc4a70746365c9dcddd91be77df4b4d5054780279dc94629927a99e202b7bcde95e66c6af63fbb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167868, "uuid": "c33041ea-fcbe-46bf-8a40-90d28d71423d", "value": "T163E3CF2935F0C173C6C658B0485896A1263BFD326A7599873B4B77AF3E316C1863E393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167868, "uuid": "d75e8efb-9dd0-49d7-a63b-c166b2c0ed69", "value": "d3c9c233147536fd2cb825c3f3ce75bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167868, "uuid": "59a3ab59-64e6-46c1-a2c2-881ec741782c", "value": "1536:+kybkpbeEkWiqvRInkI4VVU8LVeAN1z50cpNaO5bmYMsjk5/Npj6T61mD:+g3+8LVr1z50cpE3sI5/DuT61m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167868, "uuid": "2ca0847b-91ea-466c-8217-8640e129ef6c", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167868, "uuid": "064db668-362d-4ff0-807c-705ffd6f5586", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167868, "uuid": "361de834-3856-4c15-a80e-9c2eb8c8ee93", "value": "dd887717779d5bfd4f78471908ee887d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3680c99-081b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630167641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167641, "uuid": "faf87c8b-343a-415d-99ab-118badae4429", "comment": "Malware payload (Formbook)", "value": "3235ee16bb12ac83bd145a7d87b09618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167641, "uuid": "9174e36b-f11c-4627-8282-2026705a6ec0", "comment": "Malware payload (Formbook)", "value": "ac67dec533d5b06a41145ba39ea674e30ed03bd09dabee9e0417bef18943edd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167641, "uuid": "9a2edbf9-5b0a-4e95-85b5-ab214e4e4ab8", "comment": "Malware payload (Formbook)", "value": "fc38af3749e0d33b38d2c1aa317c39918c494f76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167641, "uuid": "3ab2bf5b-5304-4778-8720-584ad7f3fb8f", "comment": "Malware payload (Formbook)", "value": "fa3cba2f179474939f75aeb6b2daf865ea71581146febc719f151550ea0d1f66a09443c0260da2dd9ffc1c19f3f13c90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167641, "uuid": "b4d5a9a4-cb57-4604-8da5-49744a49ac52", "value": "T1FAF4C97E19BDA12BD165C6FA8BE38427F0108F6E3110692466D27716433297AF4F336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167641, "uuid": "f6eb1a75-deda-463e-ba00-03feb7ef0010", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167641, "uuid": "7e6a29a9-3351-403c-9129-c958156f990d", "value": "12288:pbeFZlNhJdLEHgjM+fK8I4nVfcphY/+A:+Z5JdLzu4VfcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167641, "uuid": "c5c08ebf-670c-4cfe-a00d-cb0cff35ef66", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167641, "uuid": "94d6116f-98c6-47b0-8a3c-65058f864db4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167641, "uuid": "ec7bb7ac-7f88-4691-9462-404e0cfe5de9", "value": "PO 4100066995.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86969ee6-0841-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630183806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183806, "uuid": "51c5e433-61cf-44d4-b6f4-7ede6293c958", "comment": "Malware payload (Mirai)", "value": "27736e4213a50078e8f032d0f85339cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183806, "uuid": "2ededdd2-6b99-4c61-9609-a6c79c35991c", "comment": "Malware payload (Mirai)", "value": "afbd71db408e7f4654ea1a198c9002a5aeb7688f4751751f7cd2589c95b86a14", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183806, "uuid": "9018b9bd-cd52-4cac-aeec-4a3947c08f48", "comment": "Malware payload (Mirai)", "value": "b30a5ce4ddecdec2a74492171b2d3a520a66b1bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630183806, "uuid": "b2411f79-e8dd-41d0-8bee-f15b5d836f41", "comment": "Malware payload (Mirai)", "value": "d9ddad9b395e7a14f07959e8ad70810ff31e9c3861061c9a4fc57eda5ff3d657ab635af08f29a36bf433c9e6c3561599", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183806, "uuid": "7f91c354-4910-466c-a1ed-c25c8668b073", "value": "T1995339C0A983DCF2DD1146B83177FF328636F436212AE9E7D7D9A923AC81E41910729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183806, "uuid": "5782aded-10a3-4f14-b0d3-78ea86e10168", "value": "1536:VMzVhePhrkmetvEuckIzN/hkfgiu5Bz2sYmrpY8+3UoBiAGpTLEx:VMzVhePlkmetvBcxJhyu5BCyrpE1oAGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630183806, "uuid": "dd8c0a61-594a-4c4b-810d-6ab598188766", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630183806, "uuid": "ed7fcec5-6ff2-4bd0-9ef4-d9e4113a3b96", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630183806, "uuid": "97badeca-2896-4d91-8281-612c7d6e09e6", "value": "vcimanagement.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a75095-0814-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630164288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164288, "uuid": "6c7f97cf-d966-461a-a92c-45ca882be2ce", "comment": "Malware payload (Mirai)", "value": "0c6b0e02667c2bb6486ff3d87fad5aec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164288, "uuid": "5cefc265-1933-433a-a916-fa2ba9a1e4b3", "comment": "Malware payload (Mirai)", "value": "b06c78ead9a83636f99110896bfd0cd40e86e3d3d8c84839fd51da4c94767d9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164288, "uuid": "ebf06dee-54cc-4f6e-87d7-f472957093b3", "comment": "Malware payload (Mirai)", "value": "d4ee0e96515da479b0e653716ee3f72b3b37fa54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630164288, "uuid": "58b91cc6-5fba-4e96-8d1c-d2422a43bd56", "comment": "Malware payload (Mirai)", "value": "06c90dd9335e99fd6ec9e756b49ca9e2e237f0608b6bb79d0a5fc0b93c9958248fbb961b80116bdf3891d372f764945f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164288, "uuid": "718d9a69-e8b6-4bc3-97da-4695e80292ec", "value": "T1BD438DD7CAB16E68C249863436268F3C67A3D54892873FBE1159C335A843ECCF55A3E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164288, "uuid": "766f1cb7-0333-4c94-b21f-3aa51cc31963", "value": "1536:ZaBSF4/cdJFlGW8GoKb9yhTPdM5Cfnzk/KDE8:ZAwTLG0bsPO5SkSD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630164288, "uuid": "dc6814c4-890c-4378-8280-551b96e1b274", "value": 56436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630164288, "uuid": "2ac798ab-a628-408e-babd-79512fbb8f4e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630164288, "uuid": "47600c6e-88ec-4869-be36-8d42908da465", "value": "0c6b0e02667c2bb6486ff3d87fad5aec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dab825b-083e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630182342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182342, "uuid": "bd2ce78d-0356-4e35-8721-3e910ab1fde1", "comment": "Malware payload (njrat)", "value": "b4b3024e4530395f1befe7e000e521aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182342, "uuid": "c03e88c4-180c-4d63-8e9a-9c79020159f8", "comment": "Malware payload (njrat)", "value": "b0e4ffe4f149f9b6435fec757518ae2ba99293d416a28a3aebda4e877c2013e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182342, "uuid": "3f739d8f-8e4f-429d-a626-28a04fc859ea", "comment": "Malware payload (njrat)", "value": "cf3ca2519b8f6a654807e384e31883cadf967aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182342, "uuid": "b0343b0e-315e-41ec-b4ff-d0bd5d91fedf", "comment": "Malware payload (njrat)", "value": "b6dd9372dab9788fc67695242ae4cf3829194b656aeb6b1bd22505f587c42d37d2b0df455d8bfcc1da9f06ba9f55ea15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630182342, "uuid": "fb38811c-000e-4729-95da-7f9403091283", "value": "T10093E84977E53524E1BF5AF79471B2004E38B4871602E39D48F259AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630182342, "uuid": "9901cd04-4a2d-4cd2-b94a-07bce0260296", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630182342, "uuid": "b2e5e724-dbf7-431c-b2d4-790b37970b26", "value": "768:MY3SYgSgmnldjcRoMwrx7Y+DIkIITJbXX0pOt8ux82WXxrjEtCdnl2pi1Rz4Rk37:eYumlbrq+1NTZ0OojEwzGi1dDFD5gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630182342, "uuid": "700020ed-aaca-41f5-bf76-ed0eb124d274", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630182342, "uuid": "ee1b3e94-4ba7-4eb8-8219-d8a013d89976", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630182342, "uuid": "5959dad7-7e09-40ca-84fb-2b47728703d9", "value": "b4b3024e4530395f1befe7e000e521aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23eb771b-080e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630161736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630161736, "uuid": "503febcc-031e-4214-aba2-7f857ba1aa94", "comment": "Malware payload", "value": "0e345c21a363a5b2f7e1671ca4240100", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630161736, "uuid": "0d5edf8a-24b8-49ab-8987-9c34b568754a", "comment": "Malware payload", "value": "b13ef0aebbfd56ec25e6e358e25d25261cd631f318f9b26835783ec34ac8897d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630161736, "uuid": "cf6e721f-1501-41bd-8ec0-b4911e0b2e16", "comment": "Malware payload", "value": "a5e64ba807c024bcbbb159382fcdbbd1ad436153", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630161736, "uuid": "5e067f7e-1f11-4534-9057-45ddf49637a2", "comment": "Malware payload", "value": "a12de7727e41843df1413815b5341d8b3caa94d17b97fe3321cee7b5b5d91d16f2e41fca46b01c64ecf862034e205aad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630161736, "uuid": "795599d2-898f-4143-9305-80b8e7386fb7", "value": "T145A34A00B2D1C471F0B35A3218B59AA15A2DFE714F65AEEF6388125E0F740D1AE35EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630161736, "uuid": "648a7fab-c2e2-4a4b-8d30-e7480792a86d", "value": "c6135ffdfa8b888ab780237cbe8d7634", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630161736, "uuid": "1a03209b-784e-42e1-bd68-79523c813c9e", "value": "3072:vH5ehX4B1I+Fe7UovWk07XFBbyzqRyZD4Ji/:heJK1RkZGzw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630161736, "uuid": "fce4839e-28a5-4800-8600-a95fb5d6e74a", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630161736, "uuid": "8d122615-f18d-4888-a99c-853548d95507", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630161736, "uuid": "d96a2ad8-682a-4663-8b18-27f225755232", "value": "0e345c21a363a5b2f7e1671ca4240100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc834a73-07a0-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630114774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630114774, "uuid": "4b061548-df62-4ca2-b0a7-355ca51b7d34", "comment": "Malware payload", "value": "84aae592452ea2342f13c5df98c1f5c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630114774, "uuid": "7b4e1e62-dcb1-4dcd-9b69-daef642ea982", "comment": "Malware payload", "value": "b189bec04f2062bd4c239ed2609df69b3305566e63db26275e09506815c2b067", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630114774, "uuid": "7a22487c-bfcf-4722-aa68-cd30e241228a", "comment": "Malware payload", "value": "49c6a0abeb38acf28d676123b88b1c7900c3f412", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630114774, "uuid": "b51ce41b-2cf1-4c73-9ef6-8f655c1ef68a", "comment": "Malware payload", "value": "5591d0dec331dab61b837d507dd38e0338cf6bfa2f6e67ed2b6f5bbc4d131ae9cccfcde79b611ed31091761468ee6ed9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630114774, "uuid": "3c2e74d0-830b-4883-856a-5eae1222361f", "value": "T17F34DF8AFE01AF05D99535BAFB8F028D72674B6CD3FEB011E924572627C669B0F32015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630114774, "uuid": "b0ffb24d-4b64-44aa-9c43-8dac201a0070", "value": "6144:p3lOYoaja8xzx/0wsxzSigabE5wKSDP99zBalOr:p1CG/jsxzXgabEDSDP99zBalOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630114774, "uuid": "58297757-53a5-4360-a38c-b2a4741df8cb", "value": 240768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630114774, "uuid": "6d63cf9d-7b77-4a70-9f98-da708de41245", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630114774, "uuid": "8013da28-3ff0-4d9b-9cfe-2c04f94c9d8a", "value": "84aae592452ea2342f13c5df98c1f5c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb6848e-0857-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1630193431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630193431, "uuid": "b3abf706-7e64-4ec4-a2fa-5b26cd92e8bd", "comment": "Malware payload (DiamondFox)", "value": "1df01ae4f663bbb5bdc2abb2d68a1348", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630193431, "uuid": "2dbd456a-fb8e-461d-9e5a-07330a26cbab", "comment": "Malware payload (DiamondFox)", "value": "b1c5d186dc4924256dc9e8f9fad845bdb583f7028c547aa8ca2fe2076e2a081f", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630193431, "uuid": "d987da1a-b12e-4ed9-b1f8-70f6fd1b7a43", "comment": "Malware payload (DiamondFox)", "value": "bed2b62f36b774a21cb14ee8c1e98363458028fc", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630193431, "uuid": "bda10153-b03b-4ba0-9605-52da77e56b95", "comment": "Malware payload (DiamondFox)", "value": "63e53ba84df56459f43ebfe058563dd114c478b367c5c38670a9864caca5e80038069342f217f8686f9d60ede598b9d5", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630193431, "uuid": "5eb1d092-922f-4b48-9f2c-d6bb1edf415c", "value": "T1D106332536C9ACF5DD43B234FB446FB095BE82CC4A680DD7B7215B085B3E8919237E29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630193431, "uuid": "eb720918-b654-4870-b3b7-4117d7a52520", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630193431, "uuid": "790382b3-2e3a-4090-bd42-43ba5cb4c7b1", "value": "98304:x3CvLUBsgE9a4SZgRzEpVbzmX4lhfnVJQbSNKHG2a:x0LUCgya4S6zOVpVJsYKxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630193431, "uuid": "8e2d70f3-677b-444d-a0d8-2920618e337f", "value": 3749832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630193431, "uuid": "cc6f1f27-b422-4f8f-8841-df1d5358b266", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630193431, "uuid": "50294a93-a05b-4a1c-92f9-dd2a1d9fd8b4", "value": "1DF01AE4F663BBB5BDC2ABB2D68A1348.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49e7e1c-07ed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630147806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147806, "uuid": "2511ced6-bf80-4d45-806c-dfe92d0dccfa", "comment": "Malware payload (Mirai)", "value": "87a8e966ec5afb9e5356f63ed4d5d039", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147806, "uuid": "9e4a1910-5026-4a99-9e9b-e46c03bbbde8", "comment": "Malware payload (Mirai)", "value": "b34bbf9ef96c3560ccc6c96e946eaf175ad99fdcea21e7df9a24631993ea23f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147806, "uuid": "d1729734-da1e-41cf-a706-a50459e71723", "comment": "Malware payload (Mirai)", "value": "529533199776d229952353e9215527b2bb176c80", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630147806, "uuid": "f396a8db-452f-4287-9e38-8afe660db99b", "comment": "Malware payload (Mirai)", "value": "6fc817bd08c198a89ec6de8eb0cea7320a84aef133f845c06d7027d915d78cb475aba1bbe40b9faa776867eadaf785e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630147806, "uuid": "57185d30-19c8-4754-8cf8-e0e7db378d4f", "value": "T16FB2D0727015B8B7C7E5017799EDCA43FA801EF8D0E873391468199DEAD4843BAF1547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630147806, "uuid": "ef637bbb-7711-414d-a593-ebf912200d75", "value": "768:5X9nxn8o9wnBoWzEQf2EjKb3pubs3UozY:5tn+o9wjfBAZuGzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630147806, "uuid": "518c2a8c-ec49-4e66-9642-276a6c601bfa", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630147806, "uuid": "ccc50e63-d893-44fb-a973-6505a53c4369", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630147806, "uuid": "9a9a0300-7c7f-4555-ba25-b504d66b95d2", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792cd6ae-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630167892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167892, "uuid": "40d51f3c-b13b-4a57-bc33-f08dd9513a95", "comment": "Malware payload (RaccoonStealer)", "value": "2e22cb240f15b7f36a06f0247558901c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167892, "uuid": "0a41c658-0da1-4ef6-ad3c-b25b382d3235", "comment": "Malware payload (RaccoonStealer)", "value": "b404e518d5bf0a7517799d7d71e6269c2cd561a569266344b8b6b5f0f6da9db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167892, "uuid": "acb522e9-d003-47d1-8f2b-22516d55dac5", "comment": "Malware payload (RaccoonStealer)", "value": "44cf82f7ddd9bfdb647353e6ce389290207ca7de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167892, "uuid": "1abfcf4b-3945-4281-a4f6-908f9f94af6e", "comment": "Malware payload (RaccoonStealer)", "value": "a0d7a5771680b3cd09c57c9e6ea84619b130d27f01aa603ac0dc0c5e752a20b6e8e24daed15f255ab66731276225bed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167892, "uuid": "4cb999f6-646d-42a8-9ec3-08b201f211da", "value": "T102B4E030A792C035F4F716F899BA82B8B52D7EB15B6450CB92D066FA1B385F49D3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167892, "uuid": "35c6077a-f62a-44cc-b9e2-ba63b8c648d4", "value": "ebf21d5f80ce6d78a1158dea28ff74e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167892, "uuid": "f72015d9-5fbf-4263-a7a8-823a7f7abbc0", "value": "12288:fuzHblSj7HwteLHHcM3oyA0CN7Xwu6tE3YbtLx94:mzRg7QacM3J86u6S3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167892, "uuid": "018e2e7f-6d72-4eb1-8637-6a8fac8527bc", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167892, "uuid": "b954dae3-7357-4be0-a343-fd632362be56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167892, "uuid": "304436e1-5b88-41fe-b67d-c8ed21a3fd54", "value": "2e22cb240f15b7f36a06f0247558901c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a91ca9-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630167772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167772, "uuid": "e7a2c03d-134f-40a0-acc9-4bee1314ff51", "comment": "Malware payload", "value": "97104a8ef3ad734f691e0a0efc5ac55a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167772, "uuid": "61cebed4-2d57-4813-9b1d-26282c253573", "comment": "Malware payload", "value": "b482bf23edf69996d768068e89b040b9a8afa3a76fc782e2e6a6c122a774ac01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167772, "uuid": "d1e0c32a-8f3b-4be6-8047-b46da083ed6b", "comment": "Malware payload", "value": "916d26dbdcad330abb468e391698787a6042eac8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167772, "uuid": "7687ea2c-0c3d-4fd9-a33d-5ac4c25cb30a", "comment": "Malware payload", "value": "e6754f3ee6606e557f426f00c07f0d0c8aa4cf8ca490616b1359f8e7ddce09b3c8c3a51e2ffc65328b668b19feb6a16a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167772, "uuid": "613b8225-8a08-454c-b94d-1c4f447a19aa", "value": "T142A4225ABFF84971D6FA0EB18AB165122DB73E2A4C30D60F5702CECE394094255277AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167772, "uuid": "7be405a4-86bf-491b-a799-d84ad5acd96a", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167772, "uuid": "b64626c6-662f-4ccc-9f25-a8bd89c43535", "value": "12288:X0gbjjiOmvfdyZTg1Ju7lO0PgnliRpnXt0v+4OVEB5JPyl8:kijmOmv1ZSO0PgnloOKVEdKl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167772, "uuid": "c18885a7-fe41-4db0-aea3-62f4a4d0dd7b", "value": 476112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167772, "uuid": "ef0af5f3-ed0d-44b9-9cba-557c4f98f915", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167772, "uuid": "08b6c7d5-1579-478c-ae7c-12ac2de067c9", "value": "97104a8ef3ad734f691e0a0efc5ac55a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd1e02d-0830-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630176329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630176329, "uuid": "c1a5efbd-86cd-4070-8fa5-a3ed99e7aa2f", "comment": "Malware payload (njrat)", "value": "0f7ed5e72874b741504c505598d3ad82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630176329, "uuid": "6d2088ae-5640-4937-8b11-f037e43e9c09", "comment": "Malware payload (njrat)", "value": "b5436b51673693630924c77981ec45bbe70fdcecfa0b923be83ad0ae2ed53593", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630176329, "uuid": "3bc6d89f-79fd-48ce-ae2e-f0a84436a4ff", "comment": "Malware payload (njrat)", "value": "c8603a1d6a30625ed90ec19d3faf8dde7ceaa2b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630176329, "uuid": "45ba726b-eb01-4749-813c-fc1d01fb170d", "comment": "Malware payload (njrat)", "value": "dda4a07bd64063334ea790198e2b41ea1672552181618d13ed014a007f3a959e1fce3944bc82d25f5d7d1e9e69a1521e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630176329, "uuid": "a629a848-f6d5-4d95-b778-410220df0abf", "value": "T19813294D7BE18178C4FD157B05B2D412077AF57BEA23C90E8EE1649A36F36808B53AE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630176329, "uuid": "55494db3-f24c-41b4-b7f7-44e5c7fd9076", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630176329, "uuid": "59617591-a9fd-48a0-b3d1-9d234316e1ed", "value": "768:S5kQLCNhszg8QeWmsrM+rMRa8NuISt84r:SWQLCNGc8Qe7/+gRJN3H4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630176329, "uuid": "286cde74-b2ed-4f58-9de0-0c82aa9ec89c", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630176329, "uuid": "1d6a43f2-14ec-421c-af7d-2388430ed568", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630176329, "uuid": "5c12fe88-c500-4e30-bc47-b554cbf84955", "value": "0f7ed5e72874b741504c505598d3ad82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbd5277-07d3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630136570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630136570, "uuid": "c9c9c637-718f-41b8-a401-ee7fb7caa24c", "comment": "Malware payload", "value": "8bdf6751506f5187ce700672d527f4b3", "object_relation": "md5", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630136570, "uuid": "47c344cf-8883-47f3-bf73-ab0f3c1e8188", "comment": "Malware payload", "value": "b99bac7f7531b30df43dffed7ff161e1ccd031c561e18907bcd94b0611102b5c", "object_relation": "sha256", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630136570, "uuid": "3a728f50-48c2-44c0-81e6-193f280ac438", "comment": "Malware payload", "value": "3e8f658cec5e241cf274e2db84f000965f46f2ff", "object_relation": "sha1", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630136570, "uuid": "da5db0e7-e4b8-4ed3-b197-63b1ba822048", "comment": "Malware payload", "value": "bac538d19214facdb9df449b665acf962a3fe5ecc2c8604945e9bc8b4423d2a1022b7ae484558c04ecd4fd37a7665b47", "object_relation": "sha3-384", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630136570, "uuid": "a1291477-69b1-465b-89d6-59a524d5d857", "value": "T113F5CF52B3C7C0B2EFA229F2C5B553761939BD34133889CB73E8382DE9A06C16A75355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630136570, "uuid": "580526d1-7b56-4156-9ca2-9daa0afe5c76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630136570, "uuid": "d5866a07-fd30-44e9-9233-4479d56e7403", "value": "49152:RccUV4qCNhot118XSPqalFbS+OvhUMhn6RFYD2XPSIdSzdpcNenhz2JsC9ye2G:6c7qFt118XSjlon6fe0KwcnUse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630136570, "uuid": "c3ee147e-58e0-4264-b06a-57e0b4c8b3e7", "value": 3493888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630136570, "uuid": "c1ed66c3-1c87-4abf-a0de-58adaaf0e859", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630136570, "uuid": "f163ad09-5937-4a3c-8b51-dc437b981af2", "value": "Form New Digital School Axie V1.19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93752dd-07fa-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630153504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630153504, "uuid": "44b35de9-175b-47c5-b98f-e4fba233ad23", "comment": "Malware payload", "value": "2ea20906da96c5eb52a5ef79300cbb6d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630153504, "uuid": "b732b1a5-1907-4319-be98-a0fb108d673f", "comment": "Malware payload", "value": "ba649fe88d48138f695f8d24551b4e130c576d2d027197c7aac2304ca146b49f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630153504, "uuid": "5a922941-7a8a-4be7-858e-5b0c4df30c1d", "comment": "Malware payload", "value": "ce28508966413aaa33e3ff1df06524b3b4f37b7f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630153504, "uuid": "3477264b-b441-4bc7-aa5b-4b627423cdc2", "comment": "Malware payload", "value": "b54a094c203167ec4cad0b607b5674bf8aca5b6b4b6242a792011387cd07cb87fd499741eba0fc90b664dd73fa5bea4a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630153504, "uuid": "fc7383a9-5fe3-4dbc-98ad-417e2b0e125b", "value": "T198B172CC72E2F06647B771B5403FA10BF13A4969381D8410A269E4F9BCB0A6E8177E7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630153504, "uuid": "c1c4a911-1ac2-4b77-a59f-ce6de0cb0dd5", "value": "96:/BrfYW54nW0IUEbTAaYW2ikbzjzQweXTxLmSymB8wMqjX:/BrT539wvbPzZeDp/8wME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630153504, "uuid": "f7eb02a8-f838-4c08-a8d6-ad3a7304afc6", "value": 5543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630153504, "uuid": "da3494e4-f903-49c7-90c2-7bb7a159aa86", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630153504, "uuid": "e7a02a4b-1dbe-4c2b-91b1-465584f7bcea", "value": "jquery-3.3.1.min.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc70d250-07f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630149590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149590, "uuid": "3f552433-a7d0-4702-97e6-0a2829ee36e9", "comment": "Malware payload (Mirai)", "value": "2313192a03eaad749e47b554c9286be3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149590, "uuid": "4f114222-b057-44cb-b0fb-66ff11b68b8f", "comment": "Malware payload (Mirai)", "value": "bc3d060e8acd71a14c8ba24a71a20430a1ffd394df30749a5d6e5308ec33b6ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149590, "uuid": "e7472719-4fe9-401b-94f6-133a4b53d312", "comment": "Malware payload (Mirai)", "value": "2e89d274cc23aa881a92b1a307e3870446b98931", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149590, "uuid": "993c5f1e-3cab-4343-9379-6b9fe1f3b5e0", "comment": "Malware payload (Mirai)", "value": "068cbb83ac3aa1feb7ab4a6724518239ebfcc71766f09a2216e5fbed8dba360847c4338d2efcafb630bbf62abd1a2ca7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630149590, "uuid": "a48c67f0-7529-4cbc-b22d-bcd43ea3c6e5", "value": "T1AED2E1027640FEE1C5B00231E8668A5B72267D79D1D134FA8A3D0DB8A6E9A1D47F4E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630149590, "uuid": "b2c8d3ce-a7f2-4396-9d55-4259721e647e", "value": "768:vusHfRavjynNKnjFcZIhQzhKMXgi9q3UEL7X:HRwynNIOQQ1KMwXLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630149590, "uuid": "f9c48801-5897-44c2-8d09-1befcbf02004", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630149590, "uuid": "990817ff-d35a-4055-b1f4-60e168456120", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630149590, "uuid": "4e77b5e1-100b-41fb-8fc8-ac44370ff2bf", "value": "2313192a03eaad749e47b554c9286be3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac1a033-085a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630194604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "0d225270-d75c-498a-b04b-d2a2b3f80946", "comment": "Malware payload", "value": "7ff7176715088f9d83c3f501b3efdd26", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "7c1bc413-6ddb-47fd-8f4c-1ff099817c13", "comment": "Malware payload", "value": "bd152ffa2fb7bfdd446cca151d7109e2aa061ef902bacd5bd817db7ef2af0251", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "6d8ae21e-43e0-4e7c-94ae-71ad60a98179", "comment": "Malware payload", "value": "4408e2b9a00990a4ac01aed201a4c6ac5af79ca3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "ec5c20bd-7e64-4281-8215-1fedac06be6e", "comment": "Malware payload", "value": "b5e258ce81b929257c8916c72cddcf7a959cbc74ac2b199261c6064847b60208137a2a0fcce4de6c158399bb4b21ec76", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "971a5503-17f4-48d3-9a28-a6a671a6a480", "value": "T192933B41F9418B17C2C327BAFBDF439D37366A5897D7330169297EB42BC67891E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "298f58e7-6542-442f-8e73-eeaa1c7eb68c", "value": "1536:HzDBmIByJZIlhOPx5O8vQTsGYP+CvFUOStVNXLqZ1mkgmQAE+dAXDfj:H1BSZPjQkBFUO2WLmkgmQAEUAXDfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630194604, "uuid": "8a904d01-64c0-49b3-ad8c-3b5874aafd14", "value": 91819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630194604, "uuid": "d9f171fb-b572-4b86-a5f2-e0e3eca8e161", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "cad812fc-adf7-4d39-9500-c864a20bca46", "value": "atxhua", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50903cbe-083f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630182856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182856, "uuid": "63c22b29-f3bf-4ebe-80a1-1f3776026617", "comment": "Malware payload", "value": "98760316871b069b1b0ec0db65be7e55", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182856, "uuid": "1e50b51a-fb40-4297-993a-7774d3556e4e", "comment": "Malware payload", "value": "bdf74a6a3a6c7a0d7e4c62b19c52ceabb5432355a939b269a4e73d46783af681", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182856, "uuid": "617d9418-72cd-44c7-b975-5470ff5189ec", "comment": "Malware payload", "value": "0feaff406b7676631bb40807057fc3a17a0277d3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182856, "uuid": "6d4e4e18-db67-418b-9200-707ad6f96361", "comment": "Malware payload", "value": "86bd6bbd8215e22001abcdc1cd922a52060fbf38919180edcba2215af77031d6c4bfc38bdf604087d1e52e736377af78", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630182856, "uuid": "73bac096-3dae-4e4d-b9c5-8a10e1bc1a7f", "value": "T11AF53319BA536649D69342BBE143B803BE3136CC27E6A87F157E00C59C6B8D0CF15EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630182856, "uuid": "1badd59d-224c-4768-968c-19a9983fab94", "value": "49152:b22BHE8hPAc8tjI66lbAMiyql9lOHb5aG03C1mCehtTLT0g8UpimQIHNOssfymEH:i8Eu81INFiyq3lVP3C8nLT5A93nQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630182856, "uuid": "7733ce80-6926-4388-b195-a2810865d4fc", "value": 3408183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630182856, "uuid": "2f4f8c8b-736c-4d73-b46d-d8b596fd17a8", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630182856, "uuid": "dd0a189c-dadf-4140-bb1e-747610c582ee", "value": "Gizli_Cekim_ifsa_Videolari.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358caf55-084b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630187965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187965, "uuid": "8c33829d-28ed-4fd8-8234-a92c662516fa", "comment": "Malware payload (Mirai)", "value": "50e8b822ffc0bf9bf7139ff9925266e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187965, "uuid": "2436b49c-9d6d-4101-999d-168919d94a38", "comment": "Malware payload (Mirai)", "value": "be13dde7172b18c0eb984131b74d6b29022fd221fb25680b79d865fc10a3e4d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187965, "uuid": "7f71a06e-5e82-4dc2-a229-deb7e552085b", "comment": "Malware payload (Mirai)", "value": "313503a6f1b5310d64721f5838e3b80c84e25d90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187965, "uuid": "7c30568e-a36e-4303-925f-bede680112c8", "comment": "Malware payload (Mirai)", "value": "07f000abc73ea62849904365fd0778460a539338a033f7745595126e9043eccb21633edf29925868232ac836d6061e8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187965, "uuid": "a41f1fa9-8eb3-43bb-9da6-aa3bbab88623", "value": "T184332A8A64112E6DE9DA5CB981764F0ACE541210B093171FB3BBFDC33933368FE66949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187965, "uuid": "9a12e473-ed09-45c5-bd40-2e99969e5cee", "value": "768:UaRTre1lS2oueg2me2nPQCHEM/ArPwqLWHG2TqOhRol7gSu9+f1prZadIW0eNia:Ua0zoRg2mew4ChAVLzF7gSyg1pVa6da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187965, "uuid": "dec16902-e839-4784-a1e2-b9c93f742e58", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187965, "uuid": "fc81f1d1-ba66-4c7b-a180-a2631742f47e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187965, "uuid": "c6c4279d-5108-4e6d-a5f0-bbc8f5817981", "value": "50e8b822ffc0bf9bf7139ff9925266e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1cdc8dc-07ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155585, "uuid": "0595dc2b-6e22-4a0f-8d8c-5c465c58bdb9", "comment": "Malware payload (Mirai)", "value": "4dabafcea95de657adbbc6823322042f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155585, "uuid": "5eca91d0-5097-4df3-a03d-5c2ad4a67d45", "comment": "Malware payload (Mirai)", "value": "bef588118134ed3175e434da6fa389bbcf0c1465c398d93b2fd427efc5b7008b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155585, "uuid": "f6ad9bf8-56ec-46ce-86f4-cc4db668039b", "comment": "Malware payload (Mirai)", "value": "ac63521f3e53e28d7d79cdfda6dc0ecca7993531", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155585, "uuid": "551bd80a-76c4-461d-986e-bfffa92c9c96", "comment": "Malware payload (Mirai)", "value": "92f05b39c96c6eae76bf076ace45474c054e0e240bc70ac281ce58d7cbbd7e3666352fa7148883f4eea8c3eb33d37eab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155585, "uuid": "9545ca7c-8c1b-4569-8e2d-4189c528d64c", "value": "T1E7E2F126042CBE35C9E06836FAFE49E37B0589DD52C03AB2199C525E31D184D9FBB705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155585, "uuid": "91f678a4-7b6f-4b0a-95d0-fa0723dc2d57", "value": "768:5jJyUNrrV4cgaB52WntUe2oWRdMDaNGys3UozM:byUNvqTuhXRWT9MzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155585, "uuid": "1cf17d5f-d8f4-41a7-af21-ec2701024b92", "value": 32560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155585, "uuid": "4edbf74f-77a2-41a1-9803-ed2124f53ec7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155585, "uuid": "f7e89527-958b-4ff2-9923-244796188aa7", "value": "4dabafcea95de657adbbc6823322042f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b85113-07c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630131869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131869, "uuid": "8773677c-7898-40f9-b0f7-32be4279af53", "comment": "Malware payload (Smoke Loader)", "value": "1d3d7a52050d55bf8b05434615afedbe", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131869, "uuid": "d983c56f-edf3-44a4-9a65-b63a559400d2", "comment": "Malware payload (Smoke Loader)", "value": "c14d2153e7f16731ea18108f782c7af7b51e402624e0ba499c6bbe4fb8bcb40b", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131869, "uuid": "ea0f9a4f-67f1-42f1-9f70-35153d66a0e7", "comment": "Malware payload (Smoke Loader)", "value": "49a930536deb5658d0b1ab5c7b80afb180a7068e", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131869, "uuid": "0a6bffdb-edd8-4fe1-82e8-66908316f718", "comment": "Malware payload (Smoke Loader)", "value": "b6766fb7f2eccd4e5f22aa33e1a6c1127002ad3a8b19039fa081fe67ee47dcfc93f5ca30ff32c0817eafc81b14870bd4", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131869, "uuid": "0cfe1998-4cfc-4a9e-944e-d355bf94b087", "value": "T191449D30AB90C03AE5F712F499BA83B9B52D3AB15B6450CF93D116EE17346E8AC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131869, "uuid": "b6276af8-4026-4e84-9dc2-1434cc7effa0", "value": "ebf21d5f80ce6d78a1158dea28ff74e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131869, "uuid": "021c726c-87b5-4e99-a3d1-31de13e15db7", "value": "6144:B4yiCwLT7dy6W8agnl2qsgY7hxNq/VAiG0R/zqjjHssf:eCgHdlwgnWgsjN47G05AsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630131869, "uuid": "8d2f31f6-2b42-49c2-ba40-da273c343650", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630131869, "uuid": "b548d764-2b6e-4d1d-b350-5f8c20823e05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131869, "uuid": "e8a5a34c-ac26-4300-adaa-b5a5e38f92c2", "value": "1d3d7a52050d55bf8b05434615afedbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366fbbc0-0797-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630110657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630110657, "uuid": "46284b70-6826-4556-b8b3-1d3bc2dbec7f", "comment": "Malware payload (AsyncRAT)", "value": "644555d5282be9902a8eb655f1a3cde2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630110657, "uuid": "b660a0a4-6fb4-43a6-b793-d6fe8d85b0b3", "comment": "Malware payload (AsyncRAT)", "value": "c39421991cda8253fb1eeacfe5630bfa339c767d96ad40a71f5e689d0959b246", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630110657, "uuid": "3d4fd245-c90b-49d3-9a30-0f0e683e8dfe", "comment": "Malware payload (AsyncRAT)", "value": "7c412363b9c63e4634597ff2155f7cf5f589fd40", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630110657, "uuid": "cb9ca1b6-773c-4aea-a7b2-68995f7f63c4", "comment": "Malware payload (AsyncRAT)", "value": "47fa815dc9d71d12c4a737106003b2297d8deab091f3f22dc04c007920c46740ddf7a2c97fd936c134cedd921636e13f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630110657, "uuid": "730aa25b-a0ff-466f-a0c5-6435d059fe40", "value": "T104232A003BE98127F2BE4F7859F26245467EF5637603E64E1CC4119B4A23FC69642AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630110657, "uuid": "da0f025a-4816-47b4-9fff-5bbdf2aada8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630110657, "uuid": "5523fe83-a51e-4116-a64b-0ff8260b160e", "value": "768:nu1a21T3EiJfWUzuydmo2qzND3oNn90PIHzjbHgX33o0EUzdaVQ51mzBDZq4fX:nu1a21T3xN2+e95H3bAXHNJUVQ5wdHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630110657, "uuid": "198324e0-0bdb-4144-8196-b23bb36ec67b", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630110657, "uuid": "4d0b96a2-fe3a-4ebe-9db2-b35c9049d08a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630110657, "uuid": "73fe079c-858d-4589-9b3a-65a33761eb73", "value": "C39421991CDA8253FB1EEACFE5630BFA339C767D96AD4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9265d6-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630167843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167843, "uuid": "5fc4407e-387e-47b5-88b4-767bf6078975", "comment": "Malware payload (Smoke Loader)", "value": "46ca92f1d7babb120cb9f2e045b1dc12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167843, "uuid": "2805dd6e-5400-464c-9e95-a3146c8e55d0", "comment": "Malware payload (Smoke Loader)", "value": "c4aa26647fca8728998e4c14ffc867de8d671e9f4493e5eb7325f69d897dd143", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167843, "uuid": "558b35e0-1c75-4615-8077-963fd6d4cc3c", "comment": "Malware payload (Smoke Loader)", "value": "3cb5a692d338710ad950bd16e3b6de7ff79d0f61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167843, "uuid": "0bffb77e-b275-4eff-988d-f9003ab9f7e8", "comment": "Malware payload (Smoke Loader)", "value": "be734f5e1c8fc6549a3afb01e799bb2250c65ca88f4ba091ebb80d96795884e1a4f438f3a28855b9172af1c19317d2b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167843, "uuid": "537f9496-74fd-43d1-8dda-a636f81177c4", "value": "T1A2E3CF0531B4C9B3C2C31870486BD6A12A7BFC31AEBE468B7748576E3E615C1962E397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167843, "uuid": "2202f8f5-1116-450f-84ed-385c788eb80b", "value": "d3c9c233147536fd2cb825c3f3ce75bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167843, "uuid": "fcef6edd-402f-49a4-ab6a-101e636c4cf3", "value": "3072:zSZqAvj61OlWjwesJ150c+A0lofDsI5/DuT61m:zS3mOlWjJsSQ0lorsI5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167843, "uuid": "c42fd111-80ea-4a2a-9eb2-8b6063c80121", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167843, "uuid": "533c5c9f-f3b4-431f-b10f-ea844425bfe5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167843, "uuid": "4896cfda-4e78-4a2c-a3af-86570b573474", "value": "46ca92f1d7babb120cb9f2e045b1dc12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00600fbb-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630167690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167690, "uuid": "77894860-3c3a-4e8c-b5b5-f0025f0c04b6", "comment": "Malware payload (ArkeiStealer)", "value": "b29c4e8ad98d7eadce7bc60a429238f3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167690, "uuid": "4729f417-b34d-4def-b020-22e2b765d169", "comment": "Malware payload (ArkeiStealer)", "value": "c4d7602ccab54e9e281a304d7632dad3673df7afe33e5ca4bedcd64bc997f11b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167690, "uuid": "4fff7916-2652-4962-80b2-2ef609711638", "comment": "Malware payload (ArkeiStealer)", "value": "454cb598b5554c7002ac6162c020703d4cfe2669", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167690, "uuid": "520bc359-9b23-42c2-86f6-fe4d5ea0ac42", "comment": "Malware payload (ArkeiStealer)", "value": "70501ca12e117d98e00239922bd89ca43469f20423892e634ce741ae3898efdeef63c2ca332b30e2fc4302400ec736cf", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167690, "uuid": "b090c699-2eaa-4794-be9e-7eb75549a5f5", "value": "T1DDD3BF1172B0C432E5C615768869EA61E66BBD315F71C98B3B48476F3F332C0872E267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167690, "uuid": "a6c0a170-e11d-4dab-97dc-b3e5bc5e369a", "value": "4f5dc64597ca4f695b16cf6dee89f692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167690, "uuid": "9c616e7d-e48b-4c01-8789-b3fc62987f75", "value": "3072:5C3Kh/Bj9oyqHfPK9lK5zlAtgNsI5/DuT61m:MaNx9o3Hf2wat2sI5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167690, "uuid": "eccbe78e-39dd-494e-bfd7-e1fb4c41c688", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167690, "uuid": "e236ad34-ce71-44a6-a13e-c5ef870e82fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167690, "uuid": "7867e000-8e29-48e3-a9e3-640467be31d2", "value": "b29c4e8ad98d7eadce7bc60a429238f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527a61c5-082f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630175988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175988, "uuid": "bd744937-5b1c-42ea-9886-77bfd4022ddc", "comment": "Malware payload (CobaltStrike)", "value": "d68cbc7b4add96a8e32d704c60ab787f", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175988, "uuid": "359e7ec6-5b8b-4201-a937-e9a18c882559", "comment": "Malware payload (CobaltStrike)", "value": "c57345f4b66a1f93a9b474126a259b778a70d4b297dacd33d7466954e18e4673", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175988, "uuid": "b573fcd9-5cb2-4c5b-b001-f6479cfbf0ee", "comment": "Malware payload (CobaltStrike)", "value": "2bbabefb7a0f4989f3e8d67be887d77dac2277f9", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175988, "uuid": "243c038b-3b3a-4516-af9d-694df5db7fab", "comment": "Malware payload (CobaltStrike)", "value": "25b15ba112ab886a938e333ae0fe61aeb8d846bdafebe90a5d4039ce1db9b05ba06f31c1d81605840ec2d637e1a75eb9", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175988, "uuid": "cd919702-a3b4-4289-84b4-cfcd1b5f3c4e", "value": "T11624CEB15F47E7AEE572CA338950E82B7DFAB40FCA18257B3A83DC6650233D95231491", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175988, "uuid": "3767235f-4dd8-4418-bfae-5af18689d1f5", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175988, "uuid": "546eae7b-15e6-441d-91fa-ce87edce829c", "value": "3072:q09NYvjPTdaIP0tR83dqNWgql7Bf8dc/oGHIdhWniWNbid04:q0gLdmtO3QWjq0ShWHbim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630175988, "uuid": "71a5b8ef-73a1-4fdc-843e-463da55af7b0", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630175988, "uuid": "07673b7a-81b2-4837-a600-9f4eaff66365", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175988, "uuid": "8658cb5a-3d80-4aff-ae9d-f887ec05cc36", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9e5397-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630167767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167767, "uuid": "98e60bdb-3be2-446b-b4b8-3df64c467400", "comment": "Malware payload", "value": "0189460a748e9f39822433bf41360e3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167767, "uuid": "8380c7a0-0d77-40f6-9b63-ffaaa98ddbea", "comment": "Malware payload", "value": "c599fe2a2f6b6e01b34b75188fdab23735abe17bb71965b92275834ba96f060a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167767, "uuid": "a0a673fb-4388-4233-9430-c08b7a756c5a", "comment": "Malware payload", "value": "b0bd4099634cfc9b2108df9cf8e3dd52c7dc1cdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167767, "uuid": "e1de21af-8cce-4df5-b837-9ea362799bc1", "comment": "Malware payload", "value": "0aa94d640ea4500007d952136feac59166c6698a610c2584543745a49aa757a5af40aed08504047aa5919c81acefb76b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167767, "uuid": "a0b56f8e-ce36-4c1c-929d-fd20a9dabc65", "value": "T162463302A5C04732C6B23BBC9DDBA220957DBFA16D3858193BD84A4C9E733927D39753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167767, "uuid": "ded11719-0f83-48f5-8a68-177f654b7dcb", "value": "b462095fea3219e285e54ac0547eead6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167767, "uuid": "783576a2-46c3-4f8e-9f82-ee74e0d44430", "value": "98304:XuGN9kHJlu73zwu9gCpbeFUkFDnLNgxZMYqjeVALNy8VaWIlg3lKCqtL:XzTkHJw3ZpbeOsgPig4Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167767, "uuid": "8b566037-623e-433e-9fdc-97b3ce0236aa", "value": 5698944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167767, "uuid": "9c8788a9-3609-4748-8d5a-347988c58d4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167767, "uuid": "b93d700e-c877-4975-8d03-b5bf9faf63c0", "value": "0189460a748e9f39822433bf41360e3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771d8cef-07fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155004, "uuid": "bc7d928e-cf2a-4217-a1fd-2579a2a6f85d", "comment": "Malware payload (Mirai)", "value": "1a8186e2e5794a39f0936d8a6fbb898d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155004, "uuid": "5cc70ca5-a3fb-4bf6-95ce-2c4b2e98912c", "comment": "Malware payload (Mirai)", "value": "c5dc00bb3f904e1bd4f1b7848cf38876ac171a36bacf7e9e44143d7e84e7a456", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155004, "uuid": "fedc0d4b-1ce1-48a0-a966-70394397c7b5", "comment": "Malware payload (Mirai)", "value": "bf6801875452eba57eaf744716679599bc502661", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155004, "uuid": "0f397a3c-034a-4497-a7c1-dab7a9832ffd", "comment": "Malware payload (Mirai)", "value": "5745bf99e57629dfb4b224a5198c4d559e5ef79e05bcf92e3bc0584271af21af793bf4f35255970f8c5b3272b8553698", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155004, "uuid": "6cdf87b4-8b43-4f4e-a0df-9b9a2ea81e26", "value": "T1EA33F233AA080D078821BC72EAB956B3A5FBC37EE01D59F5E6074CBDA540902D9E1983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155004, "uuid": "fee5f90b-257a-4ea9-b763-d046657e018f", "value": "1536:CBd49Pl29hwd14wElc8y/T7zS7L4LAN/fBZ/q2lA:jPlRdFd8yr7e7L4+JJq2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155004, "uuid": "e820e88b-9838-434f-a0f8-085621658c65", "value": 51692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155004, "uuid": "eb0b6555-e59b-4870-9798-1ec1445c9df9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155004, "uuid": "114a0fa2-66d3-483d-89c0-696cec28f9fd", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c718bbfd-0832-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630177472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630177472, "uuid": "5c884833-8a41-4df1-b9d1-91ff920e681a", "comment": "Malware payload", "value": "635a7d30df87a8bbbbeedfe0d5da7891", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630177472, "uuid": "eab12d5b-f440-4443-8c9c-df5649206d08", "comment": "Malware payload", "value": "c6f35accd37dc1440ff1fe474d6e4dc94be2e58cebc66dca6c6d860a8c2bc4ad", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630177472, "uuid": "4b613647-bce5-41b6-9a03-fdda5b3b2936", "comment": "Malware payload", "value": "d8f08f117f7c79732f12c6b11538eefab8bc93e8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630177472, "uuid": "ec80a86f-b9ee-487b-b6f7-05d5435e37c5", "comment": "Malware payload", "value": "6fa68b8220f22964c61ded4bf9db4dfa1fd3516321b1303809e985215159ce1fbb140fae980dff151569382fb50b06a2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630177472, "uuid": "f265e549-8477-48a0-879a-a4dc859f890b", "value": "T1B4F53349FB82C88CEB6705B290DB066377253068C9E5A67E423A84878CD7D54DB22DFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630177472, "uuid": "794b78e9-57ef-4077-9b89-9a535929e709", "value": "49152:4Ww5YLWU0U6oWqDXxeOTECxEWEQv9lOHBLRPE9iV9iLEecArrP7X+8k54K6SZmA0:jLWlU/TYul489iV9iLB3DX+DqfS45Whm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630177472, "uuid": "84027493-08aa-42e2-a2a2-9d989155e2ca", "value": 3401535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630177472, "uuid": "f891174e-224d-45f6-8298-c1c5c60fbcb7", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630177472, "uuid": "f900bcd9-f1ec-4a44-b219-3c2c27124d87", "value": "Android_Guncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cf5575-07e5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630144212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630144212, "uuid": "12e83650-1d04-4291-9f78-f57f567ad8bc", "comment": "Malware payload (DanaBot)", "value": "199172dc2093263eed50e3f744859def", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630144212, "uuid": "d1ed854c-5244-45d2-8aa0-86a8a09cb392", "comment": "Malware payload (DanaBot)", "value": "c8ceceea071185485187862365097bbb02345c6519788db06c76d2286bec4efc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630144212, "uuid": "ab1b0222-0aea-48b1-8b71-553f4f97a18d", "comment": "Malware payload (DanaBot)", "value": "c38f07b26060cde49068ee6ca98a58e3cae1b375", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630144212, "uuid": "509e190c-8c09-4b26-884e-ad0c338e7c24", "comment": "Malware payload (DanaBot)", "value": "a7aeeecd8290ff67b78055b0652634547bb1fd432761accbdb4db086059fbf13e3007852a116c86b16fa3aec712da2cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630144212, "uuid": "871aa74a-1eb4-41de-9ad7-0ea1c0417be4", "value": "T14645334B7BFA4C26E3E50AB149F5725291FA2F370D30860BA7425F873600E55621ABDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630144212, "uuid": "a921f185-ea95-417b-9f62-8df198c2d7ad", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630144212, "uuid": "6caa787d-cf3d-49ca-a306-8a61f1346a4c", "value": "24576:kijmOmv1ZSO0PgnloOKVEdKlfMeezNEfRmoIXLRn10GEDbsla5I:3qbv1ZRnlA2dKi9h5bwG7MI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630144212, "uuid": "64a08741-ccca-4646-a334-3ec0497859ce", "value": 1238716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630144212, "uuid": "151b2096-efe5-43bd-b5d4-881e073125d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630144212, "uuid": "3f105395-1a85-4ce0-b774-ed8845c4b903", "value": "199172dc2093263eed50e3f744859def", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b1ffee-07dc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630140345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630140345, "uuid": "8015d744-d589-433a-be25-7cf02f4e48b0", "comment": "Malware payload (njrat)", "value": "a45d3ba62532e3dd06f507948880cb7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630140345, "uuid": "3b2dbd76-c2eb-4127-85f5-74d580d74e36", "comment": "Malware payload (njrat)", "value": "c92d88f1d85c4f80e3ce3ace06d84cbecf569d5c5d786e66d76bfbe39547ecd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630140345, "uuid": "dd049076-a8ec-432e-b97f-7ede5aa23fc5", "comment": "Malware payload (njrat)", "value": "0ddea29b835e1cdf090d780936b1198273c7186c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630140345, "uuid": "d96c516a-2021-435d-94d9-94da9591122b", "comment": "Malware payload (njrat)", "value": "5c6bcfc77574e951bc737ac560666d331585454429343dd93f4401e39c92b2efe2d66b447ef1e3d23f55b3ca2efe2780", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630140345, "uuid": "d3019819-5afc-46e8-a8ee-9edfdc21eeb2", "value": "T181B2094E3FA98856C5AC1B74C6B5965003B491870413EE2FCCC954CBAFB3BD92D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630140345, "uuid": "56a6ef39-8bb2-4f18-9690-cf1aed57ccd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630140345, "uuid": "77f0e026-1fad-4684-9b41-67cf69927471", "value": "384:4QeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZ5zh:P5yBVd7Rpcnuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630140345, "uuid": "7fc07685-ce4a-4757-af07-8f97b8cca381", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630140345, "uuid": "1cadc7d2-d69b-414c-a247-c209b816d28e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630140345, "uuid": "34a1d370-2b4a-409b-8788-a56dba38c09c", "value": "A45D3BA62532E3DD06F507948880CB7F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ece719-07f0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630148930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148930, "uuid": "ba31e7ab-3aea-48b9-bb31-85a3b862a907", "comment": "Malware payload (Formbook)", "value": "50af996871d9634ea3bc13606032ddb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148930, "uuid": "a4468ae7-c129-4277-b42f-945422fe2c56", "comment": "Malware payload (Formbook)", "value": "cb63132b863557beac43df88e49f48fad74a31758a8a95f34ea14c6e00c9b843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148930, "uuid": "e8eb93b7-325f-47fb-ab32-b1537fd56539", "comment": "Malware payload (Formbook)", "value": "efcfa722651c7b2732687c60fb54f0cb981e96d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630148930, "uuid": "e46304af-261f-4ce4-a7a9-fa39b3ed41e7", "comment": "Malware payload (Formbook)", "value": "6443b32f4f491d95ad6feefc491e41ceabfffeb7acbd0203a86daa708933b2c774ca974939181dbe0f043b9876057fbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630148930, "uuid": "7b5ca372-a056-47a0-b56f-65a9fe515b50", "value": "T161F41D7F19BDA2279175C6F58BE38827F0108B6F3110696476D347264322A7AB4F336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630148930, "uuid": "5c17e049-1c83-4d03-bf47-e4891e6b54e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630148930, "uuid": "e1f30022-7125-449b-b1b6-090aa5b8b8e5", "value": "12288:jNQsxD8xcF6H/MzG/+GMOGMlcmpPaYqnioTYMSi:xQsx2H/Mq/R5qp8MSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630148930, "uuid": "b2315141-a8f9-4645-ba7d-5f6d0c9ced04", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630148930, "uuid": "0cc9fa5c-6d7e-479b-adb2-46cd0fd349f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630148930, "uuid": "4871ab05-f293-4e3a-b5f7-e7b1963669f0", "value": "SecuriteInfo.com.Artemis50AF996871D9.8784.27574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d78a0b6-07ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630132573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132573, "uuid": "3a17218f-ba36-4fcc-b609-ca35d88e3bc4", "comment": "Malware payload (RedLineStealer)", "value": "f890dc9a8c2e6e35f191229672d0441a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132573, "uuid": "2b5163d7-a5fb-436e-af75-6b84eb89c8cd", "comment": "Malware payload (RedLineStealer)", "value": "ccb935306677626a8bf11ba92dc2c7ef6cc02ed26aae371011832d00675b9a5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132573, "uuid": "ad9fcd54-1528-4578-8a76-d4a42c65c605", "comment": "Malware payload (RedLineStealer)", "value": "a2cd83390cbf8daf9afda780b055565e36911816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132573, "uuid": "98a7547a-5f46-46d2-81e3-7deaec8e1789", "comment": "Malware payload (RedLineStealer)", "value": "a790a2260cc89a8f2720e3f27e745b78a77f694c2b182f35a29b4ba7fe91900170579acd2a5723418b9776b989abb420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132573, "uuid": "f8ca7dbc-ccc4-4342-b55e-6aa89d577af4", "value": "T17FF533094A6988E0CD463CF67F05D8BF97615CC1CA0ECA966ACA3D433B751E06EFC526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132573, "uuid": "2efc71bb-9d67-4100-bc46-10133a1b8595", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132573, "uuid": "b13401ed-f661-4ad2-bf51-7e6277bd4bf3", "value": "49152:m451//NTq7XybfrdbLVN4lUe9M6upf/XlRdKeh1k583pixS7a+SWqR54APzCCCCy:m6TUX2f50lUMupX/dK248Yx5+d4fzC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132573, "uuid": "e5b50dd8-7c92-42a2-b0f3-e82fd9ad1a50", "value": 3373480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132573, "uuid": "a9a47700-8ae9-4f42-9bb7-8f1b42f0c896", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132573, "uuid": "4fb0cd80-e4f6-408e-b25c-5fe067fc5a02", "value": "f890dc9a8c2e6e35f191229672d0441a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d43474a-084b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630188005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188005, "uuid": "2f739a81-26c4-4838-af67-16bf047ac4ea", "comment": "Malware payload (Mirai)", "value": "b6382cf8e28974dc0e6bc437c7ee27b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188005, "uuid": "79a74aef-522a-4a51-b13d-f795995cefb8", "comment": "Malware payload (Mirai)", "value": "cd3a68acee4c853b0f50fdfad2f56dea43191cf526eedb0395d371183710e430", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188005, "uuid": "642dabdc-6220-4d40-94db-1fca990f3e61", "comment": "Malware payload (Mirai)", "value": "12d0bd7ae1da5065488403b3321d0ae581e91746", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630188005, "uuid": "32f5d931-878b-46bd-aaa8-5d2aa7b51e2a", "comment": "Malware payload (Mirai)", "value": "2d589a7d26b0a65dffd5982d54eea81484c8741c45ed8dc5018faf03790ccc0f30cde1bc5aceec05ab47715c699ce33e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188005, "uuid": "79963da8-bf37-4209-a998-b02c70ed3deb", "value": "T1E9D2E1A9530417B9CABE90FC176707A43CB98F655093DE6E61C1FAC2ED404F479939C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188005, "uuid": "807bfe07-2525-4590-851a-7e5d689600d7", "value": "768:/yvYLznDEB2iC+sDqC6NtxsfzxPnNsGbzXAJgGlzDpbuR1JC:GYnnDEBI+smATfcVJuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630188005, "uuid": "307ae914-715a-48e3-ae4a-9d00c3f0a3f4", "value": 30848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630188005, "uuid": "aefea67a-ded5-4b66-80bc-ae79dacfe465", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630188005, "uuid": "390ffd68-b4d7-4522-9cbb-b5e1fa49e759", "value": "b6382cf8e28974dc0e6bc437c7ee27b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4132466b-0832-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630177247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630177247, "uuid": "8e3c4fd3-a942-4e63-8c83-e171c0aa1d52", "comment": "Malware payload (RaccoonStealer)", "value": "1f586f25d543f20483edf6fde4ccd146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630177247, "uuid": "91370749-cb90-41b6-9f10-1ae5f10945dc", "comment": "Malware payload (RaccoonStealer)", "value": "cd48beae4e4c106cbd321fde2b5ad55cceed277158d4beb001ae1debb1c10a12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630177247, "uuid": "f8b8d9ba-808b-4e18-acbb-c8e34046c9f5", "comment": "Malware payload (RaccoonStealer)", "value": "6519b10ee02d4d4476a4ba6e88736ad192ced24c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630177247, "uuid": "fb7547af-9683-4b47-b4e7-2740347d2fd4", "comment": "Malware payload (RaccoonStealer)", "value": "d00c676324329751e201f8490c2770243fc482cdce7cffa21cbb72402730ca9f9febfe194d5500cf7df29356d09ec479", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630177247, "uuid": "3eb47d2d-4187-407c-a3c1-ded422a53bda", "value": "T190A4021476B0C07AF8E148748C94D75175ABBEE72A55C2873E48CE6F3D722C08A2E6D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630177247, "uuid": "a0f9cc20-3188-4030-8947-1b245ce055a8", "value": "065a584d0d50807005a7c41fcb9adea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630177247, "uuid": "9eac0fbb-8fb4-4e05-a121-f0bc9f92ee46", "value": "12288:r20D7oeZrR6NmVn68rDco9ZZU4/tIc/ec:y0DcepRKmVnprgiFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630177247, "uuid": "6203af7b-ad40-443e-9969-a7a94d5b058b", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630177247, "uuid": "03019db8-3438-4a89-aab1-a64a897e5539", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630177247, "uuid": "6996e4d6-e2e8-4d21-a570-3ea0196d15a8", "value": "1f586f25d543f20483edf6fde4ccd146.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6908cf8c-07bb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630126204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630126204, "uuid": "0674eaa5-c117-4837-b2be-74c0f9c916da", "comment": "Malware payload (Mirai)", "value": "9c370216fbb027bb9429e8018e464320", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630126204, "uuid": "3161d96f-59aa-467e-b333-700fa340ca06", "comment": "Malware payload (Mirai)", "value": "ce65f5968259a0142e8e6ccbee88852be1e8c26c45570abdcbac0533f2e1bf98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630126204, "uuid": "b1ec2eaa-e2cb-4548-a892-96086573cdee", "comment": "Malware payload (Mirai)", "value": "f1f532e0c8273ec69dd683ed8c5e4f0778809732", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630126204, "uuid": "39acc1a6-d44f-462a-a932-8c2b4052d4fa", "comment": "Malware payload (Mirai)", "value": "f629924140adbee0f62a971e47b954cd22795901a60b8cf05f7c2a300f118fd79728df8014bbf9ef1fb5590ad73a78b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630126204, "uuid": "8496f449-fc5b-4c20-a590-69a6a65265b0", "value": "T196F36D46FA404B13C4D62776BAAF42463332A794D3DB730399285FB43F86A6F4E27905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630126204, "uuid": "6c2e4936-0d61-43d0-8829-cdc11a904279", "value": "3072:z3vVfAM674PABzcYG/vT6laZRTQrqOAzppVGrQrD1miM/9QFkm8wxQ35x:zvhAz84Bw9XZRTQrqTz5sQrD1LM/9PmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630126204, "uuid": "8b627c09-62b8-4c0c-ad2d-279099a6601c", "value": 163538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630126204, "uuid": "6603d99a-362b-4f10-b146-c6ed5b03c3f5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630126204, "uuid": "6a234bcc-8d90-4c66-8e90-7218a46f35e3", "value": "BinName.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705d3924-0821-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SystemBC)", "timestamp": 1630170025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630170025, "uuid": "556c0a41-9822-4a45-b56c-bd3ab980007f", "comment": "Malware payload (SystemBC)", "value": "e9dc207df074b319b6144fa436f80bed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630170025, "uuid": "e15112db-42c6-4bb3-a30c-82a02ade8c38", "comment": "Malware payload (SystemBC)", "value": "cea699be9ae7dfa92d1725a9ece33071f1e707e9cde5ec5137d4a28f1f74a10d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630170025, "uuid": "198e06ed-fc06-44ef-86f8-8fd01c50c70c", "comment": "Malware payload (SystemBC)", "value": "14fb934fa837c3cecede8c96f59d5436624d7338", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630170025, "uuid": "4d50867b-50cc-4862-8091-e9310ab73111", "comment": "Malware payload (SystemBC)", "value": "aec32c23ad7638972151e28971a1805daddd6c71ab000d8d5bf18d2015cf0d56fdd602ad47677eb306429af9b0935b19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630170025, "uuid": "d6214f89-58bf-4537-897d-591aa59a0910", "value": "T19F52F9D735218D65C016C6B03EAFA760D4BE6575153A9038EFF00E28773EA539B2271E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630170025, "uuid": "fa5dbe88-8846-41dc-9d5f-1cbf09fe89f1", "value": "801793b2be29822524e8824fc3c47535", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630170025, "uuid": "7ca6bb66-77c9-40bc-8944-e7200ee17ff9", "value": "192:G2WjQTbZ1eBppvfj/j2+cPM3P+Q/tCvwSw3uM76V9bhHOkrUNm:G2jTbZ0pj/vcqP+ctCYSw3GV9bhrUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630170025, "uuid": "95f251c4-cb43-491e-81fd-6f95e3afe5eb", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630170025, "uuid": "d8ace9e6-2797-4e9a-b60c-203cd3888bd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630170025, "uuid": "4e18fbb3-ea5d-4b4c-bc7e-acadf7313f15", "value": "e9dc207df074b319b6144fa436f80bed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea544993-07d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630139306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630139306, "uuid": "163456f9-3093-465e-8d5b-6ad102160c7d", "comment": "Malware payload (NanoCore)", "value": "63c23960cd0f322553b7f5bcd18592bd", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630139306, "uuid": "e295c6d4-4f76-44c2-8c01-600f28869a84", "comment": "Malware payload (NanoCore)", "value": "cf504dcf1ffe04e2df095768bdeab82f2a7e0bd77a09aded03c58ed648dd017f", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630139306, "uuid": "0449a0d0-3e26-412a-9497-f63ec97879e2", "comment": "Malware payload (NanoCore)", "value": "7124c8130367a411240395ec35ac7b6467e1cb8a", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630139306, "uuid": "3cfc2764-05d2-485d-8627-32093c280c38", "comment": "Malware payload (NanoCore)", "value": "d5cdb442e4cafa8ac5fa4d58f4f32fd543fe08126088d3ef5c13ba2d9f1bbd1bef569e6150d86b13f905c70de0775f79", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630139306, "uuid": "213b20bf-5117-4f9d-a9d5-05c2a3a95ced", "value": "T1A325338BC52D36D0D893FD0F4E0B31D5571A6A05C05AC9BBF4A801B5A7EAD38BC65CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630139306, "uuid": "a5bc43d1-be0d-4e84-99fd-e2d416ffcc52", "value": "24576:Xf/oaf9S4DTvwOb001V9NZUhnRYAo6rzckIPflnT/zPvSP:vAi9S4wsTs9RYAo6rzcBP9nfyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630139306, "uuid": "47e2ca45-30db-4926-a8b6-0e1c9acc020e", "value": 993698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630139306, "uuid": "37b89d78-cdb6-40a2-ae41-a7cb1fecba2c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630139306, "uuid": "99d57742-7061-4d49-a172-2a7143b5dfd7", "value": "63c23960cd0f322553b7f5bcd18592bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4b4c62-07ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155575, "uuid": "0c55e8f7-989e-413b-a525-ec6f64159b02", "comment": "Malware payload (Mirai)", "value": "f8176e0c3d5176e4b7808c92d5e9a1eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155575, "uuid": "727d6096-9687-4e28-a5e3-39d12f05b1ed", "comment": "Malware payload (Mirai)", "value": "cff12588a8036c6c43d50fd8355acdb4d1cb6d3ce7d7f8c3f52dc455f64f08ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155575, "uuid": "3b0b34ce-70cf-4ba2-ac9a-f6ab067bd7e9", "comment": "Malware payload (Mirai)", "value": "6dc0823d8b633749d817356896bc58b5fc51e733", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155575, "uuid": "0956ab08-8f21-49c0-8b74-c54e539a73f4", "comment": "Malware payload (Mirai)", "value": "ed4b2fc3a1be0308d52cc2db237960aede5c4adf5598a39fb564912379475ee246a75c00ef9052a22c654a95c78ab0f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155575, "uuid": "00754d5b-b0a0-4c9c-9223-8d1a3c672180", "value": "T174736CBCE179AEC4D2514578B85499389B23F00A92E22EF7D9C4419FA897DE4F5087B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155575, "uuid": "83077821-d0c3-4b4e-b4a1-9fc5f7743e28", "value": "1536:naAYdWE1H05hcIwtw8tFz3e1KFfs3cNbXoSteIC20:nxYYkH05r2z3e1Ef+SsSteI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155575, "uuid": "b1269be1-7a4c-434b-8fbd-8b2213cb2542", "value": 78976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155575, "uuid": "44fc4a1f-3eb9-42c8-a843-026ad7da3efb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155575, "uuid": "3e061008-85bf-41e3-b85b-a23e5a5637e5", "value": "f8176e0c3d5176e4b7808c92d5e9a1eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdd5061-084b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630187976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187976, "uuid": "fc64448b-54d8-4554-8e4d-dc3402df0da3", "comment": "Malware payload (Mirai)", "value": "9bf9794a1fadb1f3dbad1f4a556d02ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187976, "uuid": "e2a64c2b-2b99-4794-b645-423537e2d11c", "comment": "Malware payload (Mirai)", "value": "d14e02e1cf550fd0ba3bb00d1d5ffdb741c483327bdb1aec738e42ab8e71c75a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187976, "uuid": "ec0c7057-5f50-4bbc-beb0-252016fe0a45", "comment": "Malware payload (Mirai)", "value": "a6b4b936cce83ff6838b3ec9bfa2e1a400423e0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187976, "uuid": "4a49f3d6-6451-4c8b-a2a1-2acd7f36401e", "comment": "Malware payload (Mirai)", "value": "7c5c8aa9496302fb52d6dd9a2b33af4f4a39e13e522399752cc2776ead90fc30176c8816addc0b3a9257c24ad353c31d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187976, "uuid": "34c185b4-da3e-4192-bf31-06f031f8b266", "value": "T1BC735B24A93A2F26C1D4A17E62FBC321F1F6230E25B4961C3CB60F8EFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187976, "uuid": "04d1b2eb-dec5-44b8-95f3-825cdd749e42", "value": "1536:ubHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNicKzfrFx8:kmcjaq+Dcc5J+vN4Fzfr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187976, "uuid": "d6dde6e9-af67-45ca-84e1-b9b14c91cd6e", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187976, "uuid": "fae0b92c-21c8-4ba8-8003-e9a44d17dc42", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187976, "uuid": "6c7c74c1-3816-4a0c-b499-4ed06ed7741d", "value": "9bf9794a1fadb1f3dbad1f4a556d02ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3aafd27-0799-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630111807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111807, "uuid": "223916eb-1080-46ac-9e7a-101c8fb0b765", "comment": "Malware payload (Mirai)", "value": "73c501cec4c7f30285a7d2d3e5bd459e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111807, "uuid": "bcc38355-f1b3-445a-8dfe-ea4848a5fb91", "comment": "Malware payload (Mirai)", "value": "d17d0d692d1099df32461b013e161f20fbafcce38ec1d5f64813e2431840ce92", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111807, "uuid": "389fc5f0-0016-4777-814e-96545db7bf7d", "comment": "Malware payload (Mirai)", "value": "8a9633915a5bbe0e2bb83445a33207657895902b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111807, "uuid": "2f2d49f8-ff0c-4836-80c0-95e088c48a56", "comment": "Malware payload (Mirai)", "value": "a4391c9fd4bbd385716136d20b17fec876f02240ebbe1001d02652605b23550f410f7dd59a06b191e525f1bf35b1e0b5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630111807, "uuid": "b6af95b3-fdcb-4bd4-8276-172c4a0aaba1", "value": "T11B6319827C80AA26C7D0177BFA5F108E3315A7D8E1DA73478C142F9576CA81F0D6B78A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630111807, "uuid": "7165d297-528e-4cb6-8c51-816eaba0fb6c", "value": "1536:at/LYbUxYVUUO03k704oVLMNKHwbKnJeZWovjHJkKiM:at/LY0bKJwpvj3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630111807, "uuid": "95ee71b7-6e8e-4be3-87e2-e56da6566e2f", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630111807, "uuid": "25c4b5bc-0f2c-4c70-aafd-b5d918dc04cf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630111807, "uuid": "2e0f769e-65d0-4620-a239-c297a66f2033", "value": "pandora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd8a9ba-083b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630181052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630181052, "uuid": "7d9f2f1d-f0b8-485c-adac-711acdb413ad", "comment": "Malware payload (RedLineStealer)", "value": "c844c77a4052cd87225ef065c71abb1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630181052, "uuid": "65589e0e-cedc-47b2-b471-a99765719439", "comment": "Malware payload (RedLineStealer)", "value": "d319ddd3d52abce88199f3b7d1385bb3258290139b8b05a1ef2b672af8da2fba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630181052, "uuid": "83811796-1825-4748-82a1-ce40bdcab9e5", "comment": "Malware payload (RedLineStealer)", "value": "a2fa85d3b42005660c622aa1e59708d38a8b57b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630181052, "uuid": "dfa93564-c9be-4308-8ab8-317a79a94791", "comment": "Malware payload (RedLineStealer)", "value": "798b4ec3b16409a0d1a08e43361c1b35c063460abbbcefb4eda02d0c35916e3b7060bf4b41f0c85f94887cdcddb04e0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630181052, "uuid": "79042f58-6b2b-418f-81b8-1e906f2d023a", "value": "T11244E11575B1C87AF8C6457088B9C7A126FBB9E32A61826737450B6E3E303D0472DBDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630181052, "uuid": "ec4b3a33-bfa1-4c9c-94df-8d237e5dbae3", "value": "065a584d0d50807005a7c41fcb9adea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630181052, "uuid": "a7128279-80a7-47a3-bfea-454c44ba8c08", "value": "6144:rCuzu9S4sWp7RsmuBAtelVBSrqEYg5VHwhZU9sI5/:rCuy5sS1uBAteleqEYyVec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630181052, "uuid": "5f74dd72-127e-4a53-aa98-dec845dbe8eb", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630181052, "uuid": "3fbf35d2-0862-482a-b40d-b9555752b33d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630181052, "uuid": "063ebe74-1965-45d7-91ff-18ae042f9a68", "value": "c844c77a4052cd87225ef065c71abb1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c89efc7-07c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630131686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131686, "uuid": "e91e5d61-8f97-43a0-804a-6710c83bba41", "comment": "Malware payload (njrat)", "value": "498b038f610b49e31b24ac641a1010d4", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131686, "uuid": "43963078-47c4-4178-9e39-ddd3ffb4a201", "comment": "Malware payload (njrat)", "value": "d424a08c1e1eac484c029a6ef4008bf991aebf26a86aa02fecd18ad60bb24a0f", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131686, "uuid": "422303a2-784e-41f8-91b7-85182a542999", "comment": "Malware payload (njrat)", "value": "d44a1e96a3ab5747705dbb242ab07e452e1ae9bb", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131686, "uuid": "ed0045c4-a1c2-40db-993a-68b4e9199464", "comment": "Malware payload (njrat)", "value": "599d52761dce61b4edc107eb8e634354c105fa2e84376af0abe43b3ba93ec0259233c844acdf9c8353e5434235434e7a", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131686, "uuid": "2a3f00c8-376c-4139-92d9-b55c6d24b2e6", "value": "T17B01F60A4D29CDDB0049F18202C34DEAC6604AA74F806E7A247479476DAD22E6DCCD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131686, "uuid": "69c901f8-35aa-4932-b2ce-83397de162be", "value": "12:0ChGF2MBN2hXNoxAbOJk82cG2bwELPdg3Nfd+aaiTC:HgF2SN2hXQXG2UE7kNEuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630131686, "uuid": "fed76cd6-1c05-4b73-ab6b-10b21032ed3f", "value": 733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630131686, "uuid": "939596fe-97ce-440e-aed7-cbbb9be556b5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131686, "uuid": "0c764d9f-943f-470a-a656-2810da3bce34", "value": "Invoice #33190.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73549e84-07c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630129228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129228, "uuid": "e130d348-b8cc-4bfd-80e4-d8fe0206abee", "comment": "Malware payload (Mirai)", "value": "9855be90204ad938d350f75e181504bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129228, "uuid": "415afce2-9925-440f-b641-f61d5fe434f3", "comment": "Malware payload (Mirai)", "value": "d4de238c2e8464b6cf73666190306460f61e18cb19baac9aa4add19eb547afbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129228, "uuid": "fe786691-fa12-4827-a7d0-16b4af8692c3", "comment": "Malware payload (Mirai)", "value": "92c301d07d3bdda42e6f567e88e3a322e81af9cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129228, "uuid": "5e0474ee-0649-4d3d-ac8a-9172ba37d91b", "comment": "Malware payload (Mirai)", "value": "81f54cd0500aed3e64ed67783f902dd80f1197144a422ef067db3879619d1a09b847db52aef5b68db2b179748128090e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129228, "uuid": "19a194ef-8831-4e88-b4cb-390bc1803ed9", "value": "T1C3A3C60E7E259F7CF7AD823557BB8E25965833D626E0D640D2ACDA001EB024D241FFAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129228, "uuid": "7b1db28a-5dec-4537-863f-2260beb88eed", "value": "3072:aOhr/kU3MSEN77RV92XkddgjztJKmbUdRm7:aOhrJxytVuIwz7KyIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630129228, "uuid": "e85b48b8-e7d3-48ec-b8d2-9bfba0238b91", "value": 107076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630129228, "uuid": "1ab51292-d20d-4e9c-b94c-0b64d02b4ab5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129228, "uuid": "4c19c5d0-75e5-4357-a661-7c15425634a6", "value": "9855be90204ad938d350f75e181504bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1465c7f4-084a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630187480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187480, "uuid": "7abb269a-a9d6-4531-861d-eef318c3b226", "comment": "Malware payload (Mirai)", "value": "9a943d6d3af4a3f4ae9b00cc58a2ac6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187480, "uuid": "e85c685b-1670-428b-ba53-27c469ac5cbe", "comment": "Malware payload (Mirai)", "value": "d51ce5f3f382b1a817813266d1ac735656e739e86d9d9e00d558f55aaa3a5e09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187480, "uuid": "962f33b1-c21a-4038-bb44-f982dcb1bdd9", "comment": "Malware payload (Mirai)", "value": "c744e9ff29d5f379e23177dd28bb2d32b2b1a117", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630187480, "uuid": "2614fd24-91ff-4c89-af0a-4b7abb58a90b", "comment": "Malware payload (Mirai)", "value": "23f4e2afb0105ee4a807578fc7cd11071726292ef970f4c6de7b7c21f3958b7e2e170ba63e9749087792c52f4ff6fbef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187480, "uuid": "02e04810-6d8b-4518-ae13-bc29cb609f72", "value": "T10F539FB5C5A8BD99CF698278B61488389723900565E33DFAD741C7A6D00BEECF00D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187480, "uuid": "c0ed3308-9330-4f74-bcd4-d113ffd9690a", "value": "1536:B/bivQhunGauwt4IduhosjT1RYeycfs3QtLok1cY3CJva:BjiBGFOdOT1Rhf+Kn1cY3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630187480, "uuid": "e0883a3b-05b8-4c77-9a0b-598f8dc44bdb", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630187480, "uuid": "e06910cc-a0fb-467a-9aba-04435479b561", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630187480, "uuid": "ceb5693e-d350-4221-8b05-6ca2448089d9", "value": "9a943d6d3af4a3f4ae9b00cc58a2ac6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366b220c-082f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630175941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175941, "uuid": "9881f462-1dfe-474b-83ca-6ef64bb3e0c4", "comment": "Malware payload", "value": "c47e49f7278c8127dd0ae8acf5b9b35a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175941, "uuid": "730cda8c-26ff-4d95-b9cf-eb1d1a1c7f74", "comment": "Malware payload", "value": "d59ac041107750e588ec9f6ec7c121a0f475ce2c6be13a2593cb55fe7ce1df02", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175941, "uuid": "d0249f5b-f77c-4cf3-a942-61c844a5e237", "comment": "Malware payload", "value": "b1072609366f8c6446c865396511bd1e9d85a226", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175941, "uuid": "8895db3e-0a4f-4499-a3ff-869db8553fd6", "comment": "Malware payload", "value": "d7338a98d1ecfd0a28dfa34ee92c415f37e859ff99e04d02211b33e3a5d1d9e5c97e438dea4585269093d19ba2b54010", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175941, "uuid": "aa0b1f8c-b119-4abc-9619-fcf82b4561d9", "value": "T1F924DF7D3B035F6DE02239B8A8A3626C2C5731CB793CDBE1A9C98AE3F712E911117450", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175941, "uuid": "8d5bb4cc-eac7-4fd2-b0ea-8fcfe9fcc15f", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175941, "uuid": "9dff41cc-94cc-481d-ac1e-db537274b81f", "value": "6144:nGqfvOE8DZ9M/1/v1hZ3buLZBqsDHwvCZOzKySiT:ntwb+1HzZruLZcfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630175941, "uuid": "8eefbe30-ff83-4b3a-ae9b-871b6274eff3", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630175941, "uuid": "a31af4ca-b448-484b-bcec-074b0a94f0ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175941, "uuid": "5c06a648-df5f-41dd-b59c-747d258948eb", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d99da1-07a9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630118545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630118545, "uuid": "4c1131b4-b4df-48b5-abb0-c39e7be28881", "comment": "Malware payload", "value": "d685f72a6a48d5480068581ab29ad64e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630118545, "uuid": "09ba7cb8-d1f9-4452-9bb3-0148e4172141", "comment": "Malware payload", "value": "d6021b12c07c1ea6740754f5a5ac2992d6bbc64d1137747edef5516215e5171e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630118545, "uuid": "9cbb40c1-9931-483c-b059-5593e140a956", "comment": "Malware payload", "value": "15c934267935568c1d9b11524f8bc10c3d049e10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630118545, "uuid": "3e1a24dd-5e3f-4c79-a6d9-d55fbfbb343b", "comment": "Malware payload", "value": "4d4402fea196497a20e989c9ed61f314d7070d35dd449a6692517159f9041165ef9948f5159ccf73bce2b576d0015007", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630118545, "uuid": "cb000519-b350-41d8-bdd1-d94aa1884122", "value": "T14F158F3C29BD222BD1B9C7B5CBE0D837F0549DAF3111AA6464D78B6A5352E4235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630118545, "uuid": "843f98d3-e414-4f51-b933-ea42b82b151e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630118545, "uuid": "7b224607-2a07-4072-a96f-c12316c42512", "value": "12288:Yhv996cK6ucQVwyjUkejDtwlX5olIsXbEKFzt+R+a3jKm:s9ocJ6wuUFj2lX5oDrXFztI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630118545, "uuid": "aa148c06-03d5-46de-a484-ae8f7d890b67", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630118545, "uuid": "ad9a787c-dffb-4672-9099-0af1c4c107ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630118545, "uuid": "89f1fe98-a635-4db2-ba96-89e9c98346e3", "value": "d685f72a6a48d5480068581ab29ad64e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f0ed8f-0829-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630173606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630173606, "uuid": "8d16de6f-e74a-4f34-998a-60a1ec13a343", "comment": "Malware payload (Mirai)", "value": "0f63bcb205fd8f677d9880dac001fd1b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630173606, "uuid": "871236cc-9b03-47ca-91e5-14d6dacd58de", "comment": "Malware payload (Mirai)", "value": "d60ad6b3e748cf74d8ebe0f74629f444ca055eac19953ca129d2059afdd326a7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630173606, "uuid": "fd63c0c0-ee22-439c-971a-531ecd87cb2e", "comment": "Malware payload (Mirai)", "value": "8db5b025ca5a4b305f050947a3cf768fef66a040", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630173606, "uuid": "8c66ffdf-b13a-41f3-b578-f1b6e511038b", "comment": "Malware payload (Mirai)", "value": "ded717e5e36d85c423863b15150cf265c2030743cdc3775da6b7f10000598b6719db4978d9a7030d5fbb655d2110ee87", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630173606, "uuid": "22fb4d67-6c46-4de9-abdb-88b8a68e766a", "value": "T1BB730686BC80AA15D7C04777FE6F108E3314A7D9E1EA72029C295FA07B8EC2B0D67755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630173606, "uuid": "7ebe496f-7a1c-48ec-9f04-0399f31f6378", "value": "1536:czwFNSneF6IMMfDGsADV3bt6EB7XfU2//uBgqy:ckFgeF6I833AEBLM2+Bgqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630173606, "uuid": "e61569fe-01f9-4f5b-a905-2ffefbacf835", "value": 76348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630173606, "uuid": "f803269e-c6c8-4ffc-8ee3-630cd1e923d8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630173606, "uuid": "e5d73032-315b-49eb-a084-03a02495fc10", "value": "1isequal9.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a75818-0845-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630185408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630185408, "uuid": "94e5dd65-d6e3-47ef-a1f3-a14fa0a7a4ae", "comment": "Malware payload", "value": "ad836b329e5153cac7ec8660937e5112", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630185408, "uuid": "be1c05b5-30ff-432b-9055-a1aeb5218624", "comment": "Malware payload", "value": "d73c4a8fc8014b27b28c50904d1038540d063421bb1a2d78a1f5fa01ba3e149d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630185408, "uuid": "7302a4f2-c9c2-4ea1-9e7e-e3f7b3878bae", "comment": "Malware payload", "value": "f866fd74f4f875c53f70b7853edf31ed2f3f5787", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630185408, "uuid": "555e66fc-d384-4d6f-a6cb-bd03723116cb", "comment": "Malware payload", "value": "af78f7de713aec05d2b59b626a7a53cd63011b1faca52d130c1851d2ff4889b3a53c337a6ee7bfc4fa63e8c705ab70ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630185408, "uuid": "50eea490-5e6c-47d8-a58e-d1cb44080217", "value": "T1AC35A93DAD292533E7BA86F8C4864D4EE69454CB26334DDF42D2A7893007617B6FA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630185408, "uuid": "5534294f-4ad7-43b4-8ba4-5e708dad66ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630185408, "uuid": "d3b53c46-340e-43d8-aef3-c887d7487f32", "value": "12288:FTwbK4HtLGEUBXeu0BU5SisIid0kph+QrA2r79gEflEGD/XnyP112PdsfLosmoyM:fw3pPXG9DMnYT9gT8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630185408, "uuid": "6b744e63-17eb-4c6a-9319-0f8399a673b0", "value": 1128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630185408, "uuid": "07727fda-85a4-41a9-a515-cbe2b7e4ede6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630185408, "uuid": "fc818ea0-abe4-46fc-84b8-ef597d0471d9", "value": "BID TENDER DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ba4754-0843-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630184742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184742, "uuid": "e1892f26-3b14-4a42-bf2e-d98c0c4dc2ed", "comment": "Malware payload", "value": "8f3e17070111838622cfb69ec4868fe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184742, "uuid": "3c526b13-b2df-4736-bdec-64f73a4696e5", "comment": "Malware payload", "value": "d99ac72301d4d4c55ee0c6e33ad4e4551bac90b71f80515eea1a3dfe426abf23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184742, "uuid": "65acadaf-285d-46c0-82e4-9afb0ab9b966", "comment": "Malware payload", "value": "44ec1e95d1089db7f68ed1fba4c102fef03ad460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630184742, "uuid": "4e30dde5-01b9-4f86-bdf5-aabfceba3199", "comment": "Malware payload", "value": "008318e880e5c7bcef1f8addd71e736c0bc58303a8b6b7eb20f3331b7cd40b92d77f03e474ce1f9a99a56ebb1ee57e74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184742, "uuid": "396527a3-27fb-4f04-bf44-5400d5cc3cf3", "value": "T1299533922AB50861DBFD1B7C1B5062034AA4C956B482FD0864DA16CADFEF49DF7C12F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184742, "uuid": "c8455234-4f3a-4867-860f-1890ce7b210f", "value": "49152:lMdX/2ZvQyUxBHUNupxvHk30hgB+B4WBN/rwUlHNUhRtl:+dXKI3pxvHk30hgE6Wb/llIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630184742, "uuid": "de9d693a-b9a0-4432-9cec-c873ce5c2850", "value": 1999360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630184742, "uuid": "bfcce4d5-405b-423c-8655-efa6e391048e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630184742, "uuid": "d0ce1bb9-8c1f-4b5d-a812-7c190dc55d33", "value": "8f3e17070111838622cfb69ec4868fe7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e114bd15-07cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1630134995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630134995, "uuid": "c43ff4a3-26df-4f1b-ac74-d7544bd5ab67", "comment": "Malware payload (CryptBot)", "value": "3c112a39d8866d896f68adfa3b78a16a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630134995, "uuid": "bc9ea79a-1b1b-4166-aa2e-4841fd65ff1b", "comment": "Malware payload (CryptBot)", "value": "da0422f752076d4897a5616ff4ccde0e1088e3048074a869b8fe4da691eed621", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630134995, "uuid": "26e6a771-7171-4191-b40a-527825e5f7ab", "comment": "Malware payload (CryptBot)", "value": "2a92fc63659dd8880dc98fa3bf357f6e1fc2fb81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630134995, "uuid": "9e9efb41-d4c8-47c1-9dcc-56de5d10c0ac", "comment": "Malware payload (CryptBot)", "value": "8472b51fe744198c9f781e6f8ace6587b6a9c1ae982fa2eff0c691ce06c9d385860da59d2bce1de925b0ebd8872584cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630134995, "uuid": "0e029549-6e22-4949-a001-d1a4d63611a6", "value": "T129F4F130A791C035E5FB12F055BA937CA9393AB09B3050CF92D52AEA1B346F5AD3174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630134995, "uuid": "b6cd527c-818f-484a-9d10-075cc3606481", "value": "e68f2e15edc1c604720a74f10b8483a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630134995, "uuid": "efa71f98-3a3b-4728-b847-eb7d8ad09f11", "value": "12288:aDvBLv2FqZlrfp0gftgk47/jWCsCQPJPo0xnfTSsEUDEPO4I6eil+uQvSwMjcM8N:A5rOuwgftgk2yCsCcnusEUIPO40o3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630134995, "uuid": "15a8c3e2-4a5c-450f-9c14-51f91c4f7bf7", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630134995, "uuid": "df72f2de-2f66-4863-921b-32e85d7588c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630134995, "uuid": "5f60da6c-ce20-4117-8ced-bc64c036cdc8", "value": "3c112a39d8866d896f68adfa3b78a16a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785e77e7-07f2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630149852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149852, "uuid": "ecad1db5-dd2b-4e15-8c6c-c11d4ccd1f7d", "comment": "Malware payload (Mirai)", "value": "7bd6b5486e3bd27cfc4158aa32f7e53b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149852, "uuid": "9182acc6-281e-48cc-a841-bd95cf778f77", "comment": "Malware payload (Mirai)", "value": "da731ebd867078359613e2a2aa133b754fb5e6934f7333a1ed28a584ddcdac00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149852, "uuid": "3bad0eb8-f9a2-4c67-b136-44a9178218b3", "comment": "Malware payload (Mirai)", "value": "920e23857cff3695c5743407d09ed3b2eefa2061", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149852, "uuid": "99011fb5-006e-4ca6-a2fb-b6a08e8a448b", "comment": "Malware payload (Mirai)", "value": "7890d00329e251c704381ec0b608497efbead433308d98cad3b239b01af9c908c70fa404d5c7841b26545baf8ee8224c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630149852, "uuid": "37f37a40-88f9-4a0e-9671-ef4c01039e68", "value": "T116C2D098178919D9C2F9C17903B80B6C19A40FAAF809DC8579F8F762AD8E4753027ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630149852, "uuid": "e6fa1cf1-a235-4557-b698-4b89912700ea", "value": "768:f2G214DFyosXqgvV9o1ndB086JgGlzDpbuR1Jf:f2GdDgosaaO1ndMVJuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630149852, "uuid": "28c7e78e-7ad1-4f8f-8315-20411cc90c9d", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630149852, "uuid": "52e7e324-4bb6-40a0-82d9-9932fdd4b5e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630149852, "uuid": "13a5d91e-cf4b-4d47-a5af-3bc740f2e3af", "value": "7bd6b5486e3bd27cfc4158aa32f7e53b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1453b05-082a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630174080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174080, "uuid": "bd855445-b5d0-497d-87d2-344da7ffdc96", "comment": "Malware payload (CobaltStrike)", "value": "1296d6c02e348f627a801a02f32a26ce", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174080, "uuid": "c8abac3e-b37c-4425-8e56-027119b26670", "comment": "Malware payload (CobaltStrike)", "value": "dae0d23e076390e35ba012a1b9891a5564107bc4fd96bcb769c276b7318d4b00", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174080, "uuid": "42c5225e-4f4c-4a71-a51e-460f27b5de16", "comment": "Malware payload (CobaltStrike)", "value": "b0b98af4593b996fc65b8f3a0ef7ed3e398b7080", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174080, "uuid": "cd435d50-37d2-4560-9fcd-4cc55e42c1db", "comment": "Malware payload (CobaltStrike)", "value": "c3f0b8ae54cfb555ccd35a0b23fc6eb3a8ca14ebe10984a59c71ec6fee86d066b4fdc3dbd1a07ebbc9cbece6f62070b5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174080, "uuid": "cb07f942-f276-4b93-8688-c39c0a4fec38", "value": "T11824CEF8A87B0DA1FED4563D997C2CEC0FAB78DF034211FD9A8CB435B0556880AD1999", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174080, "uuid": "9df9d0f5-36f3-48ee-8d6f-6466b77fdc38", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174080, "uuid": "da8c39c6-88a3-4777-b6bd-2fb351b1d6ef", "value": "3072:wn0XHqgE8YzAMDLuspafV0Yp1cR6abXs85ExRHLdN501aYhlDL5ZGQnuQMQh:PbrGAMDL6fV0YzEsK2LPSakz4QuQ1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630174080, "uuid": "f6aad2de-efb1-43b2-9b1b-32f7f9a02342", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630174080, "uuid": "b2b4f270-4ac5-4bbc-a42d-36d1642ecbea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174080, "uuid": "f9ad5813-3c11-4780-b8fa-8dbe41e55c24", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a85f3ce-07ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630132595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132595, "uuid": "92cbf197-6fa0-4352-9865-e8013ed9f2d4", "comment": "Malware payload (RaccoonStealer)", "value": "c407d4fb0a859743e72402a90e2fece8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132595, "uuid": "32844634-5edb-4161-8dba-c83246429765", "comment": "Malware payload (RaccoonStealer)", "value": "db2a28f76862ebf16aae7dcdcd41535704f4ec084bd0707a61d8f0a227fc3c68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132595, "uuid": "e75aef0e-12fc-43e4-8558-6b3850eb59a6", "comment": "Malware payload (RaccoonStealer)", "value": "1bcadf0195f31bc6713f42690fbd9f24be6a78d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132595, "uuid": "47894e07-74f8-4293-a902-3cac4276eba5", "comment": "Malware payload (RaccoonStealer)", "value": "82f02b3bfdd8de41965b0401bc0c1a4bcdaf322bf162b8751d04a66fd8071a012c5b0a9cc19a3c5733285f0be3f114a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132595, "uuid": "bfdbc739-ee37-4f61-97c4-4cd88901f6cd", "value": "T123B4E030B791C035E1B722F459B98278B53D7AB0A77450CF92E52AFA56346E8ED3070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132595, "uuid": "d5704f9c-a1c8-4d9c-ba6b-5640ed34e19d", "value": "e68f2e15edc1c604720a74f10b8483a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132595, "uuid": "8ad52ac8-20aa-4f26-b2b9-e4a2839e0ff9", "value": "12288:EmvYHvkh0Rx7SdKNLiW9EibGLuSHRMNkhkFFT0NgUm+:zgPo07/cPGmhkFVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132595, "uuid": "5f573120-a924-4184-af84-3824bd1cafe8", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132595, "uuid": "fc57256d-7f94-4dc6-9777-5bcf4130a31f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132595, "uuid": "db182f97-b404-4d78-bb4e-574eb8f31570", "value": "c407d4fb0a859743e72402a90e2fece8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2a0e72-085a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630194603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194603, "uuid": "c85b9597-d2b5-42da-94f2-6d372695b237", "comment": "Malware payload", "value": "5aa68537c9d6404db0ef8edb85ac44f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194603, "uuid": "c1c8eaaf-540e-445a-a772-97b3cb381712", "comment": "Malware payload", "value": "db6207e5859614ee43cd64bd528b0c3ef61be4a8224b0eca48eedb2304c530d4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194603, "uuid": "25925a31-9735-4b3a-9590-e7fe745f07cd", "comment": "Malware payload", "value": "4d3332122869ffb48506d70470f6b6d0274a8fff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194603, "uuid": "23b18d86-d651-43cc-b575-937de4bd7481", "comment": "Malware payload", "value": "0c9bf7fa7d4e7c5f3867cc6035f39ca633b09d73f3ed8adec3dd9c567943e16ef1a11c4ce588f96791da51fc0d96fa08", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194603, "uuid": "9bd35e18-fd9b-48a5-b92b-be8ec2bb6ae9", "value": "T108735C136991CB7BC4C747F92FDB952144A3F83E1B32620A73D8BDA92B1A9C82D5D301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194603, "uuid": "5fff7ba4-c61a-4aaa-826d-82dfd8d410f0", "value": "1536:47IZuSaH+1iDnD+Q8bQ8O32Ls0FnswNRzvmA+JbOm/coZ3ymj:eCae1ItqQH2LDnsERzvm/JbOmEoZimj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630194603, "uuid": "a63b639d-9c58-40a4-bd08-cfbcd57e9a83", "value": 80455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630194603, "uuid": "b055716f-514c-4a03-91e5-9cb79bac4c2f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194603, "uuid": "5a73b405-7ae2-44b9-8dcd-559c95e5cf0c", "value": "vvglma", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa96a9d2-085a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630194604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "c24130cf-b3ea-43e4-b313-f4f500c7ac23", "comment": "Malware payload", "value": "778bb0d05d091d5bad56752903225fd9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "bcac05e6-d289-47bc-8c75-cca24e0c3511", "comment": "Malware payload", "value": "de0041d51fd3815c6c050aace73f4d1e9a1866fedc7c1720af61cf50c44a700e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "f5d67e47-94d8-404f-accd-0e555fc151d2", "comment": "Malware payload", "value": "ca937bec037d49d5ce92988fbf5be9d82bc57f2d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "94a176a0-79b5-432a-b104-4942ada8a580", "comment": "Malware payload", "value": "29e629b025af98264684852a2581fa3c4a4b4edb669e99a1c39b8ca40bfe8f5f4e1c7d09beb7f0e81550a3ae1b8e79c5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "eb55b168-f6cb-463c-a967-91bc008c7f95", "value": "T16A632A026741CAB3D4831AFA06E75B250633F83A1E16DF56F32D7CF45B15188B22B769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "b62d05e8-34ea-4fc0-b140-4f21d041d2f7", "value": "1536:RRVYPCNH1jUdOn4JymPWBSgSh1MtN6r/NbHBDSDmd+l2OZ/fufYEZ:RRUCNH1gdikrEHM1IIrVbJSDmMl2OZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630194604, "uuid": "74eac1ed-6e1a-43ac-a913-3f2d3971b973", "value": 68252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630194604, "uuid": "37fd83ab-0c73-4f78-bde0-97381826cc9a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "d396541d-f407-42b2-b560-a508c4c3a182", "value": "qvmxvl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6076b918-082f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630176011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630176011, "uuid": "c0646d3d-c9dc-4d9c-bb22-65a42f0b2455", "comment": "Malware payload (CobaltStrike)", "value": "41eb24d16ded391c973e9dbc6c2fec00", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630176011, "uuid": "7c01f821-4d0d-4c29-a9ab-37a93c836687", "comment": "Malware payload (CobaltStrike)", "value": "de9276fe0d69980d3ab80be2883bef46bd5979234ada3b221c4f415103b6cc71", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630176011, "uuid": "ee2194df-c31c-4079-ae9b-b440fdeffe0c", "comment": "Malware payload (CobaltStrike)", "value": "f80bdff323b4e90a3b58442c92b406ccaf7baeeb", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630176011, "uuid": "80e37a7a-6e99-4298-838c-334e9f04f7a5", "comment": "Malware payload (CobaltStrike)", "value": "49fd64a59e9323a2e2c665f81013cc46379848c01113f71810dc216e8c9de4559af4881a846cab04ff395ccebf8a6cf5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630176011, "uuid": "40b62fc3-2ffa-4e63-890b-28de952b276d", "value": "T12224DF3CE81919E1CF420E32C9BD4B3C2C6D64CB9B3A7C14CDC0D4D6656A45ABD6A72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630176011, "uuid": "2167d94f-f8bb-4d6a-864a-8e0dab17224c", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630176011, "uuid": "b51115ee-2524-4aec-9e34-15996a0d1dc8", "value": "3072:rFHJbdxOK3Ye0BQE75pG7Pw16v2tHQAB/YgSCc4YRT4EDjm0sLWq15HSKQgO:p9b3Ye0WWnfoUTbc4s4EDCPWq1RSKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630176011, "uuid": "6895123b-5b86-4372-b6c4-defad179036e", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630176011, "uuid": "b592a00f-ff9e-4f74-8daa-9dcd3275798b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630176011, "uuid": "12ca05b1-bf7a-4a7b-b757-aaf0782040c9", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc678815-0819-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630166743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630166743, "uuid": "f2fbd31a-4f3c-4a21-ac65-1021f41e61d7", "comment": "Malware payload (njrat)", "value": "aa93d1d3cfa1ecf60082ceda795985ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630166743, "uuid": "5304b2de-e7b0-4844-9547-d101b408be07", "comment": "Malware payload (njrat)", "value": "df76b66e92d2d5f0b35e9d8b67a65f2e967ac7502013496e9e241ef510ffad29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630166743, "uuid": "101c4b52-696a-4866-b671-5a40cda357b9", "comment": "Malware payload (njrat)", "value": "1adf64271ddf24d326c1bc160d5070bc991b4021", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630166743, "uuid": "94318411-b4c2-4ed5-8a23-55b3fb41d4eb", "comment": "Malware payload (njrat)", "value": "9a3f2823be920f29d120c95681a6c9fd42095db90db55488f417723b46da20322cce99440162acea5b9491a5ccb5029a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630166743, "uuid": "8ba3cf0f-0b90-45f3-a5d4-5bfe336c100f", "value": "T178F4F7242DFB501DF3B3AEB95FD8B8EF896EF673270A24A9206103464722D41DD91739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630166743, "uuid": "8d4d29c8-2937-4b12-8b62-ee24205bb5f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630166743, "uuid": "b1ddeee8-1abe-4fab-8523-7c2cb0ec3f0d", "value": "12288:MwpS8dnIxjwclTapkjXuUALG3u/7LimWQHtJu0qqvxqNzoDvjsQjWLad:Mkjtcl2wG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630166743, "uuid": "87f47257-75d8-4d1b-8fef-0bd09f7802f4", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630166743, "uuid": "4600cc2d-fd84-436c-b0c8-f734b6179933", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630166743, "uuid": "7d0f9cd4-b2a8-4fab-ac86-4a98691e12d1", "value": "aa93d1d3cfa1ecf60082ceda795985ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362723bd-0848-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630186678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630186678, "uuid": "a78a8091-1795-4862-9489-d78772460cc2", "comment": "Malware payload", "value": "bec93f2b64c8cbeabea2a161d7f1ea78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630186678, "uuid": "3e3de1ce-3e2d-4405-a571-515c83342b1e", "comment": "Malware payload", "value": "e3e9c030652099237b823eeb119dbd8a27a34d77910b0ffeb09a834afed41b0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630186678, "uuid": "ebfff42c-f2d0-484f-867f-c907d97efa71", "comment": "Malware payload", "value": "302ec0595126663ecce4f37deec165762c7b5305", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630186678, "uuid": "9449c66b-d67c-41ec-930d-8439597b969d", "comment": "Malware payload", "value": "b5405fe919b5ab7575376bf9ed7dbb3f9bdb3e00eae8e30c601cb32ff6dc9fc80ae5a5006ba47ef2c799fd053881bd50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630186678, "uuid": "835a8b07-13fb-408c-96f1-dcfb31e51f7f", "value": "T1E4E53327A9E2BE0FD8868D34267704A29EED2ED37874D35947917AF74337095B63300A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630186678, "uuid": "8c566243-1b95-4cf4-b7fd-00a4b6378a27", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630186678, "uuid": "8d1505d5-6560-4282-984e-63b14630fe97", "value": "49152:jdG8akPhMhpkkclMh5qARqvVosWhRCLGcBtBuLVqS1Eqxn+hWMMnEr/spSxb4ZsL:R9MWCh5qtvVosW7ExBtARhl+wEWJs15P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630186678, "uuid": "f6981fe6-60e4-4dab-bb93-7bd8a3188a50", "value": 3222984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630186678, "uuid": "5b61a8ca-9454-4290-941a-97f65560f963", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630186678, "uuid": "ec366327-c98b-4244-9580-784a3f26526d", "value": "bec93f2b64c8cbeabea2a161d7f1ea78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f89608-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630167758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167758, "uuid": "b16e8a3b-0ec4-42a6-a422-8439ff93f20d", "comment": "Malware payload (RedLineStealer)", "value": "60b69396f30ba55f791bef097e8ae127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167758, "uuid": "dc70a285-ab03-4ef4-874f-82b3958418b6", "comment": "Malware payload (RedLineStealer)", "value": "e7529359cf5f9d0cd7302e66fb9b121e1cc8763cae1d1d5ac278a4a0651f9ba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167758, "uuid": "69dabf13-59ca-4478-a3b2-ab97e7006a34", "comment": "Malware payload (RedLineStealer)", "value": "a2fa147e0f5b10e279939be8960a60f9cc661ad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167758, "uuid": "b7319f8f-cead-4dc3-b1fc-ec15d2ee7500", "comment": "Malware payload (RedLineStealer)", "value": "61fa834d42c29c754d0cf6f18baeed36f53171ce178c07a888cefdba4156d8ace8a177d309cf80510aac607d084e53d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167758, "uuid": "6c8de4f0-c6cc-4ec0-986c-edf12ae77ed1", "value": "T1E644F015B6B1CC73C5D7097448A8C2A96A673A22AAB0CADB3F49477F3E213C1472D357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167758, "uuid": "0126694c-794b-47b5-93fd-684ab5542809", "value": "8e0bb80ced2d421c88737de82cded0ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167758, "uuid": "6a5d2714-ea2f-4555-b8a5-a119dbbdab2d", "value": "3072:v/FpkbkdYUWLcG2FSppsoXIo3zI9b0c8ZkEt9jId9GBOeGOdE5GNzBsI5/DuT61A:X39YUlxpo3zGMkE3jtGWvsI5/A/V1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167758, "uuid": "33e59140-f09e-4a21-bd66-1e2d4a0bfbf5", "value": 263936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167758, "uuid": "3ca5f858-72d2-4380-a8e5-bf192b996494", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167758, "uuid": "7edf4e94-5579-4aa0-89e5-51e0ded2864f", "value": "60b69396f30ba55f791bef097e8ae127.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20743c57-083f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630182776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182776, "uuid": "15f3b8c0-e1d8-4223-8b5d-d6a09b3410b8", "comment": "Malware payload", "value": "ea8ba48e6066a41a5927e04b03e54369", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182776, "uuid": "f542366c-75bd-4413-8dc2-77a4d7a996d0", "comment": "Malware payload", "value": "e8dfe1e032773417df9ae4f589bb71a024d9e05c47593e1d109795fa8ee024ba", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182776, "uuid": "b5adad07-2189-4fad-89e0-4305e0caf1bb", "comment": "Malware payload", "value": "7bd5fbaebe2f7f2d4855b058d6f6ada994656a3c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182776, "uuid": "f4ae6dec-f292-4464-bc86-7e013764a6b1", "comment": "Malware payload", "value": "8663f0b0f6e3ea401b7ec2b7c0b3fc8ce63d704089a19eada17015559ac3d50c6a82f0edab89c0ff82b9ac5ddd3223f2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630182776, "uuid": "4dddeb9d-f66c-4098-8cc9-26ebfdf8f5a5", "value": "T1EBE301C3A79424ACE09FDA7013BB4353177E965066CCF3A655E50572ACAEAE21F1CC38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630182776, "uuid": "ebd9aef0-2749-4039-849e-53d28879194a", "value": "3072:UW0dJaYhnxhj4ruh5ZAIb9iAptzL2m0XxKPnVBIVBQhPZhP3gpa:p0Dhn8c9bAAvx0Xxi/I/SHYpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630182776, "uuid": "0159ade6-03f2-4b86-9279-76e4460d53d7", "value": 153002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630182776, "uuid": "10d857cc-08f0-43f2-a2d6-e8633d03ce57", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630182776, "uuid": "ebb8dc9f-085a-463a-a1a6-68d845996fe0", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53981d45-083b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630181144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630181144, "uuid": "bd2603fc-f545-4bec-b029-b1261a0e4eaf", "comment": "Malware payload (RaccoonStealer)", "value": "ca04502ff8009c1cc5a1ba556d9c9ffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630181144, "uuid": "88eaf18f-7a23-447a-a19c-8b6e7ce768c7", "comment": "Malware payload (RaccoonStealer)", "value": "ebbef474434eab0794928cccebb8db93ed801dc2dd2b3e45f46c736d78718f9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630181144, "uuid": "ca2d19d5-1fc9-4dc7-be16-06a7ca99c193", "comment": "Malware payload (RaccoonStealer)", "value": "de0a3fc889a15ddab0cb4afa931a72859a55735f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630181144, "uuid": "355eba64-8fcc-4dba-be53-7ece37580a9b", "comment": "Malware payload (RaccoonStealer)", "value": "a84b5d259174a8a21c7bcf67a5bb62a2c3b74cdd59e465091a29ddbf8b068b227bd37ea8756bb822f25e1df6a7fbea6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630181144, "uuid": "b511da54-a95e-4bb2-a19e-4131e74bb835", "value": "T19C5623261722D080C1D1C932563BFEB972B66E1D1B41DC786AE27CC735B75E6A203A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630181144, "uuid": "9f8e64e8-15ea-46d5-8fde-7738bb6939b3", "value": "5b9290431b366a1252cf05522cb28180", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630181144, "uuid": "22d552e8-1ce4-44fa-b05f-667c495a9867", "value": "98304:ZS6B/6qRfi0oMOFScwwgQM07W9IE623VoAdnqZhOs+QxsWMzZeSsgLUtfFsM:ZSy/tRfi0zOFSxjF0IlCAiht+0sz8jgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630181144, "uuid": "36785bfb-b79c-4891-b9a7-9a3e3280bf31", "value": 6231096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630181144, "uuid": "1a9b624a-dcb4-4768-851d-d54adfae91a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630181144, "uuid": "0ffd31c0-ae3d-4f12-82cc-ccfec2efae2b", "value": "ca04502ff8009c1cc5a1ba556d9c9ffd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad39782-0859-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630194148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194148, "uuid": "050119de-f2cc-430d-88e5-b2ad891b2431", "comment": "Malware payload", "value": "957af740e1d88fabdaf73bd619cb3d31", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "lockerfile", "colour": "#D92C09", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194148, "uuid": "549c53d4-f0de-4c28-93a0-f7f54c11e9cb", "comment": "Malware payload", "value": "ed834722111782b2931e36cfa51b38852c813e3d7a4d16717f59c1d037b62291", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "lockerfile", "colour": "#D92C09", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194148, "uuid": "c47a6faa-d4b2-4506-b518-ea3f523a916a", "comment": "Malware payload", "value": "a43002aed315f1f52d7628009438d685a2e361b3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "lockerfile", "colour": "#D92C09", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194148, "uuid": "bd2126fc-ba3c-4cbc-9e62-cd0a68ff0f7c", "comment": "Malware payload", "value": "5139d548923ba827a560446b5218965d62c53606bed16e2908da35bae79cc09f02ed94f0ef21cdb96dfebcf7ae6b8fec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "lockerfile", "colour": "#D92C09", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194148, "uuid": "8ad58d24-0f79-4e41-b825-db47b08ef096", "value": "T1C2435B203191C032D0562534197AD7725A7E7D326EF8848B7F95137D9FB03D2AA3E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194148, "uuid": "b560b475-d696-4f11-bef4-019353bbfcd1", "value": "95d18fbf71e07404ba484d765a1adefc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194148, "uuid": "5b27c277-aeac-41a6-9a38-2a03c0a9c14f", "value": "1536:SEZpzgIq8qyxNw5NtVACe7HkJBH8DDTsPl8zwSoxir:SEZOGqhf8zzq8zwnir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630194148, "uuid": "afafb6d8-14a6-4588-a365-bb900621973e", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630194148, "uuid": "3b46862c-0288-4c57-bc96-1ed5a5ad7d83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194148, "uuid": "30b7b8b4-ee43-4a0b-9644-78a1fa7ba5e8", "value": "ed834722111782b2931e36cfa51b38852c813e3d7a4d16717f59c1d037b62291.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c02d0e-082b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630174495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174495, "uuid": "de0362ba-7372-43b0-a5e0-620de0a3ffef", "comment": "Malware payload (njrat)", "value": "4fb41f7fc0f5ff4127329509100aa8c6", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174495, "uuid": "ef101d9f-d308-4457-aef0-6581741fa30d", "comment": "Malware payload (njrat)", "value": "ede656dc040418ed90ddf889f89663e37bc6a532396110351af94f6f302ea7f8", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174495, "uuid": "32c6cb1c-26ad-4647-8101-cf6806fb480c", "comment": "Malware payload (njrat)", "value": "77a10d1235446e8a654d4c26a7e5ab7e7a9fb83b", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174495, "uuid": "ca9ac4d3-02bf-4e6d-ae75-e38816a368d4", "comment": "Malware payload (njrat)", "value": "a78d51f34cc6e2b288c38221367185f130c6b2c8f53880ed7ce366f26502b9fccb27f98d30cb94da05cd3ebb96d3b76d", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174495, "uuid": "803b400f-4b9b-4f3d-9fea-0844a3cd8483", "value": "T18D82E0E315C5B8796B4F251218D4AF59BC7BF9889E9AB2F4093610EC2F1D9C8291D331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174495, "uuid": "22b41767-ec5a-4cb6-8168-30cf5a19336f", "value": "384:V6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f60jQog6f6f6f6fr:ACCCCCCCCCCCCCCCCCCCCCCCCg/CCCCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630174495, "uuid": "b049bc0c-8399-43c4-b9a2-dce19c82b926", "value": 17970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630174495, "uuid": "dcfec609-f7ee-4a99-aa24-65995ec25d9d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174495, "uuid": "b86aa5ff-5d02-470d-b5c5-f4302520b0f9", "value": "PDF.FILE#1145523.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31a4446-080f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630162486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162486, "uuid": "191403f6-499a-4eeb-bb79-fe6e8a3638e7", "comment": "Malware payload", "value": "a800bf8501b3c00f77ad505f333ee056", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162486, "uuid": "1f65ef45-9486-41c6-bbf6-38ec9081d938", "comment": "Malware payload", "value": "edf628bbb0980956c1041a489049260fdd3c1081c7eac1ee182396fb03883f1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162486, "uuid": "27f6e716-9de7-4eb4-a3ba-759981432162", "comment": "Malware payload", "value": "f680ba32c019a0ee440130ff9b0a91afdaa0e824", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630162486, "uuid": "9d514cfd-6ed0-4b80-b3d9-49a759e91cfb", "comment": "Malware payload", "value": "1316d1e828097ce1c5d531ef3b4504f6b54f3b38ddf5e35183f24c2b2692ad2643ad2de60ea63e4b2552e9262d31f62a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162486, "uuid": "b33aa378-db21-4f3f-9f97-f2266903cfe8", "value": "T1902302A92F1349CFC8332CBAB44B89562CC61F2A345F485811B5D5B95EF322CD5FA314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162486, "uuid": "0078a195-280b-4a9f-a996-c25fc9d80e3a", "value": "768:TDoQtBTX941eYFDgNbl5PatCbYUmQAvv/wY24kDpg4AubAvQ3kuHYh8M:XtBTX941eYF8NblpuvnwanQ3zW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630162486, "uuid": "bbf1ca44-3c62-4d6c-b046-025b00f24c10", "value": 47916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630162486, "uuid": "31d45c45-7042-4df1-83d7-71bcfaca3274", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630162486, "uuid": "6b108068-1d39-4f3b-9e83-9ba0ee4fa542", "value": "SecuriteInfo.com.Trojan.Linux.Agent.HIT.15297.14564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41824648-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630167799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167799, "uuid": "52c90503-ed7b-4a71-a47a-0dab72f46897", "comment": "Malware payload (DanaBot)", "value": "c9daf26ccee6467b645a1d0f7d93dcb3", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167799, "uuid": "ac030911-efb0-4750-afbc-e21c2a833d1a", "comment": "Malware payload (DanaBot)", "value": "ee16d0b86c76dea349da88859349f930bb88c30fbf883a8d50003ab54d03abcb", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167799, "uuid": "498198fe-4bfa-4bb2-8d5c-d79769e5b908", "comment": "Malware payload (DanaBot)", "value": "da966c169f302fc92e53850d345a9bbf0ae97c6d", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167799, "uuid": "1a419228-0ab9-4cf4-ba89-b108decb86b5", "comment": "Malware payload (DanaBot)", "value": "cdd9bf0302ed3a5030ffa458aef4e87a4a630d7baad7853c581c0410f545873c054a16de55c121bf88319959d9a85d11", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167799, "uuid": "a13f06e3-eecf-4072-8dbb-3863e1a4ca2e", "value": "T1533523056FE084A6F6EE46706CB1D6CB52B7BE626022DF17B6547FEC28B304045D893E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167799, "uuid": "47eeb607-ec68-4b6d-8b8f-5d613350430f", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167799, "uuid": "c0844bbf-e5a3-4928-bf93-793f8248fe24", "value": "24576:zLg21Zty5k33Pra5mlVrk4l6Bsfi9gE721wCc8xQuMdIFtWaDus2zeECQQ95A:Pl1ZQwjy+B6yfi+Ey1/bxmdc5ECvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167799, "uuid": "f1d67a54-921d-49eb-8dbe-6992888051f9", "value": 1088888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167799, "uuid": "018dcf99-cc47-4d92-a69a-02e654ebd967", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167799, "uuid": "278c7c7d-789c-47ef-9cb9-3588b1cb8a00", "value": "c9daf26ccee6467b645a1d0f7d93dcb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8945aea-07c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630131599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131599, "uuid": "c6820d2e-4081-4988-a720-02e896ef88e7", "comment": "Malware payload (njrat)", "value": "758ecf2399a528d2be889feaea00ac91", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131599, "uuid": "8cea9e08-a13e-46e2-bd29-48522e83ab89", "comment": "Malware payload (njrat)", "value": "ee3e682e4fa43cda0810b952e2df8b07c4fd952fe49c22c8dc4fbee1247f0b6b", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131599, "uuid": "397a01fb-0ca6-46b0-9d22-adb2f144c5aa", "comment": "Malware payload (njrat)", "value": "a30c90fab983ce5668c422240e37998c9fb7deb2", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630131599, "uuid": "eaf3cd63-20b7-4652-94bf-cc100152bfa6", "comment": "Malware payload (njrat)", "value": "c8f19132c4f99edcbc17b265acb7f24e20567e96c37a4dae8d6063cbb355215d6520fe5b63a42013ab2e087cb1a920d7", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131599, "uuid": "e4e6f4ef-d62a-43ee-89c5-882b99574e35", "value": "T12801F60A4D29CDDB0149F28242C38DE9C6604A674F806E7A2478754B6DAD22E6DCCD87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131599, "uuid": "3d259575-be9d-4fad-8f1e-39ee67db750f", "value": "12:0ChGFWNwskXNoxAbOJk82cG2bwELPdg3Nfd+aaiTC:HgFWNZkXQXG2UE7kNEuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630131599, "uuid": "a3d2ab81-e999-43e7-9b60-fe8bb8dc4a06", "value": 731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630131599, "uuid": "6cf18e3a-a258-41f2-adc8-0388e8c093d2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630131599, "uuid": "cb583db1-2ff3-4ae6-8023-790bbdaab996", "value": "List.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768607b3-07c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630129233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129233, "uuid": "99da1d2c-b94e-4f15-9473-dbef3ebbd4df", "comment": "Malware payload (Mirai)", "value": "88bbd6fdfa595e534f89ae6efdf59dcc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129233, "uuid": "28769b3d-db08-4fca-acda-2b7e1ef571a6", "comment": "Malware payload (Mirai)", "value": "ee50f6d679ef5cdac3d45317cf2d1ff662b9c0628b9d5d142e59fe2e8be8a01a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129233, "uuid": "197ce364-0693-4635-86e6-abdab537a2b4", "comment": "Malware payload (Mirai)", "value": "ad163614aa297284085be25495c27c2178cd585f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630129233, "uuid": "84cc24fd-f377-4066-9e4c-204b1c7ca52f", "comment": "Malware payload (Mirai)", "value": "07de84c40ef4b2e2a2da223913a6c40e8709de598d8b46c874e3e39e9d2a408c0437f6f8407b38c0ec752b5c48d646ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129233, "uuid": "8200cc40-4785-4481-a408-b12bc2b1e377", "value": "T180B3E706BF610FB7E86BDC3705A91B05198C595A32F93B36BA70C428F64B64F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129233, "uuid": "4a6cd715-4ba0-4909-8371-5f42f49dc17c", "value": "1536:9mW0SzNp+6TkvQxqXsyUFb2A616g7Ib+YIgS3VerSUoZ1NsHdZ6quca1NmRG:9mW0SZp+YkvQgs5Fbng6gI3oeGGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630129233, "uuid": "24f1b8cd-df4b-445a-a2ff-62dfe0c2c969", "value": 110644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630129233, "uuid": "4b5415c0-8258-4c04-b723-00bd7c95aa88", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630129233, "uuid": "780755e4-f8d0-4b11-ab27-7f1a930947e1", "value": "88bbd6fdfa595e534f89ae6efdf59dcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae478c2-085a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630194604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "846285a3-0c18-47b5-bfae-db5c30885afd", "comment": "Malware payload", "value": "ccf80222f46bfe0a88e89094eb7becf7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "8df5a79b-74c5-4f56-8473-dbba224b482c", "comment": "Malware payload", "value": "f0901c3a15f440d0cefdffe3d4a8014186afcb2c2a9a9d7066747381d4f586a4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "859d0225-02b8-4170-9b76-84c86b6f49fc", "comment": "Malware payload", "value": "a18aa0ac22d5e606bf65b46f11414c539299a274", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194604, "uuid": "ddf69618-5c52-413d-bfb5-37682bdfe522", "comment": "Malware payload", "value": "d91244bdcc6785194a659d580081b113506abc72a0b9114e40db07ffb6a4f46a10a7d2ff9ba627beff5144c9331100b6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "15d027e4-ff99-4e73-bad6-82c6531ee8b1", "value": "T16C830A41FD418B17C2C327BAF79F435D37356A6497DB33016A386EB42BC67982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "21bdb3bb-4171-4bc6-80c7-892e09371f8d", "value": "1536:2TxGIBAIxQJ8x5OEVBvFB3n1B8OYSUmZhBQ4Kb3RXFFj:WBa8hBb3/8OY5mZhBQ4KjRXFFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630194604, "uuid": "66de27e0-0fe5-4c47-b765-82f6cc580c94", "value": 85249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630194604, "uuid": "a419f442-631e-47fd-acd1-1159aaddd4fe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194604, "uuid": "b9533d93-ce44-4d64-a0c1-edf3cb85e4a5", "value": "qtmzbn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c927805-082f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630175870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175870, "uuid": "aa1dd470-a9eb-4cbd-a204-1f6055700576", "comment": "Malware payload (CobaltStrike)", "value": "9d3d34442a4b10bc27b3028c4a016d0e", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175870, "uuid": "8c7b0524-647d-4eda-b132-ee7302e34389", "comment": "Malware payload (CobaltStrike)", "value": "f0c367c06b865d025736f8f0c4dcb2b407016e124dd0fc2af6ab2332fa848ab0", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175870, "uuid": "dc93eace-c7fc-43e4-889f-7567fbe9462d", "comment": "Malware payload (CobaltStrike)", "value": "428c42e510236955067942acb8dea5f7d6cd73a3", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630175870, "uuid": "57d8e1b0-db5e-4043-a4bd-b0009f23316a", "comment": "Malware payload (CobaltStrike)", "value": "dbc9626450ef0af710a5c10ae902c17e03d1138a4032fff18a546675dbc58bfbefbfd4a2a885bf7e1dab8a32167cc76a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175870, "uuid": "e639db4b-a72a-4434-b009-35622cb12879", "value": "T18924DF78F0121C12F4CAB3746CB16066DE6ABE976C2335CE4AFA9D20F1C395F8A51D94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175870, "uuid": "84240169-0e0e-4231-a9cd-6b5bc2eac406", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175870, "uuid": "d5e2860f-5f09-48bd-a396-0dde91a7a899", "value": "6144:5dOFvRAxw6UvxA5s+KUygzrbyyyhWdLekB:5dOfYlGHrDwJek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630175870, "uuid": "7326f234-571e-4c1a-b5b2-be07d5c8af5f", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630175870, "uuid": "4e83fa97-81bb-4568-bb9b-5ac0f647d64c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630175870, "uuid": "b89a864e-ce62-45ac-b822-35147790aa3f", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68c517d-083e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1630182652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182652, "uuid": "cfd3269f-1183-49ac-9cad-becdce5cb9bf", "comment": "Malware payload (CoinMiner)", "value": "b137fff4b205d540cccf36b16d3c5604", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182652, "uuid": "3ee00826-44f8-473c-a564-5d21c6b143c8", "comment": "Malware payload (CoinMiner)", "value": "f0eef776c31bc4af21280f8b2e7f82dda4682fe97214347479b6500848324e87", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182652, "uuid": "edf57c6d-c15a-4d09-8893-0c96879674d3", "comment": "Malware payload (CoinMiner)", "value": "010a3abe5fde6040fe5beb465eca26e4615ff89f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630182652, "uuid": "7b54b631-c767-46b9-8535-1e60bdbbbc41", "comment": "Malware payload (CoinMiner)", "value": "872beb97bfbdab72c3b44013e9c727ba97170a28cd07ab4352b9e8007599490f1b9ef195f67e76620f421277305f4ced", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630182652, "uuid": "8ae0a2e8-9b92-441a-99b7-ca710422d5c3", "value": "T1D3363301F7E3C0FBEE534036635CDBF769B8CBD002484AEBA7A4D7881D68496612EE55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630182652, "uuid": "5c1839f3-d070-4d26-be70-24e989ee11c1", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630182652, "uuid": "d817671e-6499-48ac-b66b-1157c90c7572", "value": "98304:xZCvLUBsg3bsj4tZ+f/ufmD1H3K2lR2vOOlMi5aGFpG9jKbmdbqRF:xSLUCg3bsjl1H3Tl+lMikG29jiRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630182652, "uuid": "de888271-c6b2-4043-989b-921fc08f8a62", "value": 4969571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630182652, "uuid": "e2aaaa03-4e91-4d81-b74f-185e22b666ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630182652, "uuid": "e399a614-d2d0-4c5b-8cd2-f011d77b0033", "value": "B137FFF4B205D540CCCF36B16D3C5604.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f163f33-081c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FickerStealer)", "timestamp": 1630167822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167822, "uuid": "c2b8ba6d-68ba-4ca5-acc3-5581885d4001", "comment": "Malware payload (FickerStealer)", "value": "e3bf6d17db40ba1a967df90bc3ba3e4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167822, "uuid": "5050e5a4-b2ba-4ffc-ac87-e1b10dbcd1ed", "comment": "Malware payload (FickerStealer)", "value": "f1107d0bce75510a76fc68a917c48afc205459471e22a95dbbd0e52dbd445075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167822, "uuid": "c60acb70-7007-4441-8f27-71a32220a910", "comment": "Malware payload (FickerStealer)", "value": "25ae8565ae5eae94e3dd06955b908a3cdc53623f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630167822, "uuid": "cc47b6ef-08c1-4a7e-8bbc-85ef3e668cb8", "comment": "Malware payload (FickerStealer)", "value": "dd85fcf95def4e8d68b2424a0061c35297dfb401d9597208db6783bb9b7d7d27690fd371435eea0a1ec5b7013c4571cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167822, "uuid": "0e2fd325-7a02-46c9-a35a-020d35e99ef1", "value": "T135947C2060B81C6AEEC622BD488F5356A73F7E609A33C7D346366575DF531C2E5AC283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167822, "uuid": "29a12a7c-2619-45c7-8a4b-e38cbf1d2464", "value": "35df0081a66dd5736a634c136f4b9626", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167822, "uuid": "a568aa58-5555-41f2-b71f-79a4ba8e1ef9", "value": "6144:TqUMjfPJt/I7RnfDmMOkFnjuZgFK+IdJsI5/eXaW0rLFb56dpLN4XQKJ3:+UsJpItjOanSAl6mcGXaW0rN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630167822, "uuid": "47d6ce96-c655-4d39-9bf8-d4979dabd79d", "value": 424972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630167822, "uuid": "0452eb68-c55a-4694-aed4-319e64a47468", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630167822, "uuid": "4370dcce-7fb3-4c76-b28f-54d946c2bc96", "value": "e3bf6d17db40ba1a967df90bc3ba3e4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89deee96-07f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630152029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152029, "uuid": "54c22ec4-7dc8-46e0-a977-9df2a8a000c2", "comment": "Malware payload", "value": "0a935cfbecb968e84e01f2d563781fb0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152029, "uuid": "2109fde4-b3cb-4c78-9768-123af8842b5a", "comment": "Malware payload", "value": "f1c4b809123931c59aaf98fc0990879387aa50bd9d5e6842841e52c6f621e742", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152029, "uuid": "fdf8d41f-4226-4acf-86d6-d0b0664b53ab", "comment": "Malware payload", "value": "ab7feaeb1c3657f2f1f1a44a9428f4f598601013", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630152029, "uuid": "63ef425c-3b72-4b61-a86d-1a54a1072edd", "comment": "Malware payload", "value": "900e89103e774a6731cf4f1315541481e24667f7b1656707a04d64ed7809d3c9025a4cc4b2136e31958b2caab4d856b7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152029, "uuid": "b55b484e-441c-40f1-ae57-2334ffe2b170", "value": "T12124F1890EAA9B96577D924A2EE9F4801FFE6DA40CFC80C4F5D1014BFE7777091848E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152029, "uuid": "b4aac4a2-9a1b-4e40-a2ab-47c441f07299", "value": "6144:hyDHi4V5Znjie9Svvic08szdLnNraF7WgBv:hyjVVvnkv10PR9aFrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630152029, "uuid": "4f86d70b-87c4-472b-aea4-089c69bc5268", "value": 210011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630152029, "uuid": "5b6dfd9d-83c2-4c95-82de-b901437825d7", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630152029, "uuid": "48439665-b26b-4030-8212-b1bcd3de327a", "value": "esM7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1ab4ac-084e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1630189261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630189261, "uuid": "e04caf56-7616-4d81-97a4-6066d8fe5abb", "comment": "Malware payload (Amadey)", "value": "1d20e7282d674a8d160ac5096798ba9a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630189261, "uuid": "5b116ec5-d2af-43f8-9778-2388e0f6b5fa", "comment": "Malware payload (Amadey)", "value": "f500c5f2ef41c296869cef7d33ddb90449f8ebe703e7da2fc47726c7232ad10f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630189261, "uuid": "cd44075a-89b1-4d4a-84de-05622a1b8eca", "comment": "Malware payload (Amadey)", "value": "414468a3216442f186955693ce8c3aea984054bb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630189261, "uuid": "20b33679-ef95-4fe8-bec2-71b48d3c593c", "comment": "Malware payload (Amadey)", "value": "e1ef1c39e0811a9d04f4160b2feea824cdb7c36113eaafd89f9faf3cedc930ca742401adb665b32cfecf6d39723e8273", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630189261, "uuid": "ae0efe01-f354-4dc0-884d-07c65b5f8512", "value": "T1D745333EDE4A4C5AF30216F61E72EE51DBE02BBB815591F0B54503069CC95B23AF3B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630189261, "uuid": "51869b70-7950-484f-9444-1f57a8f8c0c0", "value": "34b35df7c6acd4636c28f27c1695ce68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630189261, "uuid": "cb4dd920-c291-4d83-b26e-cd619d3852c9", "value": "24576:BjE1kzjE9h8pobNlRMW+xcGSapgRkQuB9yzA/FoB2v3yiIkEc7WQaWFWzSZS:povhlWt7SwfdoBmyiI9uzZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630189261, "uuid": "070f0a17-f9ec-42c8-96a6-48c3363a7fec", "value": 1263312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630189261, "uuid": "bd56b782-190a-4cab-a42b-35fad47b71dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630189261, "uuid": "4fc5114d-0db5-4a58-9bfa-c5eafb644b87", "value": "1D20E7282D674A8D160AC5096798BA9A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef6a2c1-079a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630111906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111906, "uuid": "c79fb944-5863-49c9-9340-ce6dee674e11", "comment": "Malware payload (Formbook)", "value": "b1412cb23b0b4cb873ce820ed5f36b70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111906, "uuid": "84570cc6-0659-438e-a6c3-138577db1a09", "comment": "Malware payload (Formbook)", "value": "f6b33a05fdc9dd3ea9d4e3f0082b6c54763286261316ec9880a444a0865c64d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111906, "uuid": "1cc5e3ce-2c0d-42f0-9922-3ca5f40a8a6c", "comment": "Malware payload (Formbook)", "value": "592b90dd4b43f1bd0e4c06c297e0b31bfb1297ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630111906, "uuid": "f03f10e4-88fa-4262-bd76-7abceb367d08", "comment": "Malware payload (Formbook)", "value": "1abbb80f10abfdd908d4ca0dd84e03b2f31ca041eeb7d213bd1acbc2540d4ee2d902bd6fb6037ec055de70ad71e3f038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630111906, "uuid": "5e2e9360-337b-4ea1-9ac7-01af2bc53a8e", "value": "T147159D8D8C8D91CDD51ED7C81AA3C6C4B31FD3BB3419693EB45FA2712997919EBA3800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630111906, "uuid": "e5797157-4618-485a-aea3-50962829c87a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630111906, "uuid": "8e1a49a9-d477-4e70-9d88-eca2ec6c827f", "value": "12288:AEfKvacp2l+38aYZDW5dAQAMg9+Iyok7dDiw8bT7JKR2cmlDoDYGL:AsuZU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630111906, "uuid": "1a09f641-60fa-46eb-a4d7-911c50942cc2", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630111906, "uuid": "52282b92-c92e-4086-8049-c5f5e1060bf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630111906, "uuid": "76edbacd-5680-4786-b972-04eb2c2d18c8", "value": "Technical Specifications.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06be18b5-07c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630132052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132052, "uuid": "84a9763b-ed3f-4c90-afb3-3f56a522fc58", "comment": "Malware payload (AgentTesla)", "value": "c30e25a431491a7858938d01fab63773", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132052, "uuid": "c9f0c61b-898b-4287-8c91-28b914eeaf9a", "comment": "Malware payload (AgentTesla)", "value": "f7e05ec3e33c04e232b986c6c907b51369ca145a3cc262916c40c66504871484", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132052, "uuid": "69dbad14-0156-4f49-97e6-9e506f9669fe", "comment": "Malware payload (AgentTesla)", "value": "ed6741c9e1380ce821117a30e2d280b421026052", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630132052, "uuid": "53b22b38-faa8-40a1-9bd4-a84e053ca17e", "comment": "Malware payload (AgentTesla)", "value": "1a8ef2ef9d4c3ac53143af0cfefa191449787aaff4004269deb627e2754933b555df6816cd9ac50f84944ea715ffebb6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132052, "uuid": "cb5b7cfb-8676-43c7-af5e-2d339b4df12a", "value": "T10655D93DAD252533E7BA82F8C4860D4EE69415CB22334DDF42D2A7893117A57B6FA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132052, "uuid": "d91d8e17-46c8-4e35-832d-25ebb50a0c4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132052, "uuid": "c0deda1e-454c-4be7-b76f-816602bbef17", "value": "12288:Xj0bK4HtLGEUBXeu0BU5SisIid0kph+QrA2r79gEflEGD/XnyP112PdsfLosmoyI:XjzpLD0v2oso2vwS5DU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630132052, "uuid": "6ca0b7aa-21c0-4381-b88d-01863c9a2e7e", "value": 1372160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630132052, "uuid": "e8be4885-2c28-4cda-9a69-13373dd0f12e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630132052, "uuid": "a631d19b-e719-4b7a-bbe5-3186a43a78cb", "value": "c30e25a431491a7858938d01fab63773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8949f8-07cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630134989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630134989, "uuid": "d298e4f4-5bec-4666-844d-a077654d5c9e", "comment": "Malware payload (DanaBot)", "value": "3841f9b923313da09a706c8ceadd9481", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630134989, "uuid": "2b9adc6e-e395-4c9a-a67f-1de75f301df1", "comment": "Malware payload (DanaBot)", "value": "f834475837169f8c9eb215aeb91ea8b5ea6049504f7bc981d283529902edcee2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630134989, "uuid": "38b3e400-1b98-46ef-b9f4-a741efbe7de5", "comment": "Malware payload (DanaBot)", "value": "25c364b17547ca502e0372c530a3d45124c95c39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630134989, "uuid": "3aeae44d-91e9-4d58-bc9a-eb57ca8bd48e", "comment": "Malware payload (DanaBot)", "value": "b4e657016d70c4b48caddf3cf1b68689f1a1d50114c3fdc91baf849198cd24605d323cb2c1df4f7f14160ff3db0e51fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630134989, "uuid": "15dae5d0-cc6a-458f-a177-d2711d0e5cfa", "value": "T1AB353387B6BD6532F2661C7079328B638EAF3DC18970D71BA611AD1F722225253523F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630134989, "uuid": "5b978581-c4e4-4631-9e5b-0e15d3704242", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630134989, "uuid": "51859dc4-6240-4dc5-a098-d7e6225f0782", "value": "24576:zLgl1ZuW1W/wmoyKmqaPtms/3MOuUHJExnMKKYTTzGxtv:PO1ZXMImo9YPtm8fjpEQqotv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630134989, "uuid": "98e87c6e-f848-49d1-83d7-d64f6dd7d42c", "value": 1157452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630134989, "uuid": "972d3fa4-02bb-46e3-87cc-eede731ae966", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630134989, "uuid": "e25c008f-2b9e-4fa8-8704-36c55df4ebf6", "value": "3841f9b923313da09a706c8ceadd9481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f98ce3-07ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155317, "uuid": "8546db92-540c-40dd-9efa-d18cb41f5439", "comment": "Malware payload (Mirai)", "value": "d88db92b162134bd92e324a5e86a31b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155317, "uuid": "561e6d46-eddb-4cdd-8279-49b92beea92d", "comment": "Malware payload (Mirai)", "value": "faaf62ac7af80832c5329d94c7f35d258e88a9ff68700678a01a0052123d05dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155317, "uuid": "f6c74483-b883-42ff-ade5-766c9c5a56bf", "comment": "Malware payload (Mirai)", "value": "5796441e3bad34061960315c64efaecdf63eff71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155317, "uuid": "04d25eb8-7eee-4a9d-ab77-9651ffd6b38e", "comment": "Malware payload (Mirai)", "value": "1eccaedb933e8a9821dbeb333d28ba25a87ff7e0e669b18369386ecc84014031d979527e6c67fb310be78d829fcff861", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155317, "uuid": "b7e27e74-a211-481f-9f86-31c8cd6476f7", "value": "T119C2E182D0634C81FF6AAC313634CBC5E7B12EDDA763CC9671C087B6106B576634649D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155317, "uuid": "72d7ab79-2438-4791-b712-95d4e958ee51", "value": "384:np129Bvnk/Sc20bQUgOS/ETvMozxjaMcUsGoSQwSyjS0mUS6T09eDM4uVcqgw05F:7Ovk/aUhzxUFP0mUS6qeA4uVcqgw09p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155317, "uuid": "34928260-df3c-4c30-ad55-01f4401c00a9", "value": 26348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155317, "uuid": "5ad86211-77e6-4c9e-aca9-3b049d812a5c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155317, "uuid": "9db22ef9-b6b0-477e-9190-38357b21b32c", "value": "d88db92b162134bd92e324a5e86a31b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b56d2b-0851-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630190730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630190730, "uuid": "a5de0844-683f-4d07-ae54-d4ba761282ab", "comment": "Malware payload (RaccoonStealer)", "value": "4c3962a1940c243d51f5f9375f7a4f65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630190730, "uuid": "13ad33b6-2e81-49bc-b5b0-9e5dbbacc110", "comment": "Malware payload (RaccoonStealer)", "value": "fb18bdd49cc7281ade03682763ad56976380e0bf891c7e89937ed12c13d310f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630190730, "uuid": "905dcd21-4270-4268-bf6e-c30f06442354", "comment": "Malware payload (RaccoonStealer)", "value": "e171f77a4aa829d3124ee026761e5f2316a1355e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630190730, "uuid": "b49be551-84e7-4d44-a75c-2426cc4659e6", "comment": "Malware payload (RaccoonStealer)", "value": "03ce208097b259fe50495c48e0be6b3e689834b0bf7f20c983010db58ec4b2392e5adda2aeebf9a7e6f85b316211b202", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630190730, "uuid": "f16463a1-3d6b-4168-b529-1af2e17a663d", "value": "T17DB40249EA0C1077FD9114302696AA9F597C1FB2627DB0ABB44DBE4811B3FE2C716F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630190730, "uuid": "cb397603-e992-4d3d-8d60-6201d7699edc", "value": "7e4a49baed74fc5fdf2cc2a93738ac6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630190730, "uuid": "29434478-b9bf-4083-936a-93f12a5373d8", "value": "12288:2UTltqYZIojZhMoYg3WDkYCdcxipRFwi7XciEwaolaAj5sxr5yRR1jnipF7aR:2U5yojac4U6GR17g0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630190730, "uuid": "4447db5a-b8da-4153-bd2a-9f68d00c798a", "value": 538944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630190730, "uuid": "2df7abad-b2bd-4051-8d59-563b785acff5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630190730, "uuid": "6ace7a30-2ace-4e2a-8dfb-3feba6a09b9b", "value": "4C3962A1940C243D51F5F9375F7A4F65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e9db83-0833-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630177576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630177576, "uuid": "d9f2a6de-2872-409e-ae97-840c4b863345", "comment": "Malware payload", "value": "35c23cffccd7d1779c4f0cc47a6079f9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630177576, "uuid": "c173ceab-fcad-4e65-aea2-33b2bd942435", "comment": "Malware payload", "value": "fddc3e3ddcd17b6ad5636078780a3840dc92aba05b0f9ec6060ef192cb1100cb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630177576, "uuid": "9ade624a-6640-461c-a48e-5abf545571c7", "comment": "Malware payload", "value": "358486e9acd44746f90b69de0f9b365f65af2aeb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630177576, "uuid": "06d7ada5-ce3a-4a77-af30-85453a6dcf29", "comment": "Malware payload", "value": "e95c5ae9c2cf5cb831f70ab5259ab67356e2880341cf2584ef373449fa4b8d5eb7f430a9ecbada319db97804da9471ee", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630177576, "uuid": "c0d2a3e3-7093-4ea0-9378-4e507344f702", "value": "T1C5F5334A9B435D4EC6A780F7518325E3FF36316C57C2A9BE0A7400671CAB9A0CF15DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630177576, "uuid": "313679c3-8b5a-4185-9e55-f13e65c81002", "value": "49152:Kn4NERf0O9oBHgmG7VDBvEgC+m3YIq2I/j3SkEKjkJL7sst69AT7/HaKRt8C6c:8Rf0ioHG7VBcPET73SkEKQJL7m8aaOJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630177576, "uuid": "d52c642f-a137-481f-a109-dbbc6bf0d5da", "value": 3360346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630177576, "uuid": "82d15bd4-afbf-4db2-b695-7b6df655a3d5", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630177576, "uuid": "4ce3daab-09f9-469c-9a42-65765514056b", "value": "Yerli_Gizli_Cekim_Ifsa_VIdeolar.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750624bc-07f2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630149846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149846, "uuid": "cc16ea64-ebd4-4f29-8ed4-100759a91231", "comment": "Malware payload (Mirai)", "value": "4596285c928d957b9598894420ff53e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149846, "uuid": "2f154f25-9343-48f8-bdd8-bb9413643bd1", "comment": "Malware payload (Mirai)", "value": "ff4b124e914841354e282022e0289919574901fc0eaac6b45960ee0afd928bf8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149846, "uuid": "6147a1df-f48b-46ff-854a-7e044df17f66", "comment": "Malware payload (Mirai)", "value": "caa1851ca58b910174066d133c83f88f464725e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630149846, "uuid": "24de71e5-f715-4e5e-89ee-4ad6e3ad9682", "comment": "Malware payload (Mirai)", "value": "5ba814e76292bf42903f3b46a927a88f3667767efebb9dcf98deba1cd35cbb65238dbd23ebebf926185ca8e879dc476e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630149846, "uuid": "d182e569-afcc-4381-a21e-1b47232296d2", "value": "T1DEB2D01DC0AE3E74FE9B79795941E2817B619BDF3E628EC01AC15B110622D281F986E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630149846, "uuid": "47034b2d-4458-451d-9a76-9bd6507392b4", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIolgM4uVcqgw05Vxs:2AApCdvwJr69VJoA8FZtxCo8E4uVcqg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630149846, "uuid": "7365183b-780b-42fa-8f78-299986af70dd", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630149846, "uuid": "32e79acd-cce2-4ed2-9cdd-a59e1439dd19", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630149846, "uuid": "e4b84741-b910-4b64-940f-91d6365ea7d9", "value": "4596285c928d957b9598894420ff53e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec7088f-07fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630155017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155017, "uuid": "49ab5d27-b965-432e-a306-15fc0ad80393", "comment": "Malware payload (Mirai)", "value": "df3e028ca6bdc01011a83f4bc35877cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155017, "uuid": "4907828e-c828-4f9e-a867-581fa5a8602e", "comment": "Malware payload (Mirai)", "value": "ff4d35de5d88a015721f84d9869a33eb66c9e846d64026c4eecc96d50f7c36fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155017, "uuid": "ffd3b551-6144-4200-8a39-08212efdeb4c", "comment": "Malware payload (Mirai)", "value": "c729aee04d23fac5dec2134fc7975447f1482f3c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630155017, "uuid": "572e087e-aa0b-4739-b39c-7ef1bcf828e1", "comment": "Malware payload (Mirai)", "value": "e76ac964eb90c92dad900164a569290a456b31835d3537730f76d6cd2fa5b1b73ff077f93320cdaac5e8441e5b8fe160", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155017, "uuid": "16c5c6e6-f2a4-43a6-b011-6a1615b8b820", "value": "T179C2D0701B857B21C17008318C68C6866E2337B8D1BD78EB25780ADCA0DFA4F697DAC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155017, "uuid": "c0c3e02d-22db-4885-b9e9-5b465429cd3d", "value": "768:oQaaX8dMsZUIj84/11d5PKBEVXjvI4MSxQs3UozbE:oQaaXP+Fj7t1KmFwSTzbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630155017, "uuid": "16bbcc21-8e37-47b6-bae3-66edbb76582f", "value": 27928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630155017, "uuid": "abdb4229-bd37-49d2-a782-cc9e07ef1f74", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630155017, "uuid": "bee39688-0bff-440f-933d-319a0aeb666f", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5a67ce-082c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630174580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174580, "uuid": "cfb32796-7ce8-4ef2-b479-7d3320821158", "comment": "Malware payload (AsyncRAT)", "value": "b6e3e2ab3e50a1f33e9e48d95c12017d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "https://urlhaus.abuse.ch/host/skyrosgreekmeze.com.au/", "colour": "#533EF9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174580, "uuid": "ddcb799a-06ec-47c1-8157-a2be412c00bc", "comment": "Malware payload (AsyncRAT)", "value": "ffceaf4ca7eb63d67ded5b7b4a32d5c68d8424bc889d4d4b9b9db8637e209309", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "https://urlhaus.abuse.ch/host/skyrosgreekmeze.com.au/", "colour": "#533EF9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174580, "uuid": "7ef8f12f-da8d-4b43-b7d4-284afe354bbe", "comment": "Malware payload (AsyncRAT)", "value": "ce80b9486c0d2cfa5ebb6fa90bbf55a55384a7d2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "https://urlhaus.abuse.ch/host/skyrosgreekmeze.com.au/", "colour": "#533EF9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630174580, "uuid": "a985cd1b-b4dd-4baa-bdc4-229dd8a5650d", "comment": "Malware payload (AsyncRAT)", "value": "34bee3827551f7c542ec11f2bf4fec2315361f55ae88fe5e33da27a2fedce79442ae11862b72023e114dbd651188114f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "https://urlhaus.abuse.ch/host/skyrosgreekmeze.com.au/", "colour": "#533EF9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174580, "uuid": "e4e1bc65-d662-474e-a62e-e5349ff16375", "value": "T102019946D59E718AA3D0D9DF45B89818EC12BB542709747C20AA170F441A65603AFDEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174580, "uuid": "d0526731-6e33-47f1-920e-7d9c3d2c8935", "value": "12:TZ6xvLhO3N/JfnJx2YK+/9+iM9+DOOyv24Bh9+vM7ITkSSsa/eLO4:gO3N/lJx3hMpOSDha9TPSsa/j4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630174580, "uuid": "eb4c011e-1815-497c-8c91-5a1913c8e45e", "value": 672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630174580, "uuid": "834acda8-015c-4131-8a6c-57869ae79be9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630174580, "uuid": "2b78145d-56cb-4d1a-811a-ac558312fc2d", "value": "QUE34.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3858b3-085a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GCleaner)", "timestamp": 1630194343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194343, "uuid": "24ecc83c-5254-450e-8627-d7e9cc784d37", "comment": "Malware payload (GCleaner)", "value": "15960617507a6b7f52a8f92ba2759502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194343, "uuid": "fda14992-6ef0-4e72-bd59-85de69f4d611", "comment": "Malware payload (GCleaner)", "value": "fff25302774366cdb466fa0e4015f9c7de93fd0192585a3cab2e2f51b635047c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194343, "uuid": "55fab360-ed88-41fa-bb21-61ee09767e6f", "comment": "Malware payload (GCleaner)", "value": "3b6fbf7ab017d7aebc3ff3d931cf8aadc4053f7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630194343, "uuid": "5aba611f-179f-421f-abdf-834c82e4fb17", "comment": "Malware payload (GCleaner)", "value": "55149748983404e4e92cff8e61aef6d0aca407c94b3912b0dcae7310bcdb63d422c8038aa5925946de5d54b1179fa25a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194343, "uuid": "daa92bc2-467d-4d6d-aa96-095bf479b2e3", "value": "T1D3963311BA4078B1E1A37D3205B76DAC76BC6D2416F142AFB3D40B12DE72C92E7365A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194343, "uuid": "a3187b42-f9cb-4f90-b762-9d527ba87930", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194343, "uuid": "604feb9d-1556-463a-8f2a-4c1b5129446a", "value": "196608:PZ2HpzdxHr9mT5kszFw1d4zZkxaZzDaC0b8LP3gt8QmKVURWw/RhXE5w:YB59E5kszq4zZqwzD30biPwW144RhXEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630194343, "uuid": "6eb01fee-14fa-4b35-89a2-f2d4dfc46bcd", "value": 9401666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630194343, "uuid": "d452fa80-6190-4634-98c1-b9bc36d027cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630194343, "uuid": "4ece7612-857a-4a3b-9835-d44df2db6a7d", "value": "15960617507A6B7F52A8F92BA2759502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }