{ "Event": { "published": true, "date": "2023-06-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-06", "timestamp": 1686096181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "2be376c8-3476-4f03-b7d8-40322b61943b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f823149a-040f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017712, "uuid": "5c2e7a4c-0d91-4eb7-abd0-524be3bfb16c", "comment": "Malware payload (RedLineStealer)", "value": "1e0b935b30f7fe50c529c94a01b44bbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017712, "uuid": "34e24620-3735-40e8-bf3b-86332addfeff", "comment": "Malware payload (RedLineStealer)", "value": "0091ba4805deb91e122cb38c16cd208f047dde5b5ba591d8376367638fd3ecc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017712, "uuid": "fe58657f-3171-4cef-8be9-536a75448fd8", "comment": "Malware payload (RedLineStealer)", "value": "38bf030f66a9b2bec521f329453e8b6e782c4f41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017712, "uuid": "b3214ce7-6dbe-4f3a-83a2-44817a1ef26d", "comment": "Malware payload (RedLineStealer)", "value": "e1e427f3149707b84e6a20c99ef4834e6c4482bccadf603373a8a241a7125939b6ce2d16ce1fd130887225a0108009b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017712, "uuid": "a01005de-c642-4d10-916c-d9977be7b630", "value": "T186152353E6D48531D8F827B068F643D31E39BCE189B8835F3396A94EAC72454E5B132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017712, "uuid": "46ecab32-a7a7-41d8-a0cf-0ea80457aed0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017712, "uuid": "8936145e-6403-4791-b46d-17a549b149f5", "value": "12288:0Mryy90gu1EquWO9bAyng9nlqlWZOhPuNzaJ+Tuk6qHpiSJ20MfY7C1doSfhGZx2:2yYEqE0smqlKqevLHpiSQNwCTtIUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017712, "uuid": "6a3515d6-30a5-452c-a156-7d1a3f011b82", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017712, "uuid": "52cb48d5-6290-4bc3-a059-8747618a7b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017712, "uuid": "b4fb904a-3a6f-4e29-9769-55bd3ccad5fa", "value": "1e0b935b30f7fe50c529c94a01b44bbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78b9a54-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036099, "uuid": "ce84a07f-7ee0-4747-b88d-b9d3148113bc", "comment": "Malware payload (Mirai)", "value": "0de9cb28e3ea54d16e3aba846319db42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036099, "uuid": "ef5baba7-5297-44f7-aca9-0a5572b428d9", "comment": "Malware payload (Mirai)", "value": "00e6f6e400afc35994f35ee84824b83e7769b8cd5e31cb829ed47629f231954c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036099, "uuid": "88bfaca1-46bd-46f1-ab62-0ebf9f7278c2", "comment": "Malware payload (Mirai)", "value": "b12db9c78c8f48d00c51c807fa69c197182dec36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036099, "uuid": "ea57d7b1-bbf9-442a-882e-593b3369ce6d", "comment": "Malware payload (Mirai)", "value": "a1206b847203c1cce0be394ebe5a0f0729fcefe748791d6e9df50c12d8942257050779ecec920e98e1862aca42519d5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036099, "uuid": "fce33bdc-aefe-436f-823f-b31d11bc45dc", "value": "T146A34A05D5418B63C1C3177AB69F86593B332BE897DB33126A247FB42BC279E0E39911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036099, "uuid": "0eb51f45-10cf-4ca8-ae91-49bf9a52a9f7", "value": "3072:xfux+fNq1aFlMD6lr2IIcM4sQ+mUQOT9XYMn:xfuxh1aw6lrMQ+mUQOThYMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036099, "uuid": "827826bd-7158-4d38-8e2f-3a191d2d1a41", "value": 106261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036099, "uuid": "3efe6f7f-e24d-44da-bf11-60cdcff99642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036099, "uuid": "69188158-f63e-40f3-a4cc-558ae51652c6", "value": "0de9cb28e3ea54d16e3aba846319db42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bbb5a3-046c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686057631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057631, "uuid": "be20b755-f84d-4425-b1c8-5b005f3f2f78", "comment": "Malware payload (RedLineStealer)", "value": "499d55cc63357dad9aebaf6a4b517527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057631, "uuid": "bddf581b-6db6-4286-b1fe-5e5d4c813cb2", "comment": "Malware payload (RedLineStealer)", "value": "00fc3bba8814fea6dd4c9b78ae51876f5e6a213ca7919451253008330160aba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057631, "uuid": "2b2a9fb0-aef7-4597-876c-6e20d0303356", "comment": "Malware payload (RedLineStealer)", "value": "0a870f2eb8a6346153af2109154bc3e2ecfb56ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057631, "uuid": "30a566b1-38a1-45d2-84ad-53ed62ee822b", "comment": "Malware payload (RedLineStealer)", "value": "7511fdf929347d49963054e0303d6e0c364015640b9bf847dec09aff99a3aa1b30bc2b1672c77121b4a65552652f4cad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057631, "uuid": "1eadacb6-f78f-4f4c-90c4-1e41301a8ddf", "value": "T1E9747D0392A17D65E5265F3A8E2FC2FC771EF6518E597B692218AE2F04B01B3C1B3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057631, "uuid": "9cb36069-a76a-4c16-93ff-254b32a098ee", "value": "0af0c6e3fe2b48c822ae2dd664bde01d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057631, "uuid": "59830e29-fedd-4fff-8e4f-dbd95cbb3bf3", "value": "6144:JFQhseNl11nZTIazEg2koS6V3Sc8h0UhEaCM:JiSeNl1zFzEzZ8qUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686057631, "uuid": "c25f36b4-a5d5-4198-b638-cf01e65eeb3a", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686057631, "uuid": "dfe00faf-92c8-4c82-8d18-be63e7cdf1ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057631, "uuid": "4e859a2e-ebce-4200-885c-ec1744fc23b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830f7fe3-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686059177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059177, "uuid": "be542b02-0134-4d86-ab7b-e74163ede62b", "comment": "Malware payload (AgentTesla)", "value": "22e6578ef54c19ec28c2ddcfffa89a0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059177, "uuid": "0c62dc98-6e9b-4cca-afcd-71a9e7e1a775", "comment": "Malware payload (AgentTesla)", "value": "01547e612fc731951049a35ed50621ffaecd45d0b0946c98f4c3c90730a9dda4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059177, "uuid": "ed4eb4bf-e8a9-4cc9-a133-fac29d66c0a0", "comment": "Malware payload (AgentTesla)", "value": "3b8279c3d924f015c3119122e695bb35d401579c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059177, "uuid": "04765a34-7aee-4206-9768-7da26e69363b", "comment": "Malware payload (AgentTesla)", "value": "5c517be15c02409056a4608757583cd5f7c942d65d7ea7461bbd6ca331932f271e34bb12f9da58ecea18f49f56dde8e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059177, "uuid": "37a850a5-8e99-494d-b12d-723d98d87bc7", "value": "T182F423916793862FD0C707B980E03BB512AD8BD67D7BB7570D07A1F8AB0AF6D458031A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059177, "uuid": "11fa177c-cb02-4bd4-9bcd-3467ebb44020", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059177, "uuid": "389acc98-d9fe-45e8-b6be-092a19ce8aae", "value": "24576:vPLaVUH9993hzUAf5tyCI50DolCaBXoDp73wu:LBH9xzUA7yL6daBXc7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059177, "uuid": "c52501a0-fcd2-4ffc-9859-6866d3e1b38c", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059177, "uuid": "ece03a18-8fa7-40b5-87ac-c2959a0ea706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059177, "uuid": "0448e155-bbc3-4d92-9566-6cbdf5f65ef5", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b076b3-04bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686092119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686092119, "uuid": "44929a6a-6153-4f95-9f3c-9fd248f9c670", "comment": "Malware payload (njrat)", "value": "b8f8323ffe1e53ad1993f6f0fc91d38c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686092119, "uuid": "782e0a22-5e4c-4d23-a41c-b91afddf07ea", "comment": "Malware payload (njrat)", "value": "016404b6167e37de1d2ca10010bab8b33dd102eca84b6e49d62f28a082004732", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686092119, "uuid": "77684adb-a031-42f9-8702-191e4cd7a61c", "comment": "Malware payload (njrat)", "value": "2c9fc140de6f527fd62482428c89b3b8a9e0b2ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686092119, "uuid": "52eb779a-fc07-4a95-9fdd-4b3fa8e1df05", "comment": "Malware payload (njrat)", "value": "2a552d70dc76fb82eba211ab99a85c2ad025a9c15a9846ec77104a1c178df6f2d59d8999c86a33c117e74784156afaec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686092119, "uuid": "2afac029-976d-4ac4-93dd-6551fe0cca92", "value": "T15193D84977E52524E4BF56F79472F2004E34B44B1602E39E49F259EA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686092119, "uuid": "f46865c9-615d-4857-8dda-b7f0dcc51196", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686092119, "uuid": "4f564125-479b-4c45-bb9f-18a4bfbdc3f3", "value": "1536:Cl+C+xhUa9urgOBPmNvM4jEwzGi1dDdDkgS:ClIUa9urgOkdGi1dJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686092119, "uuid": "54c6d24a-0bfa-46c3-91c1-4010f7834320", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686092119, "uuid": "d6e45d35-2d4f-40b2-910f-5952bdbd1f97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686092119, "uuid": "fdb3da5f-52aa-4c98-b698-ce94dfd4d97a", "value": "b8f8323ffe1e53ad1993f6f0fc91d38c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cbfa8c-0417-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686021089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686021089, "uuid": "35d95673-4e17-4d32-8f31-e3821c7f1ccd", "comment": "Malware payload", "value": "b2c88bd4996019c79657fd08ffb5ee6a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686021089, "uuid": "5c3d7d74-e5a9-4d71-a33f-534153f7fb88", "comment": "Malware payload", "value": "01de197e92747283d00ac00ddf65e99f5013223f8a07d0425e325a730c3c8023", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686021089, "uuid": "84103801-14ac-49d9-b1f4-558a9aedf758", "comment": "Malware payload", "value": "31b47a06bdb8e43052169cf8f457147717a0ba82", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686021089, "uuid": "5daea1be-0cb2-41a6-9d9c-cad3807a0072", "comment": "Malware payload", "value": "fe4144c17065d32f1bc2c5bb89ee5e77e261ee7c0919913f9b921a25b18e90a8df067394fab3a11d15253d6f597a3aa9", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686021089, "uuid": "3b0ecf6f-8fe0-4662-b3fd-e089471c33fe", "value": "T1E8E63328D6688388F201C236EB3547B63219B55309D73D3DB992D16F18EC9E9EC724DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686021089, "uuid": "5025e887-02d3-40a0-bfa8-a3f02dbcd38e", "value": "196608:PYpvuwfEwQ3Z+2gb8FMJqSGMuPLGS/QtA9cR7+dPrBFYVqqXwel8jaHA/qd+p4QE:PYpv7fnQp+hbpGNcVqPwNAmHguYl/nfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686021089, "uuid": "db8cebfc-7c28-4ff1-a340-409abc9bdf51", "value": 14139877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686021089, "uuid": "00e1e19e-79b0-45fd-838a-a788ca4de1af", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686021089, "uuid": "c687a1fa-d4ba-482d-9f52-d97904bba708", "value": "Meta_Tool_Verifed.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60097ae-0440-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686038674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038674, "uuid": "add6b1cb-ba77-4104-98b9-f6e9db0ed58f", "comment": "Malware payload (Loki)", "value": "201bea96b35417eaa307e4e27f9ef6b1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038674, "uuid": "327d3c78-2940-449b-a927-726ebcc3eb2b", "comment": "Malware payload (Loki)", "value": "02919eb98aac0c297956add4d27d7a77ec585e9b8b5476d305c13be09dab1984", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038674, "uuid": "d53e7018-3feb-4164-81ea-21bb63d9ee49", "comment": "Malware payload (Loki)", "value": "8b9e26358b2669bb78b1e6cf5bf5418c6552cc0b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038674, "uuid": "64f23d63-2dd3-4c42-ba47-81725481ded3", "comment": "Malware payload (Loki)", "value": "63ec7c99de9bffd337dddb23eca4aae770104f5d3208762340740890c161a13102ce995162f31edd25fb5cbbc2301e8e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038674, "uuid": "a2319221-f323-4587-b257-245d3cf33b3c", "value": "T1C5B423DEB3CC3177CE922A3CAB33B53C17E8534CC47686A898656AE3719230594EF495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038674, "uuid": "d8812b05-0236-4675-968f-47019e5d8a11", "value": "12288:LCL/T8SjsvpHfO666L3qX+DfNI5xrUG6UgZMBckuer:+vLsvlm0zN+gZMSDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686038674, "uuid": "d6c8ea03-2348-4c17-bd3a-36530754639b", "value": 542188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686038674, "uuid": "0654c04a-add2-401f-a218-bbc44f599285", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038674, "uuid": "66d07b15-4fae-411c-a1d2-70df11e98df1", "value": "-BL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865cd90a-0437-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686034701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686034701, "uuid": "64d20316-0226-476e-ad86-27bb9e6c57b4", "comment": "Malware payload (Mirai)", "value": "fba8745e011e46a8e27d200eed88be61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686034701, "uuid": "edac325a-d9cd-4763-8928-f30f536823cf", "comment": "Malware payload (Mirai)", "value": "02faa418e46a1cbc3bf5c0901396752a1032522e2c3a11b173f9aa6968a06b61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686034701, "uuid": "b8231dad-9aea-407f-9608-5a9358cdf4b2", "comment": "Malware payload (Mirai)", "value": "69cc69921584219f0391a55dd529c390b48a0d36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686034701, "uuid": "5962bfca-5bad-4d5f-bdfb-440dc4bd56f6", "comment": "Malware payload (Mirai)", "value": "4f367a4990032dbab44a8f0ae2d63a17cbcdcc7c0fc918794ca9363874d30edcd9d1ad88360fc05f610e25a32d391374", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686034701, "uuid": "e160ee41-baaf-481d-9d93-d8d0c8a10668", "value": "T1B6334AC4AA97ECF5EC1506753073EB338777F03B611ADACBC3999523A881A41D50B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686034701, "uuid": "bd73d0a3-691c-463f-8f69-bc86db0101b7", "value": "1536:Z8MgMbNgZpAu+h9afOs+ORXZhg/2NvC4ObwkZw6PBw4:azMbKZpADh9U+ORJhg+xC4sfJZw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686034701, "uuid": "72f75733-e55c-4108-8ad6-50b03fe6acda", "value": 54288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686034701, "uuid": "f7da1474-a3d3-404b-8b1d-cc19623c8558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686034701, "uuid": "909e62f0-fe1f-4306-a4d6-5fdca445a97d", "value": "Astro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff32e10-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686090284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090284, "uuid": "30754bd2-6936-4a00-bd47-46a245b2000e", "comment": "Malware payload (Mirai)", "value": "dc6fde3a9e122bea5ac92689476a248b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090284, "uuid": "d17e023e-bf2e-4c8b-9d5e-41c14555c9b2", "comment": "Malware payload (Mirai)", "value": "0339c49250acca4249a8bbe1842aada4609b8a81257abcc7f83ea6050570c3bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090284, "uuid": "3fee479e-e773-4c16-a2ec-0cfd0ecd69d6", "comment": "Malware payload (Mirai)", "value": "069c3583fa73f840d176fba156c22aa7061f143b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090284, "uuid": "c463015d-8ada-4d43-9d5b-e7906235e9ee", "comment": "Malware payload (Mirai)", "value": "c92f311cf860b0061eb140cbde37d8b5d018cd7fcfb7ef0cd15ea496776fd3e17d795ca6d1bd8dee84f9402754124de5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090284, "uuid": "1bda71d5-f6b7-4e96-8cb5-95f79dbc6cc4", "value": "T16BA2D029D345AEF4DFAF9D9097C1C2C276E543C7274AC8E240FEAF01351A046B789D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090284, "uuid": "7b31a3a4-61d5-4887-ba58-6d47b65a1474", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C593M4uVcqgw05VxJAw:9RxsSVsMD6xiJJE5zRWNfc4uVcqgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686090284, "uuid": "8b042227-631a-4c2d-b981-6c5edbfe8e64", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686090284, "uuid": "9e413bf1-e910-4e0a-8756-36d6ecf287b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090284, "uuid": "abb16bca-3694-47ac-a917-6673cb803f77", "value": "dc6fde3a9e122bea5ac92689476a248b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e290dd27-043f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686038292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038292, "uuid": "f845864b-27c9-4232-b736-d7a27fe07469", "comment": "Malware payload", "value": "981426401882e5c4f71d3cc27e9f1af8", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038292, "uuid": "1b633327-a0df-4336-a793-962e140f7232", "comment": "Malware payload", "value": "039ecc7e34978fb6b2a763989aeccf4560e44606edfee7f8edc383d8e9976ff9", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038292, "uuid": "8678faa7-c61d-4ed9-8152-df401a16f3d3", "comment": "Malware payload", "value": "3fe81dc04fc37b57c621055989d7d9db10f3fd83", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038292, "uuid": "294d4a45-68f2-47b1-92c2-f0a9c8cc8a31", "comment": "Malware payload", "value": "4988a0583aa5017b3cc43c0fcd742c703b46b354712d77170ec3631dcdce9ec17a05aa123ce881f664f67f66eeb50a0e", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038292, "uuid": "4915cff6-9f96-4328-8769-0a83e81601ee", "value": "T1F7D42394A0DCEAC189F13628560AA21CE4DD0CD7DE4DF5DBE368CA48F21741F66C92D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038292, "uuid": "182515d1-ed76-4f3a-8e76-58e0a0ece713", "value": "12288:sp+EI0fo2RUoV88wAMahlwR/3MKgHOWfJRnm/48K9jM7b3g6UCAFzO:M+ERRUoV1wRR63RnmTOMfQQAzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686038292, "uuid": "94c2b2a8-18c9-4a4a-8675-2623cb8517a9", "value": 631043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686038292, "uuid": "06e472d0-3f73-4334-8488-f4b4a9989a38", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038292, "uuid": "1dab1962-16bd-4dd3-91bc-3a6a3b569bad", "value": "quotation.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff4d4d8-044d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686044247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044247, "uuid": "e542f4bc-23fa-4ef9-b8b0-3b095ca4914d", "comment": "Malware payload (GuLoader)", "value": "7339f323191432260e5a33cfd681adec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044247, "uuid": "44f37a9a-dea5-4252-9c30-658045906a76", "comment": "Malware payload (GuLoader)", "value": "03c1a90911d6860dc5c60861688bc5c16ea549cad3032aede84bc394d300018c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044247, "uuid": "cc0b23da-4407-4162-b9ea-aee97735ec8e", "comment": "Malware payload (GuLoader)", "value": "0438f96068fb4f0ab0ec4089a225785b88585c2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044247, "uuid": "579f9809-844a-482c-b7cf-e842b79127c9", "comment": "Malware payload (GuLoader)", "value": "31d9704bce1befe88606573ba4d1eb02139021750189ecff0333443aeea34bf8e6c7c1c3f3b57f762b8ef16e2085a72d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044247, "uuid": "83ef3f7c-8f25-46bf-8253-98693aa80675", "value": "T1F734126200E284FBE42643F54E7677B9F3B0EF1D0AA1564F5B506BBB99112C0C96E90E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044247, "uuid": "808f613c-b46f-4755-909f-c3bec9bbc5cd", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044247, "uuid": "67c7e66a-1cba-48d1-8a63-adb5efd74954", "value": "6144:t6dN2GppeQjMB57ntD4n2J2obmBPoVscYvAKdu:I2GpXjklnun2JGxoVs35c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686044247, "uuid": "fc1d45a3-3d37-49d2-8a65-68d7ed80fc79", "value": 246072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686044247, "uuid": "6a2113c6-fd13-4d6b-94a9-1440ca3ac24b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044247, "uuid": "f5643bda-aa87-4160-9c99-a40854d0d8c2", "value": "7339f323191432260e5a33cfd681adec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b1891c-0485-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686068365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068365, "uuid": "2c4cf6fe-6eb4-48a6-ae27-b7d12fd464df", "comment": "Malware payload (DCRat)", "value": "65b404da28a5710395d490a148ea6435", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068365, "uuid": "a74227ce-249f-47f6-9fdd-d9748466117b", "comment": "Malware payload (DCRat)", "value": "0471994d95609f0e7fcb0b98e9845f8e85890b186b26b12797ed28af0e30b185", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068365, "uuid": "58c2a81a-a543-4b29-818e-fc02e127e10f", "comment": "Malware payload (DCRat)", "value": "b4fce3330eae94ca5e6325e04ba0009c94d53281", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068365, "uuid": "edb80fa3-827d-4d77-9e62-6ec2329a8ca6", "comment": "Malware payload (DCRat)", "value": "94af936e3da8f1a73d26f049c3a61a1e19757b10bfeaaac290cd2b197e26bae1a99aa6209ba02465ef214a5adf29885d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686068365, "uuid": "2183c4fa-5f9c-4a94-aacf-ecc4d4cb70fd", "value": "T199235D0037D8C136E7BD4BB5A8F3A2058279D66B5E03D6596CC810EB1B13BC696136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686068365, "uuid": "fdade8b6-3120-4f2c-a05d-5aa0b4f71365", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686068365, "uuid": "b2592c1a-c864-4793-80d2-aa9953d4e787", "value": "768:Eq+s3pUtDILNCCa+DiPF/ah+diRi++98YbngetD6wo4UivEgK/JDZVc6KN:Eq+AGtQOpqXx+9zbgYD9nkJDZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686068365, "uuid": "331ab61b-dd02-475b-88d9-111bcc32ed01", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686068365, "uuid": "f93dec44-b73f-4273-9d48-6856a32ab032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686068365, "uuid": "5a90c4b1-fb9d-41b9-b7f5-e20d1a1da950", "value": "xxDvgvC16bB8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c36909c-0464-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686053931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053931, "uuid": "0a464170-363b-4123-810c-9c965c12d3b9", "comment": "Malware payload (AgentTesla)", "value": "a4ed5c7f4a7aa30478d3427447411c9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053931, "uuid": "af694f6d-3eb7-4c18-a031-99e42735d42a", "comment": "Malware payload (AgentTesla)", "value": "050a63a55d933996cfd7898320adfa74620a75175aef8cb32f302d827f780949", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053931, "uuid": "1644d74e-0023-45b2-8d99-fd43918bdb9b", "comment": "Malware payload (AgentTesla)", "value": "0313791c04b631fe6d707ef31aba949021e35077", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053931, "uuid": "dbc014b2-adbe-4537-b866-bf69e565824f", "comment": "Malware payload (AgentTesla)", "value": "5e00bebea73f57588c0588d481fc85ece47d99f6987a7bf56b6df5312bea21bc27f87723b484a2d32401cfaf4900ab81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053931, "uuid": "74528611-4e9f-42a7-a1bb-cb1e3b88d8bb", "value": "T117D42364FB24DD818C1AD4822BBE3D5837D7E78B61E30B3C66A55C8E01463C6E55BACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053931, "uuid": "b1b38dc7-34ec-4a9e-9b3c-dbe35e6ee9b1", "value": "12288:t1U8diYiXusVZjpowBfcZiR1yzenDG6AjwnbMx5R7AjbvT0jHqAI:tfdPiXuSVlUZiuenDvtbiXGb70bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686053931, "uuid": "0317589b-85df-40d3-b257-373f740cfd00", "value": 641068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686053931, "uuid": "79009688-cd81-4234-a254-ba18b3381e3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053931, "uuid": "c69d5186-5d31-4c94-9c0c-b5454078bd2d", "value": "NEW ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019451e9-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017728, "uuid": "a11beb82-49cf-4a55-aca5-aeb7559146b1", "comment": "Malware payload (RedLineStealer)", "value": "506a742c26203eaac0d2764ee2c20747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017728, "uuid": "0760ad63-9dbd-4c0c-852a-a6fd6c90279f", "comment": "Malware payload (RedLineStealer)", "value": "052b9e82de3def6a314ca864592a8cb0d395d8b4e3968a28c6735a9b170c75c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017728, "uuid": "dd027021-80f2-4eac-8b40-63c135a8108f", "comment": "Malware payload (RedLineStealer)", "value": "b8d4d35b7478bda9ae3ec5d46cf1840d47bd42b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017728, "uuid": "81afca1b-84fa-46a6-ab26-8cb94c1791a2", "comment": "Malware payload (RedLineStealer)", "value": "b0e58af283a11a8d5fb4f171af7922eafe0391772e7758ed1fa4ac1aee7b2f8e11f4b859ab0aa7a550d732544414088b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017728, "uuid": "eecf2c1d-32db-4602-af49-815758e5cf5a", "value": "T111D412139AD86077D5B517B028F203971F36FCA68D78429B239AA88F1DF22C5643573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017728, "uuid": "c2b4e036-a869-4cd7-8af4-53dbb13027ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017728, "uuid": "674f8ffc-4620-4bc0-8360-a2efd963a7dd", "value": "12288:dMrmy908zOejeSIg+bETvL3hdQScusUYF1Vlla5Z5/u1rBbMMv+:by1OnSD+ATvLnVPYFvap/u1aMv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017728, "uuid": "184638ae-d0fb-4616-8859-76f17d8487e5", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017728, "uuid": "e3f5a00f-96ec-401d-b49d-528941d6c55b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017728, "uuid": "05827fcc-ce06-4eba-95ee-29b1fe6833c6", "value": "506a742c26203eaac0d2764ee2c20747.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf3af3f-03fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686009614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009614, "uuid": "4a1e56ae-3ce0-409a-b761-6c225310b262", "comment": "Malware payload (RedLineStealer)", "value": "28f3fac92e6bbdfe5b5b1d67edd5e8e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009614, "uuid": "e8537a65-b13f-49f9-a93d-6790626f9d8c", "comment": "Malware payload (RedLineStealer)", "value": "05571aecef6b95f015772df03a2954a765d5fbe3ecddd74d32d7519019ae8630", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009614, "uuid": "7ca40160-a94a-4c46-88dd-2d9de3f5c728", "comment": "Malware payload (RedLineStealer)", "value": "57127aad48a7314bda4134af5654cf298a8c4a57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009614, "uuid": "a4ef26ce-fd50-412c-865e-9ae8cf7729b6", "comment": "Malware payload (RedLineStealer)", "value": "aa9fa51e50b51b366339dd8c4a59d308c8819f58a16e602407f1a08bf87241c0a0eb3eb7f0f62d3530af843687344eb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009614, "uuid": "cca34927-b9d2-47e2-8170-b92e2650f185", "value": "T1B3D41243ABC94033E8746BB054FA07D317363CA05DB9835B6BDA999F1CB2590B43276A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009614, "uuid": "e167feb1-672c-4663-ad18-3f0879af6c4e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009614, "uuid": "2c2b4260-0adb-4c59-9343-7b0363282d21", "value": "12288:NMrUy90MhvMEG1mHEA5F/79MqgTDdKp2yVV27cXD/Tge6t:Nypy1yEAKqgwEybL/Tb6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686009614, "uuid": "c6f7ce8b-9fdb-419d-b393-50f4e36dc459", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686009614, "uuid": "381f48cf-acc0-4c1b-be8a-0941f8de400f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009614, "uuid": "540f7758-98a4-459b-bafc-f1c585be48e9", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2dc9350-04af-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686086369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686086369, "uuid": "e7c8e4f7-6e96-4ce7-8bdb-84d8f9c8d69f", "comment": "Malware payload", "value": "d1cb04472ae214817671bc3a2a423e71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686086369, "uuid": "e8dfe104-b3cd-4d7b-8870-72f3ebc43c09", "comment": "Malware payload", "value": "0579f4a7c8bdcc98420ea5e87b6d3f927b2f419824aa10c909d7539675b47d10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686086369, "uuid": "270aee8e-a326-4d38-a453-09a66273c24c", "comment": "Malware payload", "value": "080dd2b425935cbdbb9c608ae64f1250a30a6c75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686086369, "uuid": "f0b02227-18e0-48ad-8549-453f383c8ca3", "comment": "Malware payload", "value": "40c8c3fbf9b644b5cf36560785f510ea8f0520ddcfc3dc841368169cc235903af2a5ba0c3eed3a1d9323fc8310087020", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686086369, "uuid": "d0a965ae-8cc5-40b7-a618-e011c20db97a", "value": "T112334AC09783EDF5DD660570203BF7324A76F03A216DE9C7E79AA933F841A06924729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686086369, "uuid": "0641f0d9-e81f-43bc-9832-4eddcf507bf6", "value": "1536:BIU8cbkbqo/ArirSiicP5s2+zMJ51UX2QvuuUuKzx:mUZwbqo/AmrSiicyMJ/UXB2u1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686086369, "uuid": "5ebf2a08-0e31-44e9-9505-263565fc4723", "value": 54128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686086369, "uuid": "54e790b8-4dd4-4783-9068-21fb2f6384a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686086369, "uuid": "ea74ae1f-c300-44cb-b570-ed0282c0521d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7e1a14-046c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686057418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057418, "uuid": "55291b1d-ad9e-4816-87c6-d9800ef19aaa", "comment": "Malware payload (GuLoader)", "value": "906e39b64cb89e580693decf88ba7e69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057418, "uuid": "70f32e71-70ca-44ee-9472-ce5b5266b9eb", "comment": "Malware payload (GuLoader)", "value": "0582d6a276c3aebfa2f95c65824ec63645157fee9d3d9e06e22fd425fc76a438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057418, "uuid": "e015d756-1376-4322-8757-93d4c65156b7", "comment": "Malware payload (GuLoader)", "value": "20b8ff2f097b199ec4a978a67ba8c89235c269ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057418, "uuid": "17ca107a-4c7b-44a9-ad2d-d79afb301031", "comment": "Malware payload (GuLoader)", "value": "26e01bf35010b461fd9143cc1cfda5a3536873da8d76642bb063f0940c9383ab0d1d4b3d2d0200a378aa1920f2be751d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057418, "uuid": "45df3425-f4f4-4acc-a3f7-5fa686916c33", "value": "T189641227E3A0C193DD932B725DB72A368DF99A5050A1AF4307409CCAFD35A46A92F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057418, "uuid": "53d8b5e4-2eb4-4879-be90-7c1a2c3423c4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057418, "uuid": "a6600609-8638-4122-91bb-a9e713448544", "value": "6144:6mGIhaa9njjRsghoDGFgAmJNyGOwePHUXoo7P+K1m+eo/6u:9+a9jVDgGF0NyG/eP0hb+z+eS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686057418, "uuid": "e2f00d0b-2a2d-41a9-b934-48cc3ab599ef", "value": 325741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686057418, "uuid": "0dfbec3a-b5be-4f8b-a6b5-c5880ac6f849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057418, "uuid": "a4795384-d392-4042-aae6-349eece72786", "value": "Athermous.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d02286-0477-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686062314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686062314, "uuid": "50deabe4-a2d4-4b2c-acab-25071659356f", "comment": "Malware payload (AgentTesla)", "value": "030f244c41220560161eaef4d6b43422", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686062314, "uuid": "31f3e1e1-b01a-4952-80ea-89b54ec1b927", "comment": "Malware payload (AgentTesla)", "value": "058ae930b400f78299933d5ba985b41664127f94dda5297913be8904d531dc30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686062314, "uuid": "806d9872-0643-49e4-888f-1adba69e0de8", "comment": "Malware payload (AgentTesla)", "value": "c5ed34e31bb69121efa2b8c111af9b73239d0689", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686062314, "uuid": "c9acfbc6-3304-406a-9da4-349712da9669", "comment": "Malware payload (AgentTesla)", "value": "b53bfda7f44159253b6347512ddbbfba59020229d0a6cf0c80b8e971db55106a96cc60fb911f7d67b72b5391136f114a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686062314, "uuid": "48fb4b12-1176-426d-837d-7ef3d926c81f", "value": "T1359423B3C57042734D9EF01FC2A60CEAA8C0AF442DC7A32855F6DD78C4A6369A154EEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686062314, "uuid": "e1728b01-70c8-4b9a-8b59-7fa441f4cef3", "value": "12288:iyFaie9wSDwqL0+0KY3O3GIRDqjq2e8HyB:iyFI9wFqwLKYOFDqjq2egc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686062314, "uuid": "dd6ab9d2-e889-46d5-952d-2f48dfce0946", "value": 446412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686062314, "uuid": "f2b7f5b6-8e9f-4ca9-86aa-1e08f2af6ef9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686062314, "uuid": "2497f82e-511d-442e-866c-a7bf970eb1a6", "value": "Docs.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d6c1e6-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017757, "uuid": "5d9efc72-d1e5-484e-82b9-d6a43c76d4f4", "comment": "Malware payload (RedLineStealer)", "value": "e918c3e788ea50d8a445474cf24df6a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017757, "uuid": "1217c93c-2535-4521-9769-449a40160899", "comment": "Malware payload (RedLineStealer)", "value": "069ff3a81f6e320aefcec2b4d3bea4d4accb2c5efc0f7242f69e726fe7a6c67c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017757, "uuid": "253e70a6-cc51-4139-8d78-4947518f411a", "comment": "Malware payload (RedLineStealer)", "value": "87511142ea05cc980c38eaebeb873d203a6369b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017757, "uuid": "5f4bb015-79b2-4787-962d-5449e64cda24", "comment": "Malware payload (RedLineStealer)", "value": "ab60a8eb7e55665e4b00239aa5ce83a66558d8557a0090c0762fd96817a65162ec96ae437fef848fbfe93add9ab184d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017757, "uuid": "84e000aa-cdf8-4b97-8dac-bccce4326c52", "value": "T19DD4126377E9A122D9B01B30A8F607D30E353DB0997C435B77D1A94A6DB26C0A632337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017757, "uuid": "9cb4f113-d5da-4bc1-9109-72dd98ddafa4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017757, "uuid": "bdcaee04-ffca-42ae-add2-e19ba3df4bf4", "value": "12288:zMriy90b6W71TSYxzpANmBPurdJblbiVrNjuDLvpHFtz:NyUSYVpkmRurdRlbyNaHfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017757, "uuid": "d67af626-9277-4ebe-8bae-972b32d577d4", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017757, "uuid": "ac6b9d74-aa06-42bf-afd6-eb4b39b0849c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017757, "uuid": "dee6213e-e2a1-48e4-8077-809731ea9f20", "value": "e918c3e788ea50d8a445474cf24df6a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6983849e-04b5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1686088770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088770, "uuid": "3420a11a-d980-499e-ac46-3743b549e858", "comment": "Malware payload (Gozi)", "value": "be278775008a27bc991a461302080d98", "object_relation": "md5", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088770, "uuid": "060fe9f3-2bc7-4e9c-aa64-4e8be9008c02", "comment": "Malware payload (Gozi)", "value": "06b3f14f359d4286bf5323824f637e082e876b9c1de0002109ff23e336ff9062", "object_relation": "sha256", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088770, "uuid": "0429f9ba-5729-4e53-8e52-ce6f6f9ca8b9", "comment": "Malware payload (Gozi)", "value": "741c09198b5544330a9f31bc83c2d7b4bb3059ce", "object_relation": "sha1", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088770, "uuid": "0470cf10-fe4c-4854-ac5a-d8b79282f109", "comment": "Malware payload (Gozi)", "value": "0c9405fa84611a69d8fb9b7bf50bf9679af5b08ec58affaa9eca6bb2e84a92c31e09db05d23a556c80f5555224886d3d", "object_relation": "sha3-384", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088770, "uuid": "401ae205-349b-4f44-a3c3-4531ee31547a", "value": "T15B644B00F2C3B02AE8F711B9956A92382D197F60776791CB22C4EE6D697C6C36E30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088770, "uuid": "4592ea73-fb2f-4735-b3a0-12995f518ee3", "value": "8ab7e55c59f2d55cd0d51132c305b100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088770, "uuid": "fe7eb29d-6efc-4577-ae6a-f5777218e497", "value": "6144:xEqBRfInTf6orO1sypgkYKZqhoDCFV8u:xEqBRf6fyp5XZqhYCFV8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686088770, "uuid": "2a8e2693-c4fd-4682-8965-78c040b20b71", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686088770, "uuid": "04aaa7fc-f7a4-4857-821c-645bdacd2f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088770, "uuid": "632165bf-c009-4e0a-a659-8e2faab3acef", "value": "647fab34ad681.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621d448b-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686054397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054397, "uuid": "de38d7b8-15c5-42a7-95df-a2b31b617e61", "comment": "Malware payload", "value": "42675fbaed86a5c561977a14c9071fcb", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054397, "uuid": "4e569347-1bd0-45e6-abbf-7f2b96aae995", "comment": "Malware payload", "value": "0764e5b7148eb1fae000ee79779f575eab5889b30669314cfd7d5fe477d5879e", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054397, "uuid": "71060be0-fdbc-4344-b61c-fdec1ac815de", "comment": "Malware payload", "value": "7e8d25d1c5dd3b22c18c7c20b9072f4254f5559c", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054397, "uuid": "f607a0de-abed-47f9-89bf-e1a4749de782", "comment": "Malware payload", "value": "25490a6b50772d63f10da0fbf755d9b2c7cf241a7b4f8241d9c3397f6eaeb79d8536686c6bbf42b6c06336ef3356a1e6", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054397, "uuid": "f3570d6b-d0d0-4879-b0a3-781225eff923", "value": "T112A3E1EAA45881F6C3C8E9742B1C4C1FEA139EE776A12D91E51F17DD0032CB1AFE5494", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054397, "uuid": "c615e733-3356-4bec-854c-38b0bffc3448", "value": "1536:sr6pdgZo0A3PuJZo0A3PuIv8o2HIbD4TZV/yFaAzodrAZAkdZo0A3PukZo0A3PuT:K6pC6I6dd1E91yrKAZA86d6CcNe6W3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054397, "uuid": "d6ffbda9-568e-4f15-8012-76aeac4543ca", "value": 100134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054397, "uuid": "3b4b6b46-27a7-4a1f-a560-ed9d94a2b820", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054397, "uuid": "e608a18a-c746-41b3-98b1-03663a14cedb", "value": "shipping documents.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e2d959-0440-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686038695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038695, "uuid": "ea570733-3570-42c3-abeb-ebb90bb6c0f4", "comment": "Malware payload (Loki)", "value": "a58041a6de11c6d6b5ca70242bd1cd48", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038695, "uuid": "a339d23e-25e5-4903-af97-215c41fe4602", "comment": "Malware payload (Loki)", "value": "098b375757bbdec539dd924e40b691a5677a47a4f0d4dd6a9ed80e867623ba22", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038695, "uuid": "88ccf071-02f4-4ac0-a8d7-13828d13a8dd", "comment": "Malware payload (Loki)", "value": "0ab9dbe7320cd7dfca7e5621d88df8b435b850a1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038695, "uuid": "b33dc6f4-a829-4fd7-8808-3cf4d683cbf5", "comment": "Malware payload (Loki)", "value": "e25e2886895495a0021ee36b1e6b50d8308e2f0601844f95d7dc42a01fa944f91d5bc20f7e78f11faf38b96455e1aecd", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038695, "uuid": "50554ef0-ba03-4249-94b7-246be61f42ad", "value": "T19AB423DEB3CC3177CE922A3CAB33B53C17E8534CC47686A898656AE3719230594EF495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038695, "uuid": "b4b89fe4-b685-4668-8006-574a8face84d", "value": "12288:gCL/T8SjsvpHfO666L3qX+DfNI5xrUG6UgZMBckuey:jvLsvlm0zN+gZMSDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686038695, "uuid": "dcbdb645-4cff-4664-ab65-4d1c24804354", "value": 542230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686038695, "uuid": "39a37e22-a6b3-40bf-8bb2-f27ce281708c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038695, "uuid": "5b71c7af-1505-4e1a-9d70-c647c547263e", "value": "-Certificate of analysis.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346f000f-046b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1686056898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056898, "uuid": "1088bd9e-d630-4840-a085-30565e5a864b", "comment": "Malware payload (Rhadamanthys)", "value": "2681c3c6661adfc73bea10b2a0196ca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056898, "uuid": "108b2392-e935-4450-a706-e2453e55f3d3", "comment": "Malware payload (Rhadamanthys)", "value": "09ab57049567b5c2e403f0901b5a9bcc7eab0ea6ae466c315695474c951d590f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056898, "uuid": "8203e773-eef2-43a9-9535-8301759fc354", "comment": "Malware payload (Rhadamanthys)", "value": "9fb2687ad1e4341a946e455de92d92664f994a9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056898, "uuid": "4d7111d5-6fdd-4bdd-b030-63e8d8357da2", "comment": "Malware payload (Rhadamanthys)", "value": "f4720e76d486f22a74d01a43cd5e13a93055502f8a42cc5fc4878a4981ffec797913ccc816642cea7c7dce5046595d48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056898, "uuid": "d23309d3-a270-4403-9636-5164ba06549b", "value": "T12EA4BF1392E07C50E9254B329E1EC2F9B70DF5918F59BB662228AEEF04B00B1CB73755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056898, "uuid": "b24bf3e2-edca-4fa8-88f0-f74298c1a94c", "value": "619ae273df4887798e37a9eb4264a245", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056898, "uuid": "0c818b33-aa82-4453-a777-b37e3b93e8cd", "value": "12288:45yjZ2J9+/eIUTOZY7JV9Cy2hGGXc+R2hmOW:454gyeTOZ2JDdWvrRsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686056898, "uuid": "2e758984-9ade-4251-9749-b611372a3c7e", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686056898, "uuid": "4270f085-a742-4430-b228-a4bd2d09cf1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056898, "uuid": "727d5bb3-b382-4ec1-b2e3-fdc70393b13c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7d8872-0449-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686042555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042555, "uuid": "f4be6592-6354-4117-a25e-8554c91de00f", "comment": "Malware payload", "value": "a35ada71c8420a1271a13e9894e9ccc6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042555, "uuid": "e9a45e41-c1f1-46a0-95b1-a042ba8ca2a1", "comment": "Malware payload", "value": "09e8ff5ded5b178f4a795a93b97fd4528969dc76312f61d17b560f2c1b6c3813", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042555, "uuid": "f67afea4-6eec-45ba-9eec-a33fac5af3b1", "comment": "Malware payload", "value": "b3f8790cfc84a8fd4b7bedae9ed14a55569ca57a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042555, "uuid": "6a67a421-70b9-482b-94e8-1403c48ff725", "comment": "Malware payload", "value": "69405e55b7069f23f84dc95cb07c98ed2b445d2b0ad32352d9866ff969fef79d3e190a5134bf57b40301299f3c43210e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042555, "uuid": "d227d949-890f-493c-be0f-e2173a342cdc", "value": "T1DA650113F056AC6DDA86CB398F937485811F7E6B7ECE68851714332A7A336E2935234C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042555, "uuid": "43e17a45-fa14-4847-80e8-b046cff92abe", "value": "24576:3LKkuPqO05MsPsO05YSAKEJaOaeoyDewujVMz6hTywV:3LKrPqO0/PsO0SSA7oifml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686042555, "uuid": "f02f531e-a650-4c12-8a46-f65e0e3e18f2", "value": 1501184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686042555, "uuid": "a0e3614d-2a70-4e53-be94-930ad85208bb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042555, "uuid": "1973779c-f571-4ede-a11f-a5881a8e57c0", "value": "Rfq_8544_20230606_131956.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7a44f0-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686059250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059250, "uuid": "c4a61b90-3581-4c88-8fac-2ebe3f5d8eac", "comment": "Malware payload (RedLineStealer)", "value": "9081c1ece0e51858a918ec47f74b7198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059250, "uuid": "c75d2cba-29d3-48a7-834b-9bc1c6b61339", "comment": "Malware payload (RedLineStealer)", "value": "0a91d8f9615fa7d6a2bd35ccdf5a6f3a34791dd0427556f0cc3910df652ee7ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059250, "uuid": "20a239d3-1e8d-452c-945b-3cc01f817ad2", "comment": "Malware payload (RedLineStealer)", "value": "4e201ced2771a8bea880682aec4b512a6074bcdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059250, "uuid": "47a54fa7-e062-4122-9c6b-9f88ccffd7c4", "comment": "Malware payload (RedLineStealer)", "value": "09ff44dad18d6e115aefba95aaddeb35741ffb5e9a8df6ce92bd1b66d18805f741f28088b4e6e604a571d2651b13fbe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059250, "uuid": "1dd2d966-38e2-4809-abf6-20478de01bc3", "value": "T19064F02236918032F6679D7009A1CAB19B2BBCB15B7159CB2BD1577E0F723E2DE34312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059250, "uuid": "3399e4a6-fdeb-41c9-a373-79b99e757127", "value": "dcc3403437adbaa710d120d49b019308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059250, "uuid": "020a7899-6560-4955-8374-92771ddc65ce", "value": "6144:9Ggx+q0xUafzH7SxQm9CYIGfisqU1D4Nqfx:9Zz0xvU0YHfiL5Nqfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059250, "uuid": "b2bcbb82-4f81-4516-9843-1c259aef1748", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059250, "uuid": "a268340c-2fbe-4aa2-a5e9-3b7ea89f9da2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059250, "uuid": "9c7ab90b-afb1-40c5-ba04-46ac3d09bd24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b18309-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686054585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054585, "uuid": "5c709460-fcc6-49ea-a9e8-e7587ed91e00", "comment": "Malware payload (AgentTesla)", "value": "51de05f257303a9eb6e520cf32df0576", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054585, "uuid": "0dedfb5e-fed4-4c98-b1f6-3618b04232b5", "comment": "Malware payload (AgentTesla)", "value": "0aa97a391af7e84389400dfdbe079651df9b0bc421e5e069f6a277a3e71f464a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054585, "uuid": "a5b50a5f-c4c1-4594-b7b2-c862f6a9e4a3", "comment": "Malware payload (AgentTesla)", "value": "3513d6c4c77f4ce0543aca55dee38ae022f6585a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054585, "uuid": "1395d1ff-5cc1-4c16-8161-9a6211e3ae74", "comment": "Malware payload (AgentTesla)", "value": "be175786bb78d0935c883ebe1e8ae038f58580d2014240b8fa24b65bb9cc7c4a55b68fccc8c2af845e8e374c7621f910", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054585, "uuid": "77d733ce-3c90-4edd-9ba0-e7f65f20f08a", "value": "T1B8D423B22E7FD47AF81548424513D8E1AAE7884B276133A53324ACADBF7FF09C9D0641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054585, "uuid": "69a49d90-1795-43de-9044-b106289c4642", "value": "12288:b2ifnfg+MikPJmQ4tLBKpkWaLyxa55HqxEWyuuYUV3HLD4oEnB8bNm:b1fnxoxmZcaLS/jpuYtnB6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054585, "uuid": "479fc7fd-ed7b-4261-8e92-714ca6554220", "value": 633487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054585, "uuid": "712dc1c7-82da-45be-827a-666e2514595a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054585, "uuid": "25231a3e-795d-44f5-93c1-f4691adf3f7f", "value": "PO#88224, 88224.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdad480-0483-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686067138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067138, "uuid": "ecee3249-1515-4eef-a547-247de0f62cf4", "comment": "Malware payload (Formbook)", "value": "3a2f541b7a4e7735ee0552f6a25d7408", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067138, "uuid": "4505d5e4-0e1c-4056-9021-8635ac69073a", "comment": "Malware payload (Formbook)", "value": "0b6d509b045694a6a8e53eb80f7495e5254583c2626bc3efc5cd3b35f89adaea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067138, "uuid": "9769710c-f2a2-4d34-a802-8fad1f11d815", "comment": "Malware payload (Formbook)", "value": "8528944fb2756a6a692a69061e6ff16575d82f73", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067138, "uuid": "1da165e8-ee1e-42e7-bdc5-7ad1ce59d080", "comment": "Malware payload (Formbook)", "value": "5cbaf4549fa3a10fc0aba76487b3720e07d285276e24a4ca1570ac61b48517826ea4dcd747902b986a0ac42fe802a51c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067138, "uuid": "e474c957-3793-4024-a0d8-82b0923f35c2", "value": "T165053348B80B064B41F4F0AB5D0B09A11AFFB95D57956258E1B4F03BF4AD4BCE1BE079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067138, "uuid": "c44852a8-02e3-4a4e-b288-761b973152f0", "value": "12288:7w6QKfMhMjqHu01QDzJ5RYosQ8FfvU5Dfa9VzkYbCovHmnJyImWXb/Sa43sAORw:7wpRCjqeJTQQ8FfR4yCoaJyeKhcpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686067138, "uuid": "882068e3-55ff-48ba-b659-28f5def02c57", "value": 855134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686067138, "uuid": "bc7c586d-12f0-476b-988e-009c65d85a65", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067138, "uuid": "eb3610fd-30d2-4bea-8b5c-cac6438d0cb1", "value": "RE RFQ-Huada Superabrasive Tool Technology Co., Ltd00PDF.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9b0bc0-0471-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686059566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059566, "uuid": "49830c5c-212c-4118-bf8d-30918560d8d0", "comment": "Malware payload (AgentTesla)", "value": "11cbe548a55455b43979fcc32744ea0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059566, "uuid": "67330a4a-1b9c-4d3f-a7cb-a17a39e9d051", "comment": "Malware payload (AgentTesla)", "value": "0cc3029664a931cfb3c215fb3b946008af071d531de7a792ca07cc79572a789f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059566, "uuid": "c8a4d62f-ee3e-4c45-a01c-728cdce152e5", "comment": "Malware payload (AgentTesla)", "value": "a7f825fcd93f3dbad83198ea2227057129152bde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059566, "uuid": "d635a8a6-7212-49ac-b9d0-e7aa7f88364e", "comment": "Malware payload (AgentTesla)", "value": "6119726d04b3630b1a0eb52a4e6bbf2d1dc7aaf9f30dc884fe98b49d1d4d7fff749b540548c99518902e3769dc8f4280", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059566, "uuid": "6c8c8d0c-4e4e-4869-95e2-0d4d601a869d", "value": "T1529423D473C4A2AFA5E63A310C5A636E053036BE92A6FC529DD0E47E27C14A8D14C8F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059566, "uuid": "c6dc2f65-6595-4387-a963-4b20484eeeac", "value": "12288:Tg+ItmDJ4Y9mZyH+qHJ5uE6thF/LMfeDXa9sE1J:114CtzA1L4mk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059566, "uuid": "537a372b-e044-4b91-8474-c13531039cec", "value": 423838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059566, "uuid": "89622b59-340d-4c03-bad0-634bb9f1b45a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059566, "uuid": "062355ed-6967-47a3-a44c-bf4b128ee563", "value": "PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdf1ccd-0488-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686069292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686069292, "uuid": "be434aef-0fe5-4c8d-9d51-6241f8b2623b", "comment": "Malware payload", "value": "c8438960f4f248c1850d3163b508079f", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686069292, "uuid": "e7f69edf-fb4b-4a56-9c0c-826a66ddae21", "comment": "Malware payload", "value": "0eeb72418add4d126dab5e1f1a44f49fffc0b110e2bac35d4bc1dcbb8c7fe039", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686069292, "uuid": "bd4dcb0a-f86c-42ed-8151-f017731ecab1", "comment": "Malware payload", "value": "ff3eb37453ffcfab565b2f4bc0869f5cea5c8de7", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686069292, "uuid": "575b8c99-2859-4198-ae06-a9424a54870b", "comment": "Malware payload", "value": "7a1ede864063290579605f7672958428eab80ed4c49e4dd49260af0085e9acaf358815ba87ce09dc8af4888e44a966e7", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686069292, "uuid": "a7782148-2183-4c83-8ba8-4b167c3069ff", "value": "T147D022AE031AC1F0D7C964116260FC80A80A788B88E9E95567C0DD9C7C582DAEA98296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686069292, "uuid": "814d3681-183c-4c61-ba0c-e8fe2d689386", "value": "3:J25YdimVVjSei4mqRAbABGQZGQsG4vnKLxtdggFtdOLHK0hpBKvQT0rKEgGGwW9C:J254vVjoERYFeJ1nd3zkrpshf3Isn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686069292, "uuid": "11d292d5-cd34-4080-b082-4aa14776c2e1", "value": 198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686069292, "uuid": "96f6dd22-b395-40d4-9656-727deb53ccae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686069292, "uuid": "d8383523-5c71-473a-b108-c6993db78c22", "value": "FACTURA_PDF_XML_65099.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d609bb-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017756, "uuid": "4e8c4910-a8c9-465c-93f7-4d7919dba1b7", "comment": "Malware payload (RedLineStealer)", "value": "d0252f685e5f96cbbde6df3c576374fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017756, "uuid": "38c9e1aa-db75-462b-b084-eaed7d09cb51", "comment": "Malware payload (RedLineStealer)", "value": "0f45ebf9c23d99bf17fa0a32e1d42a05b263dc1187852b89b56f104cdcbc9e57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017756, "uuid": "298f7bb7-436f-4593-b298-1c1bf1212bdc", "comment": "Malware payload (RedLineStealer)", "value": "513f140cf41a339f7a966d7744fe9ba64196bf3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017756, "uuid": "d1cd31d6-3272-4f1e-a3a2-ad0fa304f238", "comment": "Malware payload (RedLineStealer)", "value": "2d5d893595a92becd7ff3406d25bc4a1437c7cf39e196a5a60a63a612648dc45d3a6f313d2cc85eeaf71dc00398601cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017756, "uuid": "34fd33ea-358a-46a5-9243-dfd9a36ddc1c", "value": "T192D41243FAE89033D9B527B054F602C70F3ABCA19C79865B2F86AC9E0D71249A570777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017756, "uuid": "cad91761-6358-4d85-a9e2-264d95109177", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017756, "uuid": "8881350a-145c-47a6-bc1e-13c4ab83007f", "value": "12288:AMrQy9089KKDw7Wp4xVMEFZP/t0hPSGEUbVflHJSyW:gynlsya5IRE8fW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017756, "uuid": "d1b85756-26a8-4c1a-9bbe-10cb38d606d2", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017756, "uuid": "c78b1066-7fd4-49d6-9444-7f9a4c109259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017756, "uuid": "be28403c-38b1-4781-8e7d-e621381c95d8", "value": "d0252f685e5f96cbbde6df3c576374fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b95aee-0468-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686055528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055528, "uuid": "6b72af91-c495-4492-a84a-d7a51e9e4e2f", "comment": "Malware payload (Formbook)", "value": "9fe77757d2070219814ee60aab5444db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055528, "uuid": "78c19a4c-5494-487f-8135-7024c17cbf7a", "comment": "Malware payload (Formbook)", "value": "10353eef0967b431cba47ab4d805a87303cda200c2b9f111924917c18106cfc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055528, "uuid": "c26ce50b-7a48-4643-8d49-1a2e10c622e5", "comment": "Malware payload (Formbook)", "value": "a2520d4e8be1c178029a19fc289fd8bf965b6d3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055528, "uuid": "e998fcbc-eb8f-46f4-af97-6a4e67659495", "comment": "Malware payload (Formbook)", "value": "3c33782a274f8aaa23b021655dc72e90a266782ad4ec1605763c61e9fb598e4f7cd2f818da9dc2294f82d8aac538bc6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055528, "uuid": "72949647-1c9e-4069-8aa3-5d9e11593d23", "value": "T187D423B54213C1FFC4A685722ABC295F6C8AF41185352E4BAB81C738B775383A719F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055528, "uuid": "aae3fe99-766c-4551-ae7d-285c79f0d5a0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055528, "uuid": "9608dbc5-b628-41c2-a4af-45da1ff6e9f3", "value": "12288:NY2f9ANFB6Q0cl2fpbkVvEKTnVVWNX8eq042fW0oSwAO9A/7byuFgdUxlc+7etOJ:NY2f9EnZV88eqGoSwAO9wXdC0lutODl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686055528, "uuid": "ceb05fd3-126f-413f-a716-97a55d3b2706", "value": 652186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686055528, "uuid": "7c669aae-50f2-4676-8bce-9d95bea1f679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055528, "uuid": "55f166d3-3f5d-48e4-9bf3-11c464b6bc58", "value": "wire_confirmation_7746362972.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e00ab23-04ad-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686085314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686085314, "uuid": "c73e50f9-e30f-4d5f-a7fa-98521efd8198", "comment": "Malware payload", "value": "4f02ba19a4db3393dc5f3e79d8f7669e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686085314, "uuid": "bf2a4aa9-31fb-402c-ba71-36f314749ee2", "comment": "Malware payload", "value": "104d7971d940cfdf674ae8900605ad9a0092ca2f573c10d53374512d62f4f7b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686085314, "uuid": "32f2c0d8-e9ed-48cb-ba29-ddf944f9bd61", "comment": "Malware payload", "value": "5e0fe326ba95ce06d295d7c7a202f1d6437d21b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686085314, "uuid": "3918899f-65e9-4ebe-8c4d-f8b3a8cd78bb", "comment": "Malware payload", "value": "cdb1c5448ce306bdb7608b6a1d48864f21ced7642a3130ea460d9813a58d2f241d3feec26792f2f70f12a94de823e011", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686085314, "uuid": "b3fa270b-83f4-44f3-9987-b24d55ba912d", "value": "T157936BC5F783D0F6E95205B1517BA7329733E43AA02AEB42C329AD36DC52910DA1F76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686085314, "uuid": "e13fffb8-bb68-45bf-aedb-4cdd9b1ed058", "value": "1536:7FC5g7zNMl+YOyiqwT7h+gkHYxWhgfGSdRXXx:7FCCNMldDx678gjxb/dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686085314, "uuid": "82cfdceb-8d00-4df3-8317-c2282c9b8aa7", "value": 92108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686085314, "uuid": "3a5d5ad8-3540-4a76-bfe8-e5c84da663f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686085314, "uuid": "9f16f06d-8945-4516-86ff-c0667695d89b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c3240c-0472-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686059960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059960, "uuid": "7e247131-4f84-4185-b2b3-471c57f6addd", "comment": "Malware payload (AgentTesla)", "value": "52f1028b21f00aef9cade73462440a16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059960, "uuid": "4f88dc9c-95d0-4a0d-bba7-e47c06b17643", "comment": "Malware payload (AgentTesla)", "value": "1057645002a8069110c4d47170d9ebed6e7d238704800fc3cbac943d65fa8503", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059960, "uuid": "02ca0593-480a-4ef9-b63f-3a200cfb8958", "comment": "Malware payload (AgentTesla)", "value": "982932b64b69998dbe260d3db98d2f6ccd417984", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059960, "uuid": "854a7386-59d9-4b1f-952d-4a7c1138f299", "comment": "Malware payload (AgentTesla)", "value": "87eb94172eb9dff8e8546d0a17a73837f080bdb082bd0f1f593068130e966efdd0f746838478f1cbb1169b656ea51a07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059960, "uuid": "e0f663f8-c9b0-4ba4-8025-a8401e2e049c", "value": "T1B8E43312BCD7016524A87037718E401E2A6F4EE8EB37B5FB5E194B90E56B394DE88CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059960, "uuid": "21730848-9c73-4a91-bc6d-0403ee8545cb", "value": "12288:HURHsNl7lUX67aJF3J+DIu47C2I1UTi8QE8W0Ju2guLMdZUT:P+X6u+Eu47BDh8y2gS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059960, "uuid": "e0911449-00f8-4a4d-b52c-9a4226e23d15", "value": 672268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059960, "uuid": "c428e102-1f55-4ac5-935b-3e7c953f3ac9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059960, "uuid": "efaf4728-0470-4589-b5a2-379eb31a97e6", "value": "delivery arragement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfa13e7-03fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686009642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009642, "uuid": "4fd23836-29ba-49a2-8c61-a0b80239e9e4", "comment": "Malware payload (RedLineStealer)", "value": "7af4916d1f50bc3bf017c522982d6d5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009642, "uuid": "5a06ccb5-430c-4324-bee2-382d19fbd0a5", "comment": "Malware payload (RedLineStealer)", "value": "108b595fd3559cc2c635557d17cbbf5016cab3c4041257b33fd66d4a1acbb873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009642, "uuid": "b8bafd04-36de-4c4b-b016-e56bada51658", "comment": "Malware payload (RedLineStealer)", "value": "bcefb3264ce86b456112ed6830fd7badb9f0980d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009642, "uuid": "c57bebdd-1587-4f8c-8d41-a5d4a7256c82", "comment": "Malware payload (RedLineStealer)", "value": "80a5863e29a57dfee816a3d10de26324def04ffeb148a88df51b40f7e32318e6ad9a933534e4c86a58cbbce8d92d87a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009642, "uuid": "f63ae929-a15d-449a-826a-ba94f839b445", "value": "T1E904D668364B697ECA6F483D9C700CE4667CAC661246EB07998EF0E43D3B7919F051F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009642, "uuid": "2a048a67-74f7-4be9-8072-26e0bf045634", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009642, "uuid": "31f20636-ad7c-4e77-9353-0dae6d2134b1", "value": "3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686009642, "uuid": "b115b9ed-d55a-4900-adcf-d0c9d7c9b58e", "value": 176284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686009642, "uuid": "3855dab7-1067-42dd-868e-073e2e77f1b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009642, "uuid": "98a09007-2993-4029-bd7f-53ed3338967b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e14ca4-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686059267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059267, "uuid": "bdc5ae07-b260-47e0-9616-cfd2d2b1847c", "comment": "Malware payload (RedLineStealer)", "value": "aca9397b5822964d318ca148f947935d", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059267, "uuid": "cc5ec03b-94cd-4b9c-bf74-cb26ba815a11", "comment": "Malware payload (RedLineStealer)", "value": "117923fa4c78bd37c924ad1e59c636a9a9337d4d58df9e1779be1c0e3a94151a", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059267, "uuid": "d8692664-94cf-4b67-8188-01afa905b745", "comment": "Malware payload (RedLineStealer)", "value": "404fcc91caccf8771d47da71e4b5c0258f5343c2", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059267, "uuid": "3fd20add-f705-4069-a995-60e9faa53769", "comment": "Malware payload (RedLineStealer)", "value": "5242914e8548ccf544c06f348fbd06868c02f36f874d0c67e14b172485556a199254c59712c23dd6bdfcd74ca482e55e", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059267, "uuid": "348043a2-f24d-4f40-b7ca-599d216a9e1e", "value": "T11B44E17973CCCC73EB6B5A7A597507610731D8A89803E31B64989E637C2D3D6AC01ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059267, "uuid": "e86d5f2c-37ef-435f-aeb7-6e95685de072", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059267, "uuid": "ff6c6db9-5a66-46cb-85d5-41a68043389d", "value": "6144:0JXxbZwnGEjf7Vfwh1kpOjXgbCz1tHwKFkVX2:0JTt+f7G+pOjXUurwKFk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059267, "uuid": "fb6c804c-386e-4ece-92b7-b08069a0b726", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059267, "uuid": "8cb7b791-4f20-49e6-b86e-0e42a3656f19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059267, "uuid": "52d6d3a1-db98-488f-b7a7-93e7d2bee737", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79a6b2d-042c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686030033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030033, "uuid": "a6b5f5bf-3e8d-4c86-bd8b-77cb56756441", "comment": "Malware payload (Formbook)", "value": "d93dd4200d1997c9b734bc2b1de77dc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030033, "uuid": "3f603213-30c5-4d39-9973-272e03e5c7d1", "comment": "Malware payload (Formbook)", "value": "12a06c74a79a595fce85c5cd05c043a6b1a830e50d84971dcfba52d100d76fc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030033, "uuid": "0224b1a3-b682-481f-bd45-031e6c24cca7", "comment": "Malware payload (Formbook)", "value": "9b96aa19510fd49e13d394017284c325ea81dc7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030033, "uuid": "e735af9a-9721-4c3e-a5ac-ca31dcd7db4c", "comment": "Malware payload (Formbook)", "value": "a58fe5fbefd3ad9cec11c4b896e555decd2a322b7b6ea5c3b17421c96ae7c84479e42e3af61d3140b69efe8d69d3e4b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030033, "uuid": "b2051aa2-cf0e-498c-89ea-c569d0fea6a9", "value": "T1DE641298157ACDA6E1A2C231643B8A947EB19C3594E153170314FA2FBCF63C2DA5F327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030033, "uuid": "28290bf1-224b-4c6f-9306-eb6edbe96110", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030033, "uuid": "8ced5159-9881-42d5-a15e-6ad1581e4813", "value": "6144:AYa6rb6wHR86N8RbEpztPAZ3IZUOGAdHwWM0g4uGFzq8Mh:AYJbFx86CBEe3Il/LpXukQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686030033, "uuid": "1db8ac90-d81a-4ec2-9166-6ddfc2d1068b", "value": 307416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686030033, "uuid": "e00b90ac-903f-426a-8f2e-665cf6b9b3a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030033, "uuid": "8839c667-e04a-45e6-b848-d6fddb46a323", "value": "003737.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029e1e08-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017730, "uuid": "95ae009a-6a46-45a9-81d0-17ae261bd26f", "comment": "Malware payload (RedLineStealer)", "value": "4b9cc96c298cca6cb5c22aae0e79d606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017730, "uuid": "7e210560-f76c-4af9-a23c-ab9f7bc63b60", "comment": "Malware payload (RedLineStealer)", "value": "12c9a5226cbd00b1bc5e9efc4e50190d201e7f3b24b9a8c58210165b34f0c478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017730, "uuid": "b571736e-b7a5-481c-bd8f-330419e02297", "comment": "Malware payload (RedLineStealer)", "value": "5e84d2dfa3e99003c9203f19747bca4f2fc9d2d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017730, "uuid": "d06268b8-5f9b-432a-aeba-e2bae5b2f9e2", "comment": "Malware payload (RedLineStealer)", "value": "341f9934019da0749ac199839cc9d8ca254bb8ef873590a6cd3ddb4065c8997671d6c5eda57326d0aed71f22b2ed15c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017730, "uuid": "c312d40c-5195-409a-9da9-f022771d217f", "value": "T1C3D41252A6E84073E9B5177009F716832F35FCE19D3897272786A94D1CB2BC4AA3137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017730, "uuid": "99c32c58-ce47-4805-9d78-b05c43c538a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017730, "uuid": "13501201-1f41-4f57-9889-f457ea1309a7", "value": "12288:hMr3y90eSP3g9IDpMY2JLDuql337dq8HAaxeMLaxe:KyzQ8IDcRuA3LdxGMLaxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017730, "uuid": "08dfb3e7-ac5d-4642-be97-880752f85aeb", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017730, "uuid": "d605945e-9860-4f72-865a-fe5294426ada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017730, "uuid": "7b4ee526-6089-44d1-a2d7-249b8008e5ee", "value": "4b9cc96c298cca6cb5c22aae0e79d606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b43724-0468-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686055845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055845, "uuid": "2e6a0961-4a5d-458b-81cc-85cdcbe78cd9", "comment": "Malware payload (RedLineStealer)", "value": "662bf19ee4d2d7012a4a992e481de2e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055845, "uuid": "07482af1-8cdc-4989-8af6-607ba4493df0", "comment": "Malware payload (RedLineStealer)", "value": "1455c02724f01860990caf7a8253ad58b32ad2b9ffb955c36205fc82473e222d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055845, "uuid": "d0a26880-7106-4b5f-8a2e-5b994c3dbedb", "comment": "Malware payload (RedLineStealer)", "value": "af801f5aba409e74a33df5d25411c4007ee7ca41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055845, "uuid": "ad1d80cf-664e-4e11-9530-005480b24a86", "comment": "Malware payload (RedLineStealer)", "value": "6ec6f15ca33f67cc22b3800c4d8f1d603dfc0c0c466292c9de7770e6e99c324e6a18ea98f8e2c1a1fb0e91ce7c9f5ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055845, "uuid": "690a4782-e12e-4bf9-93d9-7df421b8ecf4", "value": "T1F8D41216E7E8807AC9F22B701CF323830E31FEA65D74436B6356A85E0C726C59976367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055845, "uuid": "c4e7c0b7-9452-4885-8ac1-5195543eea8e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055845, "uuid": "87886456-0b15-4e96-82ce-0ff57b85ecaf", "value": "12288:QMrYy90QUTjhPtkCU+XWOBZhUTnBkmpCNI36YNWR:YylUTJXdBiWmpCNI36Ek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686055845, "uuid": "7dfcf14d-1907-4a8a-a104-c4f346766a0d", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686055845, "uuid": "9c243f36-dc61-47c6-a291-1d0cb95a85e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055845, "uuid": "a11f22ad-cf47-45ce-94ab-f5c234c47f91", "value": "662bf19ee4d2d7012a4a992e481de2e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e7f4a2-044e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686044443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044443, "uuid": "59f8c709-d368-4cb1-b3b0-0b1f6776d6e3", "comment": "Malware payload (RedLineStealer)", "value": "f1408a0c8416b71cf847906fc9f78867", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044443, "uuid": "24f9cc13-117f-43ab-b994-62beeeb27d56", "comment": "Malware payload (RedLineStealer)", "value": "145ec1a3bfc0ac8699c3273a0dc47701205ef872b378f6c3290f837a46fb2390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044443, "uuid": "3a793d36-654e-4855-8193-4c58cf8f243e", "comment": "Malware payload (RedLineStealer)", "value": "7c3d43ba8dfaf03543790eafa57a2ec6d4a8f560", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044443, "uuid": "d2f636c1-56d2-48a1-9d6c-ab66d245f8ce", "comment": "Malware payload (RedLineStealer)", "value": "8d812b3db281ac033ef3194219838aea7019835b56fed6fd23e83f814357a4abbc93450ac42e0f4ceaf69cab4169cedc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044443, "uuid": "9c9b5611-1d42-4a97-b3e9-4452cf97e722", "value": "T198D41252B7E48067DDB71BB45CFA07C3093A7CA2497883AA53569C5E0C33AE4783176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044443, "uuid": "7ff19107-a259-4f47-bde9-74e53d6fa524", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044443, "uuid": "076b7b28-7168-4ca5-a2c8-41726d63a801", "value": "12288:3Mrgy90hIPWxuy0g30zhEghGja2tap8Qnnr4SjQlfI68ag:7yOulzhGN0lnMS+fgag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686044443, "uuid": "85c4d3dc-050c-420b-9e20-eef54c4f3e30", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686044443, "uuid": "b1c60fd0-9960-4187-b3b5-73b994d2fad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044443, "uuid": "68a3c91d-767b-48fc-a00e-3600ad5c2ca6", "value": "f1408a0c8416b71cf847906fc9f78867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384a3802-043e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686037577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037577, "uuid": "7141dcfe-4cde-4d7e-b285-1f83a79daf1d", "comment": "Malware payload (RedLineStealer)", "value": "a7ab125020181f4f4612a2a4d94cd144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037577, "uuid": "eb78a4c6-7fd9-4a23-af98-6927ae0e256a", "comment": "Malware payload (RedLineStealer)", "value": "152e5b0db37e3db74698841e417e95f57cfb235c213b4dd6165e3ff0734e1700", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037577, "uuid": "49504357-95ad-42db-9115-f986dc436b32", "comment": "Malware payload (RedLineStealer)", "value": "7ebb5a28a553b3987e935e8bee6978ddef2bdd64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037577, "uuid": "03c87e3e-4a18-4d8d-8e8d-8d962d52d2d4", "comment": "Malware payload (RedLineStealer)", "value": "334986b1701d349f9bfd9cde55617c6ac7a651745f8ac5e374288421ea7b19850ac2a199cd5575b9ee62aeab02be48c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037577, "uuid": "0dc8655a-b519-4dbd-9a0f-f500b5cb6a0f", "value": "T104747D0353E07D54EA254F739E2EC6E9361DF6918F59BBA522289EEF08B00B1C763711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037577, "uuid": "292baaaf-567c-4d71-b748-a095e69bd581", "value": "73f55c9a8ec43dc84ad4d9211db141b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037577, "uuid": "198fe86d-de44-4acd-8d5f-7c3556a46991", "value": "6144:z5kvRX7Ju0NNnwV5OI89ejB0fbo5ZQGZ59dZzXI9sb0ur:z54RX7Jbu9JV0Do5ZtZ5fB00/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686037577, "uuid": "ec95f6f4-824c-4cfb-83ed-c04843a693a5", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686037577, "uuid": "6d11da80-355f-42a9-81f9-0285795f5dda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037577, "uuid": "54c3e14c-fcb7-43b0-884c-e17628561f56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990f4b16-048c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686071240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686071240, "uuid": "08b7fc36-1752-4488-8d4e-ad5faaf27c5d", "comment": "Malware payload (njrat)", "value": "144fc1ec9c05433ae3a5e9d6543f1cbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686071240, "uuid": "3db7fc26-c304-4b8e-817b-5d0551d7bff8", "comment": "Malware payload (njrat)", "value": "15800787860c1e735ad6b5f2a1b0915b1e3dc1b63264eb5c8af4a1386d5a2e07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686071240, "uuid": "7539c9cd-8696-4869-a790-2f0f7c60631c", "comment": "Malware payload (njrat)", "value": "2a2c04871b40ab7d51edf23911a3d6f16698efef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686071240, "uuid": "ede422f4-e539-4cdb-9fbb-74c536d4d24f", "comment": "Malware payload (njrat)", "value": "c783ad7853db5344fcf32daadb5d08ad04d7c176494f9f3205f8113ce4b3ef5324390371b99e8c2c66101dd280b6ccef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686071240, "uuid": "b09a920c-6dcf-49e9-aabe-0ca9d134e32c", "value": "T1ECE208067BE94215D6BC1AFC8CB313214772E3838532EB6F5CDC88CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686071240, "uuid": "935f28a0-b98a-43f1-9838-6a6a50d7de76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686071240, "uuid": "932f5fb1-a9e0-43dc-8eea-3b86b02ab8f9", "value": "384:n0bUe5XB4e0XmOnPw0Q0mS03AWTxtTUFQqzFcObbZ:sT9Bu1I55dWbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686071240, "uuid": "0aab159c-5953-488c-9af1-0c0d4a99cbb8", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686071240, "uuid": "11819c28-c5fc-4e61-b24c-f62c00321bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686071240, "uuid": "8599ee4c-0cd0-4919-85ac-8dd845783a0d", "value": "bNnX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82287e5c-0486-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686068625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068625, "uuid": "056f997f-a236-48f4-beb2-6ab70a1d9d8e", "comment": "Malware payload", "value": "2eaad599f5f70d9ce397e81fdc379b1d", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "horabot", "colour": "#7EF179", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068625, "uuid": "a13dbb48-bc4c-43c5-a12e-a09c525b1e40", "comment": "Malware payload", "value": "15dafb329b399caba8651357437c9cf6e39961c122a9884f6218a012ef214f99", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "horabot", "colour": "#7EF179", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068625, "uuid": "b84b003f-5883-4681-81ce-69a1cdb9c2bb", "comment": "Malware payload", "value": "b5d0fc3dca83aa16837bee009f9f3b6e50da9109", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "horabot", "colour": "#7EF179", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068625, "uuid": "cf24580c-6e09-46b7-8475-2e3a4b57a4e6", "comment": "Malware payload", "value": "4e463602be7eb37c5df8bff8f9f12fd04ab961266e2f0430a29db0020cd9af66f70942733988623db51805c1fd51df86", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "horabot", "colour": "#7EF179", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686068625, "uuid": "e4ae11ee-89fc-44df-9253-820d886496a6", "value": "T1D686336C35442BBC6B1F80121F7EA3F459043AABD0E4A85688F5F23937F7606B5B9C16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686068625, "uuid": "68959999-06fb-4f6b-8cbe-657769dacf16", "value": "196608:AQXlOrqOU0HjGs6LYq7Ymj+1A22w+Nf40Qtb22aCC:A8eUCpI34Sw+Nf4XF2tCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686068625, "uuid": "e6ebef71-4128-40bf-b7e2-0411aa75d5f2", "value": 8113891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686068625, "uuid": "feea4ac7-f9ba-48c5-9556-f770ad48fe64", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686068625, "uuid": "ee07be0b-3b39-474a-9558-16a5f125886e", "value": "fatura_2023_comprovante_25823548ASDFH2349ASFK235.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ad17a3-04aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686084143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084143, "uuid": "d6c7a7fb-5794-4935-81f8-4723981a4a0a", "comment": "Malware payload (Mirai)", "value": "2c2fa6a245dea4bc079925eee8bf1f81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084143, "uuid": "f87d3d77-2bea-4bf1-990e-12abd8216df5", "comment": "Malware payload (Mirai)", "value": "182a85b8b86b9d2fd2ac428ad3a61bdc4d1835aa30b17fa4efd7c3a1f54bdf35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084143, "uuid": "83c93b7b-10c8-4a3d-9b88-a6dc2c93960c", "comment": "Malware payload (Mirai)", "value": "60884b5d45fdf900df8b8b926b72b476e604a5ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084143, "uuid": "ab00e7d6-8d25-4bb5-9a4c-43073e97c9d7", "comment": "Malware payload (Mirai)", "value": "1abbc992ee6db5489e9d5fce5a43e042f8f903a4c8ea77f165e57fce5668c3d61a503c308e8a9b35478956112335690d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084143, "uuid": "24608f69-4340-421e-9bbd-62bbf1532778", "value": "T1A1D35E97B4019F7DF89AD67985370A0DF121A21466A20B27F356FC9BBC330A85F1EE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084143, "uuid": "49066cff-0c3d-41f9-bd31-6d425ae497c0", "value": "3072:LOpni5XImwXRQlJOooL9NN2D3e+j/XSfwMdBa7r:Cni5XImwBeQooLYFj/XSndY7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686084143, "uuid": "39dc5e1e-d04a-4da9-a1f4-1e110f3f9cec", "value": 131676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686084143, "uuid": "325afb1c-54c8-4396-98bc-cc1b54cc198f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084143, "uuid": "5e9945b3-45bb-4b09-b50c-076514c2f094", "value": "2c2fa6a245dea4bc079925eee8bf1f81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b660bf3-0467-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686055353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055353, "uuid": "53692c6e-bf3f-443f-a062-b4afebd96327", "comment": "Malware payload (Loki)", "value": "0c457df8d7a54f95c75350425f0b25b1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055353, "uuid": "c2b96b86-d674-4569-8f03-2d17b5f6ac66", "comment": "Malware payload (Loki)", "value": "182c6fa00df15464432021561516c0c5b27ecc80e57abf661fae2cc376933c18", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055353, "uuid": "726df1a0-20eb-4bc1-bf93-81195a1876c7", "comment": "Malware payload (Loki)", "value": "5b8982d421e8a6ce340a6357e8c9b8b1a7d6be90", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055353, "uuid": "36b93a03-faf4-4453-a376-964f57404d04", "comment": "Malware payload (Loki)", "value": "269a47f1cdb209a37ca2ba53d445bbce415f82f5c69c94b05f31b6565436d89bf378489a9516b5e1ca81e83e1e206532", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055353, "uuid": "4c7086d7-e1ce-4ef3-83f3-9f65c58a1ad9", "value": "T16DC4233B294E473F8D33D6531AE4160BE6FD899991E04CD71AEFC5AC48EEE80931119B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055353, "uuid": "d41e9863-962c-481b-bba2-3a90c468991a", "value": "12288:W3B2iSnpd6lw/9qGU5hi2eM8IO9Wc6E52a9CfqdoiYpkElskMINcJwlNu:+B1SnpN9qnh+ToKaS6N/NcGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686055353, "uuid": "764ebe17-9ec5-438f-8214-ac2440c21d68", "value": 555552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686055353, "uuid": "230204b9-b7b5-4c3b-ab4f-de5174cdb11b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055353, "uuid": "a790e51b-2059-4030-9e28-0ab4df062e8e", "value": "11121409.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d316b5a6-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1686059311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059311, "uuid": "da453cc1-39d9-4211-97c6-e794b39ea37b", "comment": "Malware payload (LgoogLoader)", "value": "daf761fb9aaa34a9c2120003694d88a3", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059311, "uuid": "8894232d-aa05-4a76-95c2-0d330ffa5fc4", "comment": "Malware payload (LgoogLoader)", "value": "18d4850a10812f3b4d8631939d469b41c1d344a7fa9205acc31b265d0600291b", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059311, "uuid": "c64d13e9-4034-44d4-8a4e-6a17f75de64a", "comment": "Malware payload (LgoogLoader)", "value": "47fd2695b6da26f6444799d442662b982d70f783", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059311, "uuid": "e67329b0-1c84-452c-a6fb-286e0f7f8536", "comment": "Malware payload (LgoogLoader)", "value": "ee8324475ca1d28e5df05f3b3c915c9b74aacdbe512640109f51166129c320787366bd0d2611e724e92c17671417453c", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059311, "uuid": "78b3b2ca-c257-48bf-b885-7c94396635f0", "value": "T168D20800A3F98767EAFB4BF64871124447BA7ABB7936E75D0DC460DB1A637404A01BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059311, "uuid": "00648da3-61e5-4809-ab5d-0fd1e77c9b43", "value": "768:uwVMApolbUGPPMdwdunhdH15FIU/ogyejq:bVLoljn8nhj5FF1jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059311, "uuid": "fb6abe16-fd93-4ccc-82db-30fda7574831", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059311, "uuid": "ff5b6553-b2f6-471f-8487-07eb9fd4f516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059311, "uuid": "7fb5a325-9c66-4831-b8b2-d17ea69b71a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb25e64-0466-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686054872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054872, "uuid": "990865b4-2e2b-461b-9367-34a1eeba0683", "comment": "Malware payload (AveMariaRAT)", "value": "f0b5a3e71a62702d77b821b59cfd4064", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054872, "uuid": "7a95b619-ce86-47b3-9d78-6809ec2aee73", "comment": "Malware payload (AveMariaRAT)", "value": "199242f2ab053d188ee11a886a38f0c38671b42943a4c7d7a7dbd06919ba0d69", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054872, "uuid": "f04cd7e4-fe58-4081-8c6d-6d686a0424ef", "comment": "Malware payload (AveMariaRAT)", "value": "37f1926b022b3a2245ea84f964c69b18aec6936b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054872, "uuid": "eb5ff923-c3bb-4b04-9e5d-5330bfe65701", "comment": "Malware payload (AveMariaRAT)", "value": "b01476f0051a6186b8671d0b1b876a08a6361b105a3999060d489ad1e449cda832595bed6eca9d1f875076dbbda31ecc", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054872, "uuid": "38551a7a-cde1-46e6-97f6-352a6e182c55", "value": "T1B943D60C72BC3F22EABDD3FA85A4221407B9655BB022F7A90DD270DB1561F805D91F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054872, "uuid": "3640d56f-2102-46df-9889-199d9e52c601", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054872, "uuid": "977f9a2f-0615-4df1-97b9-7e4c55e942d6", "value": "1536:TA+yI0m8aFA+yI0m8aNNPM2dWqyqWqzqAqVq6qnqQqzqsqZq8eECODCEOajpVspE:TA+yI0m8aFA+yI0m8aNJM2dqECODCEO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054872, "uuid": "e3be0b8f-d6c8-4c5c-bc57-6ee099a4147d", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054872, "uuid": "ffa001fe-858e-4adf-af6d-d7ebf77cef75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054872, "uuid": "734abf87-e541-4a7a-a7ce-7cf7c2e3b41b", "value": "278857944198_\u53d1\u7968 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05af23e9-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017735, "uuid": "e3c154b8-1130-4df6-a3db-dc665fc1f898", "comment": "Malware payload (RedLineStealer)", "value": "9126b1de2494095963f72b94e7be176f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017735, "uuid": "22f94134-6626-40d5-8c3f-ae95dbe90f54", "comment": "Malware payload (RedLineStealer)", "value": "19a8c27abfa11ae3fcc13c463845b9607861ca00f265da543ed6791ee407d98c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017735, "uuid": "9b88a77e-ba74-48ba-90b4-37d9de397a43", "comment": "Malware payload (RedLineStealer)", "value": "68b59b66001d604401d0ca90ff8ad62261fc442a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017735, "uuid": "1c2dfca9-3b59-4290-b1d5-e4a17c26bcec", "comment": "Malware payload (RedLineStealer)", "value": "548b24b5fca5ca57cf2a2fa71733f395b183a26587b97731b08f8d9102d734b16d35bdb3889d719efe047d1dea862c35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017735, "uuid": "3b1f69d3-94ba-4311-a3fb-0ef56c083be2", "value": "T1A5D41212BBD88031DEB9577055FA06C30F3A7CB65D74862A3305AC4E0DB25C56A39BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017735, "uuid": "179ac21b-1691-4e84-bcd2-fa02b0262342", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017735, "uuid": "b1ba4676-081c-4af9-a7c9-b78493495862", "value": "12288:oMrwy90BObXl3mPzTow5fmDmS+BL1mi/FPXr/hoBst4+R:4y4c2bL5mDmPBRL/1Ge4+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017735, "uuid": "0142be77-87a6-4d45-83cf-bdd6667fa738", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017735, "uuid": "b7b4b121-f375-44e3-b2f8-46936933c9c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017735, "uuid": "a6992870-2efc-49b4-a671-3c8546d7600d", "value": "9126b1de2494095963f72b94e7be176f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ae666c-0441-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686038775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038775, "uuid": "0c1fbd9c-b55b-4eff-9dc2-690a39a13338", "comment": "Malware payload (Mirai)", "value": "7f75d46eff5881ff1944fa19fb32b713", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038775, "uuid": "42e456c9-30c0-4046-a621-81298d1769d8", "comment": "Malware payload (Mirai)", "value": "1a2892282ecb5cc562809f4355ae05dabeee09c3ed7dff7efea570a6a6c8b379", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038775, "uuid": "18f6cb86-0fe4-4f59-ae59-b9793fffafc1", "comment": "Malware payload (Mirai)", "value": "7dcce382c7ecf3a0ab28f9f9777625cd5f0f0c7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038775, "uuid": "dc4ba228-72cb-4498-a85f-e19e094e6db6", "comment": "Malware payload (Mirai)", "value": "03c005cd12688d2209d995e5b58804854424b88b8c61ccbb58a41051f1a8dcab70d68993555ffd1f5c8072d9d822a8ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038775, "uuid": "daae22bf-04ae-4635-b89a-c40e7eb52a9c", "value": "T1A9B3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038775, "uuid": "bdc96e3e-5475-43bc-a14a-a623383f462b", "value": "3072:C/4g3Kd1rj5hZmxgA9OKdwwjF9GhsR1Ae:O9anj5hZLHKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686038775, "uuid": "a6ee2915-97c4-4139-9c29-71634a819b69", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686038775, "uuid": "92b43523-81f0-46be-b097-942ef899df20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038775, "uuid": "0fe8fd42-3e27-42d2-a8d1-e86fa4b1743c", "value": "7f75d46eff5881ff1944fa19fb32b713", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f48802-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686054545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054545, "uuid": "b859c406-3667-4a27-a5be-f5d8253bfd7f", "comment": "Malware payload (Mirai)", "value": "d4fae1a90461219a5871d25a3a6d8e1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054545, "uuid": "b5efc7f0-ed27-441e-98d0-d0e9e24caed8", "comment": "Malware payload (Mirai)", "value": "1a7191c2386e589559e7badb04bec8022f8eeefac29ca458de3c4726507284dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054545, "uuid": "953b9e00-b8e4-4085-b8f7-eac09ef13cbc", "comment": "Malware payload (Mirai)", "value": "a013a2cdde10d44f5f0721b0799009e1a7c16d43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054545, "uuid": "86a08713-6e18-471a-bc10-babda286c847", "comment": "Malware payload (Mirai)", "value": "19a8431b6a12b42c5e289647201a84acb9e8dcdf40a010654b07c7a1ad886a1acb7cf403409cccd7892ff3c7065f9bd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054545, "uuid": "1ad7fdcd-2bc9-4b72-af48-c77f36926796", "value": "T12333B60A2A25CFECFB6887344BB7CE659748339227E1C5C5E14DD9411EA0A4E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054545, "uuid": "61166012-c3b5-40b5-b4da-5d42f3ece530", "value": "768:B/IfKGZ/8smrKTcX3jARZbV+2xoXCuw7MLr+SdJC+KPOAHGnInU:6fKGtYrLtTCp2AHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054545, "uuid": "c41e58dc-6741-483c-8747-d02f3f6d5420", "value": 53556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054545, "uuid": "12a4b8db-f18d-4644-a936-801236d759a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054545, "uuid": "ef24d059-55a3-49b7-933f-c89da7e4a7a2", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.1.3984.28786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee899c01-0454-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686047332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047332, "uuid": "4267cb11-3274-460d-89ef-3ac034e90fcf", "comment": "Malware payload (Mirai)", "value": "bf6bdf29a3406aeb7378ac36b5556608", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047332, "uuid": "635653a8-bd29-49f9-8a59-55a41a6056bc", "comment": "Malware payload (Mirai)", "value": "1b81e565c5ed2869c554024e5a2fc6f33abfb6d47d78bbdb47bef9711b0fb575", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047332, "uuid": "d70d0c4e-e8d6-4e2f-82a6-3773f7b9ed2a", "comment": "Malware payload (Mirai)", "value": "e52769b29525138df88ee6f32a44bc273eb7ef0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047332, "uuid": "6c783e20-e5eb-42c7-8cbc-0a9b3a1eb69d", "comment": "Malware payload (Mirai)", "value": "5730579d2834df01557904dc5e6ea5a209ea71ee41ab18f9376a514e24d43763bd149573fb40e70be88e0a020327384b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047332, "uuid": "13366da5-4c76-422b-8665-ad58840a6d96", "value": "T1EAD2D08876D263FA8CCDCA7DB35E103A309E74E9A6B29363B305C55307B6180E691D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047332, "uuid": "3b213fa3-3fc0-4d5f-a7c5-bfdae98c6551", "value": "384:Mqd/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BKiwW/KeNyN:NlxKd29WcxEns+V6IHE4RlY990bwyK/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686047332, "uuid": "0a7ca6cd-ca9d-42e2-8c9f-10d797646bb5", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686047332, "uuid": "acfb8b15-907a-4296-9f32-04c6428c8525", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047332, "uuid": "0c6f6af5-5829-4577-b3b3-3b1d1a121ced", "value": "bf6bdf29a3406aeb7378ac36b5556608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c9e902-0498-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686076219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076219, "uuid": "1a084955-ee11-4b64-8080-21d035a41902", "comment": "Malware payload", "value": "e783f26eb96f8f6741edd280010b2be9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076219, "uuid": "b7c068bb-a761-493d-ae7b-4252117419a7", "comment": "Malware payload", "value": "1c503c1576dbcbcbaf2ebc8ac578e6d694ffcaf84f88c2ea6a49e4ffcb5861b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076219, "uuid": "a9148f2c-48e9-448f-9a2c-55c4a72b556a", "comment": "Malware payload", "value": "bc256f81278d3e33147806cccd2cb26691409b45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076219, "uuid": "375c261b-1a41-4911-bdfc-6ea2f0438f53", "comment": "Malware payload", "value": "ee74d9bd0cc3d8e6ee85a4bc797a0f0bd83c8d3ecd2feaacca479a4d91b61372a6d789fe6a5504dadd82ecc094a34a81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076219, "uuid": "c00f327c-a85c-412a-9faa-538d34d626dc", "value": "T1B405126865EB424EC87B3FBC0C506271DAF85589B067D1470FE72DCDCE22B258DE48A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076219, "uuid": "8567eaa5-58d7-4df0-83c2-4bdd8a0b0180", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076219, "uuid": "14c93903-1dd2-4862-a14a-eb0bc864f4a7", "value": "24576:Y1iewlqB6pAkg5Wx4nY480LPz34D5U+UeYnxglR1ZJob5YQ:YQe2q8pAZgxeYLM4DmneYxgj/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686076219, "uuid": "e5bc2d8d-7bde-4ff4-8aa1-899258e43940", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686076219, "uuid": "ae63a2a0-6e04-47d8-bf68-b342e6b817f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076219, "uuid": "22d6d978-57de-4b14-92dd-e1e57a56294b", "value": "quotation list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2884523-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1686059311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059311, "uuid": "024c6866-5324-4913-9623-df69b255cb29", "comment": "Malware payload (NanoCore)", "value": "462948d717e44bda852450260ec44d37", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059311, "uuid": "5ca27795-0ad4-41d0-8b30-f4c618f8f9a4", "comment": "Malware payload (NanoCore)", "value": "1d28cee9d618d8f15b3875ea1ac44a8bf4d9c59171da3227ba3b973e0c9fdb1a", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059311, "uuid": "5e7f9fe5-3e84-4289-995e-1b85c5c5510e", "comment": "Malware payload (NanoCore)", "value": "dc2aab0e06f483ee853ebec53cdb126131c0c8d7", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059311, "uuid": "1ec9b243-059d-4173-a561-2a0b56f427b3", "comment": "Malware payload (NanoCore)", "value": "3a94c942955784f21137ef78b8d7135cf8e7223c486e2680626eba82e32f2e9d3d0d53f89d6b7ecd88c07f70ec7aba42", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059311, "uuid": "876d539f-0f7c-4ef2-bed7-1ee3f0173224", "value": "T1FAA49E8B3609E82DC1DC6777D6DB08145BA09E81B307E7067CC723A94D0B7BBAD49987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059311, "uuid": "a1ac7eb9-9f54-4566-8198-e73a6c2ce9f1", "value": "12288:OKC8ZS2btvRz4Ber6bHfbUyMD0v+c1ouiLNISO:TZSiYbUyN/1opx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059311, "uuid": "34f4292b-1c12-4213-8629-4e15c705f1fa", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059311, "uuid": "6410dd0e-3c6b-4a18-b413-9358e54979e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059311, "uuid": "60e0c651-9f61-4894-a64c-db78a12149b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae554ca-04b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686087027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087027, "uuid": "a02cf71e-7753-4a51-ac43-c836b2f80100", "comment": "Malware payload", "value": "f388d31b3038d327726ed49858179d43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087027, "uuid": "f89d10f5-a658-43b4-85ab-40b348df2f79", "comment": "Malware payload", "value": "1d9ec922dcd155705b0ad4fa0d3b2a80b14612cd56b1c2e6d8506fc844d54b0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087027, "uuid": "e1e012e3-1fbb-43eb-a70f-c40b6ac8f71f", "comment": "Malware payload", "value": "e691b427ef75256194f5697814b3de771593a943", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087027, "uuid": "332b1fa8-3216-4a2f-bbaa-abfce8695178", "comment": "Malware payload", "value": "7e1625631b3abb4656327ab2552bb4c63b16ae8a98995baca79cdf68f53a767ea3cfa6f7727a7a5f4960fec8968f8d2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087027, "uuid": "f28e0dc3-a09d-4418-ac73-89832dfc27a3", "value": "T14ED3F856F9819B16D5C111BAFE1E124E37231B7CE2DE72029D246F347B8A8BB0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087027, "uuid": "77649be4-1511-4335-8f0b-26c986610cc5", "value": "3072:xSbIPdU3ww9FX3W6lr6KaUA7UoTKGSv4TCV51VHHq:xSkUXFXm6tBas1GSMA51VHHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686087027, "uuid": "5a180b15-f5c1-4dc5-804d-5413a4fdbf6c", "value": 141776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686087027, "uuid": "5dd50be5-e67f-4793-b78b-bcb23e877c88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087027, "uuid": "9b3f55fc-f542-4f83-8bb1-61fb50d3a5b1", "value": "f388d31b3038d327726ed49858179d43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aeaf543-0462-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686052963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052963, "uuid": "975595b6-92ff-4e03-a029-71ef36ac164b", "comment": "Malware payload (SnakeKeylogger)", "value": "66c6909fb26103060bb7bbee4c06ed2f", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052963, "uuid": "dfbf1352-e868-4ece-95cf-35ffb5826f98", "comment": "Malware payload (SnakeKeylogger)", "value": "1def418e881b33fa2b255604e5962eec6153bfe9c99b7dd93a24f6056afc7ac5", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052963, "uuid": "1fcd759a-029c-4d96-8687-dc5845dde34c", "comment": "Malware payload (SnakeKeylogger)", "value": "40fe2ffbf75ae70c64cd461fbc3b4701b077d632", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052963, "uuid": "367a29c9-5b02-4964-9eb1-8a064578e955", "comment": "Malware payload (SnakeKeylogger)", "value": "0f2e08f05cf6096c4f9669677c6bd410fdc714e89e61d464aa93f35dc64c3dc60f84c95647ac8060eddf3172773296a2", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052963, "uuid": "094f04b2-bf3e-41c0-b858-bec1d9a120ec", "value": "T1B615339BBAE207B4CDA5BEC1EACA5C0F4535DBB39658406BE374900D9A7138033275B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052963, "uuid": "7a3883bf-1b9a-4e03-bf51-c08941c4d4a7", "value": "24576:regC+4KdE9eRxx9I5kU/qqBXikiT62YXDWdWF0:re6dEQXI5jbhiTm2YiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686052963, "uuid": "445cf967-164c-44d7-9354-997ef34d48dc", "value": 907130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686052963, "uuid": "26bc0c4b-91f6-45bc-a750-d9f8da749f45", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052963, "uuid": "bac41070-fab6-46bc-b108-6ad36d0fa161", "value": "P.O no. 238275.Pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e623868-047b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686063947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686063947, "uuid": "7a78345a-65a5-4154-900f-1863b0113055", "comment": "Malware payload (RedLineStealer)", "value": "efa015ab2b5f2c15edea59878603ce2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686063947, "uuid": "c53fe6bd-df56-4de3-9547-850c96751458", "comment": "Malware payload (RedLineStealer)", "value": "1e5cfff6f14c0bd993b2067265734473bba336502c0c057bbed0429ae659f27c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686063947, "uuid": "98e4e5af-fd85-4096-8900-32b7b3efbd53", "comment": "Malware payload (RedLineStealer)", "value": "34e1601cea9dc60e38edbe834ae39dda5b482acd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686063947, "uuid": "1171bceb-60ea-40b0-879d-c530b9f14532", "comment": "Malware payload (RedLineStealer)", "value": "9cd572a37641da19a468efc9d9f7f881035e15e1c8db691add8ee2e2120fd32fe67409bd9b2acc9de4eeec3b2975c6af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686063947, "uuid": "2fd602a7-858e-4b12-80cd-d5908447d9a4", "value": "T101D41202BBE85073CCB517B05CFB13831A3E7CA159B8876B2746A46A5CB37D0987177A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686063947, "uuid": "b3a6caed-4ed3-4c46-a4ee-b20ff82f3f83", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686063947, "uuid": "a2dfa129-8e7f-45ef-9c0f-03a2c3e4d1b1", "value": "12288:wMrGy90UE97sKgv1veVpIymuse+6GNJSGH9LRa:myJ9KAJeIxuo6GNJX9LRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686063947, "uuid": "6b7ab552-02be-4ff8-aa88-a8d4989f4770", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686063947, "uuid": "a093bbf4-e4e0-418d-9b4e-9929914025ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686063947, "uuid": "849e723c-3250-42dd-ada2-e1f36e50d1ac", "value": "efa015ab2b5f2c15edea59878603ce2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c588c78-04aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686084130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084130, "uuid": "9104e53f-e1b2-48a0-b93e-eefca2b49536", "comment": "Malware payload", "value": "bd1d9b2ed712a1491c3064ba1c116430", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084130, "uuid": "1fff5c26-f80a-428c-8150-a624246d79f9", "comment": "Malware payload", "value": "1e64e1bc8f892358071fb50781acddee07838996cbd5fe365af6b07687993692", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084130, "uuid": "4df0a446-d721-4e68-95bc-752d80f89c35", "comment": "Malware payload", "value": "3e15eefd744d1677295746984b411998a851d932", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084130, "uuid": "8d2c0f98-2618-4586-8a36-55ff941e9f8a", "comment": "Malware payload", "value": "23e70e4b8808d3fa35b52d1d662a2a088111c10b286f36a50ac3a7d87de4e8370548ac137c9f12c30aae30293c9173c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084130, "uuid": "84857ffb-3ca2-4268-80cc-ed2acd6224ad", "value": "T1B023F2DFCA343D88C25CC9BEEA6B23C7ED8514B45447C7D1D749446DBA27582B3D8822", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084130, "uuid": "486bcbe4-a76c-4764-b6b8-09fb28cd053f", "value": "768:PkXkFRzP2p4k/2lIgJddgJ8W20+PbbndwC3gnvgwTwuMp3lHPTIEdWMn:VFZW4kulDJ0n2fPbTdX3gnTSp3tZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686084130, "uuid": "4417f07f-6abb-4886-ab3d-49873037c01a", "value": 47376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686084130, "uuid": "0ded9c38-2db7-48e4-8953-3710c6f77f3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084130, "uuid": "d232f23d-a9d0-4a87-8641-45840e3d7bca", "value": "bd1d9b2ed712a1491c3064ba1c116430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0586b7-0454-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686047139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047139, "uuid": "3e32fdda-74fe-4976-8629-9b4ff9537162", "comment": "Malware payload (RedLineStealer)", "value": "63fd95b4c8be46fa62f922aacd5e8587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047139, "uuid": "d77f1924-20ce-4216-8155-8c003468b42a", "comment": "Malware payload (RedLineStealer)", "value": "1ef0a8e136456d4c3838e6da079643ee0702d198b81a5c123b6fc8f2dd1519f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047139, "uuid": "2b8d4808-9b18-4bb8-87ba-e9925e876988", "comment": "Malware payload (RedLineStealer)", "value": "bde6e653db8df204a03f52f24c802136170083a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047139, "uuid": "31b9bb3b-889f-4844-96a5-2a1ff4d42560", "comment": "Malware payload (RedLineStealer)", "value": "0308d41124061c9443de1342a4c3b855250a2e1c8e51b9d97411e2e6cdaf4ce2eef5d50cf8cab3646ebb0fa1dcdcaaed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047139, "uuid": "a82ea9b2-8c6a-49a6-b383-9dc08635f02e", "value": "T107152322D5F80432DDF42BB04CF503870736BDA16D74976F3B9069A558A2AC0B57A37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047139, "uuid": "04a03086-d0fb-4122-aa09-0f600b2b4eb2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047139, "uuid": "7b774535-1879-462f-9e5a-1d076fe45bb2", "value": "24576:vytfbSuAhIBk40xckW/MLOgu+aMy1WgPnS7u08:6tfbuIBrhWagOMy1jq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686047139, "uuid": "5870a4ae-bff7-492d-8fe4-8029dd1e79c8", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686047139, "uuid": "82b3f01d-a462-4c69-aa0a-6b9e24b90fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047139, "uuid": "779d7ca7-aced-47db-9fc6-cf0a374369f2", "value": "63fd95b4c8be46fa62f922aacd5e8587.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad1672a-0461-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686052614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052614, "uuid": "b14066f3-9f59-405c-9fab-cd3c7aa6b7e4", "comment": "Malware payload (Formbook)", "value": "d2107782236634535608b5d0fd36df19", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052614, "uuid": "08ecb5c6-b59c-433a-b9cf-3560af2f4412", "comment": "Malware payload (Formbook)", "value": "1ef45be563fd52050d7495a7fdefa539c4edbaa316b69214bf3fe5c7c037a9e2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052614, "uuid": "286b9053-1d0d-4c77-bcf2-2e2f869013b0", "comment": "Malware payload (Formbook)", "value": "bab16f10311a97da34a4164fe4782d8a91966a74", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052614, "uuid": "4ae8f083-e019-42b5-8bb6-f5243ffa3a76", "comment": "Malware payload (Formbook)", "value": "1bdfa288e10e0fc9697a93dcc5f8f8be947d0fbeed91bd8c48e3e69f24555485502046d10f8bef303129e96d3e5ee25c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052614, "uuid": "b3289acc-b61c-4a3e-aaf3-d623c2ee970c", "value": "T14BD423B858D7651A23B57F6018842B33DA8E2F8930B9D1B39F73019E89CD194EC15FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052614, "uuid": "cc100dac-0838-4c0f-ada2-9a1a3aebffac", "value": "12288:Bg8PJjNA7B+DqyJGpjd7mqPZr2rKMR6aUciOjM5R+uGN97gGxKeqJ2aDc/ff6kp:BXPpFOyJGpjdnPZr2mMRbUOVNRZx9qRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686052614, "uuid": "232ed70e-931c-46d1-8a75-8cd749a7e162", "value": 635838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686052614, "uuid": "e7d2a5bf-bd59-425c-9aef-3d31b2ab9233", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052614, "uuid": "a557bbb8-c4e2-4db6-b8dc-f91821d72cc7", "value": "Receipt089838.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d416b3fa-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686059313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059313, "uuid": "0a4095f5-ae28-46ef-8e81-92255ac2c071", "comment": "Malware payload (RemcosRAT)", "value": "9aa44989b63c667ede9f25e26497c20f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059313, "uuid": "1b01a2f0-a828-4561-95b5-2e2cf40625b1", "comment": "Malware payload (RemcosRAT)", "value": "202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059313, "uuid": "eb46473b-1c1b-4506-9d9a-581eeedab624", "comment": "Malware payload (RemcosRAT)", "value": "28d3d9c5e486abf89ba305ca371271ceef9af55b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059313, "uuid": "988ec555-a9c6-4eb8-8066-02a711b0c371", "comment": "Malware payload (RemcosRAT)", "value": "5d9b6ca5beca46e1e7fe0b9ea471991d34799a32bb4ebfa1f606d9318f7a47aa8dc2c6f70d3652b1b253b7bf723b2f51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059313, "uuid": "48fec591-7fba-4dc3-8e48-e6b654209d6d", "value": "T1E0A4BF01B9C1C072D57261300D2AF775DABDBD212926497BB3DA1D9BFE30190B63A6B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059313, "uuid": "fae9d20c-3cd0-4633-a1db-20e1ad3d0621", "value": "3f3d4ba55ce3e8f736704310c56bf5aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059313, "uuid": "d9c94ca3-55e5-4649-84fa-a93b1b27126c", "value": "6144:h1EwL0xQk9VdeLuVnQs8QLgt8cBvnkCX/3Rde+A+DdsAOZZRXXrcN12OhX:h1EZT90uNQzYgScBvnn/XpTs/ZRdOhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059313, "uuid": "3419fe5f-ed33-4165-b558-dc52d475a8f8", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059313, "uuid": "bfa0a413-0857-49d3-8b8a-0875b9f7225d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059313, "uuid": "e1438d4b-c00a-467a-8629-b013bb63ad63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3b72b2-047f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686065747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065747, "uuid": "dd3c8dd0-147a-45c7-94fc-26c5722cc937", "comment": "Malware payload (RedLineStealer)", "value": "7a86c899903d0a6dc4d85a577434c6db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065747, "uuid": "0e92a28a-55b7-4a52-ad6a-feef8674114b", "comment": "Malware payload (RedLineStealer)", "value": "202e690447812603792d0a7bebc2657f724623bbbc418e35805fdbc975397120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065747, "uuid": "4bda9bc5-b5a9-43ad-8ab4-5826cf452f46", "comment": "Malware payload (RedLineStealer)", "value": "101534da15517334cd02368e0282aef11d368a7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065747, "uuid": "272ceff5-0ada-4a6c-a400-f99ef0a874cd", "comment": "Malware payload (RedLineStealer)", "value": "e9199594045870bfc005f3124bf431996d3a4d194c23d45a67127a83ca391d348d074ffedc82b4d3322c983b0a4cee7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065747, "uuid": "d053287a-b027-405f-8c0b-ab1ce9e50407", "value": "T1C8F42267ABC55572DDB62BB199FB03D307357C526938839F3380699A1872BC05832B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065747, "uuid": "7324265d-ff5d-4aa1-b12a-3cb5cc06085e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065747, "uuid": "4f3c8dc6-30ab-49b7-b0c6-31e87d8e348a", "value": "12288:4MrHy90+FrUG3YB60FXccGjC3AM1DuWvk6V/2MNY2S0S0obzeG15Mo3DQCotd71V:fyLALIFcRW58VS0KbzLPzQCyci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686065747, "uuid": "b7d7b305-ab5f-4b70-8f2f-24887c63455d", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686065747, "uuid": "20368051-827b-4d9a-9122-83867844f09c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065747, "uuid": "444edcbe-4135-41b0-8c72-155436ea36c6", "value": "7a86c899903d0a6dc4d85a577434c6db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e9d746-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686059259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059259, "uuid": "b5e24909-92ad-41b7-a4bd-81520074cde7", "comment": "Malware payload (SnakeKeylogger)", "value": "650de0e3d5a76ee569312726b2ccd79e", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059259, "uuid": "dc3ccdd9-fe3a-420c-9b2e-e759c7be4100", "comment": "Malware payload (SnakeKeylogger)", "value": "23bccc733779e2c39a4ce431a77b9f3317817972fc118f70ce59b735d98fe89f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059259, "uuid": "c5dfe1b6-cf59-4a69-a599-4b40f1ea150a", "comment": "Malware payload (SnakeKeylogger)", "value": "5e11c60e34e4646f6fcfc210709c8a4c83e37ec9", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059259, "uuid": "d435e3d4-40f5-4867-9525-7fc2fddd922f", "comment": "Malware payload (SnakeKeylogger)", "value": "ba5c5033fd14bd015dfde96612a88e4a7dd8ebce01920624c0ae1076961d7a975876d4d252e5ecf062a61db613d7cc4c", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059259, "uuid": "b41fabe2-7f05-472b-a0bf-f069453b3a99", "value": "T1F9E35A9D766071DEC867C4728EA81CA8FA5074BB971B8613E02756ADEE4D887CF140F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059259, "uuid": "1ca1be33-7595-4b5d-b7f0-92fcddf57cb2", "value": "3072:SVQAASLDjgl/8mgT9O4sP3fxEdXVCP9mPc7X9tMHjCSI8KGLQT3:SqA7LD6/6T9O/v+X56MOSI8KGLQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059259, "uuid": "cde88aa8-7e80-43ac-9dd6-921843799c0e", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059259, "uuid": "68c07614-4808-4f33-a330-9d5e66042767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059259, "uuid": "9d522ce2-7401-41eb-b6fa-efe075ba0eaa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5d9546-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017746, "uuid": "443d65df-271d-4fad-bc4b-807261452e32", "comment": "Malware payload (RedLineStealer)", "value": "a9d43d9f4c543471ec296a17d84fc4aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017746, "uuid": "37b3eee5-b16e-4b93-a3c4-abbdc3ec4714", "comment": "Malware payload (RedLineStealer)", "value": "23e5050f56c59eec354be12f922a4a134b59830c8e827b9bcd840d52489d0588", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017746, "uuid": "503ffc9a-889b-4e8c-ac2a-6e7363f98d78", "comment": "Malware payload (RedLineStealer)", "value": "ab4cea1abb84124539a4e8b5a9ec319940921e47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017746, "uuid": "24e020f6-17f9-44ff-aeee-b61b5f5a661f", "comment": "Malware payload (RedLineStealer)", "value": "6814b833b5e9188fc8bb7e013b53a0fcadad53116f37ab2899713b448f85e0e54a3110d01c7e53a38305cb138194c887", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017746, "uuid": "83236515-e8fa-4435-93fc-7504ce1be759", "value": "T106D41252E6E49572DCB51B346CFB03830B31BDA24978A637374A691F0872B80A57277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017746, "uuid": "fd3ce259-c846-4444-88ca-ee8e52059a2e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017746, "uuid": "1074b53b-7b1d-491a-9380-25402a4efca5", "value": "12288:eMrPy90l8rHiOLBelXY6IzRv0YRJJb+KaVp0l5orZuTb46hJqPRe4ukXis:9yiaiWBFhlhbepc5orUc62ZZXis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017746, "uuid": "7a70a30d-f0ab-4639-ad7d-fe07581d7722", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017746, "uuid": "5f32a9a2-8f8e-4131-84d9-c4c3c904141f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017746, "uuid": "8ec99dfe-1279-4b08-8596-8b550d4ea03f", "value": "a9d43d9f4c543471ec296a17d84fc4aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9ea6ec-045b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686050308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686050308, "uuid": "313b27f3-e82c-4dce-932c-dca75e6f1a55", "comment": "Malware payload", "value": "ab550e23ae2523e1c57538a081ee9d45", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686050308, "uuid": "bb70fa10-c535-4ec9-8cb0-fbf57256d606", "comment": "Malware payload", "value": "23fbff3afdf8b2174d3cf1759db4c4e6d0887d8b644835a7cb70c11baea7d20e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686050308, "uuid": "9143dcec-a146-4326-8e89-d9475dd331fd", "comment": "Malware payload", "value": "5adbb0dd27bdc5639e81afdb33c1284dafb15791", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686050308, "uuid": "90f6f035-29b5-47f0-84f5-fcebc2af8b57", "comment": "Malware payload", "value": "c2038a78d87e5f10f562f9b25d27d953f500dfb47bd78fa71e1d61a8fee0753baf1a3719016a77b1f61568821e574462", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686050308, "uuid": "18d17930-c2b5-44a2-b343-470d7c7d9ea4", "value": "T16E46334EEC6769C0F6E93B4458B1FEBD93EDB22F1648479061B110F7B469920EBA0374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686050308, "uuid": "c36e4654-4148-4917-baee-6bc9513b7ca2", "value": "98304:DpQZolTtpJVunBY3KTsCggFO5JvOazKg9EkxJUkqTVymYeT1VOsznqF:DpB9LwYUsCgDzOEE2UVjldmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686050308, "uuid": "de84ebc5-f77b-43bb-accf-9d0683d72fea", "value": 5844934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686050308, "uuid": "15d4a1d6-1123-4c1a-bd4b-a4bad1e301d9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686050308, "uuid": "9b26b291-6bb0-4f2f-b4f3-20154b8c7d12", "value": "dllhost.exe.sample.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd44ff58-040f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017721, "uuid": "2e3e6430-6ecc-4b5b-b769-6d72d08c71ba", "comment": "Malware payload (RedLineStealer)", "value": "06f847e002fad66523d7345a0ac502f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017721, "uuid": "2735ec01-41b0-4d21-9971-014486549779", "comment": "Malware payload (RedLineStealer)", "value": "23fc1064282732199ad662b196d1bf0ea0041570247c4958b81e8d87978b7ca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017721, "uuid": "5eb10fe4-c1b5-403e-8192-9588a8d4086e", "comment": "Malware payload (RedLineStealer)", "value": "b368ae5520633b422dc622fd54e66411e2b1b1db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017721, "uuid": "a268bf93-f725-4422-85e9-e1a364fd7bd0", "comment": "Malware payload (RedLineStealer)", "value": "b9e86e74c334c8db301ceb9097d4881d1bd35928bc553c4a43b1d8d2c5e3f3316bbf226ed2e1865e24ea849d193801bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017721, "uuid": "df8b11ac-dd81-400e-b4ad-b4b0c0ad40e9", "value": "T1E5D41203ABEC1632E9701BB048FB12870B36BD615979576F3356995E0CB3A84B932737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017721, "uuid": "9270051b-31c9-44fa-b2c2-025282f2b5ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017721, "uuid": "8cd1b5c3-4ca5-4b75-aadc-99a40ece04f1", "value": "12288:zMroy90oBdmyc91ZSZWbZ5Uw9dBXhxWs1j4TsLF+XbAN7zBm:DyPBI4Wt5d9dBXL+TqgqvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017721, "uuid": "2519f328-8b0a-45c3-9585-d64c9f60eb52", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017721, "uuid": "441b95d4-62df-4ac5-8266-861e7c61235e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017721, "uuid": "26e967ac-89c9-4f36-beeb-800a001fc024", "value": "06f847e002fad66523d7345a0ac502f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a609f41e-04aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686084147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084147, "uuid": "18bb4512-c5d4-41b9-b42b-6304b710278c", "comment": "Malware payload (Mirai)", "value": "24f81b0d2dc32057422a614c09e958ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084147, "uuid": "03326eb9-5002-428c-84f9-02b364e6fbfb", "comment": "Malware payload (Mirai)", "value": "24710428826b12e26dd7d0a273572d7d6d3b16d8420ba443bf1f37468da532fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084147, "uuid": "d9824344-c5f9-4de5-8a01-920102191a4b", "comment": "Malware payload (Mirai)", "value": "31b20bca2aec31cbe0f3933f0de63b6cf4b6ca94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084147, "uuid": "408dcb1e-4a71-42f9-8041-e3f18c7a8704", "comment": "Malware payload (Mirai)", "value": "1efb6f67b48018746d6916dd01763aaed2da4fda5685bc46aa77e7a7af7f2e2422110d4caa3c79b8f4020d80b0ab27e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084147, "uuid": "b5901ac9-18e5-4662-8404-ff76208abfea", "value": "T1CB13F1A5F5819AC1CFE12DF32D3DDA983792D7CC3BF721A813049E29286817649539F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084147, "uuid": "eb1b98af-f5a8-40db-8ce7-eae8eb7805fe", "value": "768:oWO/gtWSpYCjdnTe4FlfGZzyqxW4WVI4MAqUBeEJ4uVcqgw0RTWXQ:oWO/GYCjdna4SZzyqg4yI4wUBr4u+qgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686084147, "uuid": "2b63d086-69d5-4c60-a09f-2bfb09fce170", "value": 43420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686084147, "uuid": "a28c0589-72ac-4d6b-80d2-c80607f8b8bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084147, "uuid": "854e7c9e-5068-40a5-8e58-3573457520c7", "value": "24f81b0d2dc32057422a614c09e958ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1553c39-047f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686065751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065751, "uuid": "2c29cd6c-fa86-4da2-8016-d968f4a4747a", "comment": "Malware payload (RedLineStealer)", "value": "ec7fcaaed32badde93aeec8063479448", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065751, "uuid": "c929ae35-b072-4bd4-8416-05fd4f306526", "comment": "Malware payload (RedLineStealer)", "value": "24eb6393c2efe3f2e9526f6d344af6fc709ae52125c0da80b2951a0412855b58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065751, "uuid": "44cf7c85-73db-4646-9dfe-a1d23514359e", "comment": "Malware payload (RedLineStealer)", "value": "9ee7c1b819f6641c2c096f5f1b79cf93d377a606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065751, "uuid": "8e9c4d0e-51c0-48b3-82c3-38e40eda87ec", "comment": "Malware payload (RedLineStealer)", "value": "3ee10bbfd061ed24a3e91fa7a4671a36fe1fd266cfb87cc0e596567a8cfbadb2bcceb01aaaaf9c30ad342528578fe0bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065751, "uuid": "2ecb8a47-e5f1-4d4a-b77b-2e3bff01127e", "value": "T1DDF41202A7D88573E9BA177008FA12D31F397D924939875B2785D88B6DB36C4BA31337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065751, "uuid": "343722fc-98df-4730-b5c2-38fd8e4f49d0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065751, "uuid": "b0a69baa-0e6c-4df8-9a2a-a0a713306b41", "value": "12288:DMrLy90xCiqfVY/zfy6gbBmcgIMmP8OtjyscNPmEX0GvOYWDAW:IyGk+OMDmWsqd0kW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686065751, "uuid": "39a52d79-da7e-40e9-aa5b-af3602c68ffd", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686065751, "uuid": "6f79acb1-b5b4-475b-94fa-bb7dd6768211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065751, "uuid": "0d46f53a-5a39-4849-85c7-98e33c4109f8", "value": "ec7fcaaed32badde93aeec8063479448.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce985be0-0419-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686021938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686021938, "uuid": "023f1f2a-38c7-4443-956c-3f66b8d16114", "comment": "Malware payload (AsyncRAT)", "value": "0f3a96431372569b08e4ff29618705e5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686021938, "uuid": "557b7eec-f0db-4fe6-a9a1-8a84fde1a615", "comment": "Malware payload (AsyncRAT)", "value": "2571269949580368a87a0e89bcecc0957e539a6a0132756aa998fab9e35ddc82", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686021938, "uuid": "776fcb02-c6bf-47a4-a70f-624a4bc67df2", "comment": "Malware payload (AsyncRAT)", "value": "fa10c0c72a91603dc14aad5200a9db52f8409ee3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686021938, "uuid": "b4c23ebe-5dc3-4b00-8009-b4ccb0e9bd1b", "comment": "Malware payload (AsyncRAT)", "value": "ccef3439930d50b862f8ad87e80206e20a2c8051d5717a39aa1fb442297b2842cc3bd30c8e694a94e3cf49a827c369bf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686021938, "uuid": "9105a25e-a121-41f6-9922-7a2a32759f99", "value": "T106233B0037E9812BF2BE4F74A8F22245867AF6677603E54E2CC441D65A13FC69A425FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686021938, "uuid": "84ef66d4-760b-4fc3-bf7d-9649f5806f60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686021938, "uuid": "60206a91-aeb7-4420-80ca-31403f4ba8b9", "value": "768:auwCfTg46YbWUn8jjmo2qrrmux2zfPIwtzNQwN630bnjmrvcyiqhYdNx/BDZ8x:auwCfTgp/2a/M4wtckbnjgUvdNxJd8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686021938, "uuid": "07d77808-c0f9-447a-95f0-c0ce46f78ec4", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686021938, "uuid": "5285209a-4c8f-4bbb-bc12-d6f3870232d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686021938, "uuid": "a5e8afc2-0298-4762-8938-21f0836d47a3", "value": "0f3a96431372569b08e4ff29618705e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c3a6bc-041b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686022539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686022539, "uuid": "17488dec-9629-44ee-8564-1928d86d0989", "comment": "Malware payload (DCRat)", "value": "0f6e4f12eece56cbf783c923b9fb9d88", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686022539, "uuid": "8ef0e5dc-07db-43a6-aca0-3add2bb7e37c", "comment": "Malware payload (DCRat)", "value": "2668b2bc1d53c208306668d88a90e2bc00abd3e53727b88f018aa68c0cb26530", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686022539, "uuid": "e2577b2e-052f-4d7d-862a-4570e9008308", "comment": "Malware payload (DCRat)", "value": "febb8eff62525fcc355178c5081c664b3404f676", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686022539, "uuid": "a005254e-b158-4f1b-9236-d279e319ac4f", "comment": "Malware payload (DCRat)", "value": "d9dc7988694e733532f96b192ab10e8fee0ca24491a7e66d392141f61c320a6dbecc319d297a974c78fa5016a23d91cb", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686022539, "uuid": "db1e08c7-9f3b-491c-8a0b-1f67929b324f", "value": "T15D45FA342EEA5029F177AF7C8AE47596DA6EBA633707894D10B103CA0723B41DDD163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686022539, "uuid": "54291c22-959a-4226-ab91-3bd8a340f01d", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686022539, "uuid": "d6de62ba-95ec-44df-ad39-78af97854467", "value": "24576:P2G/nvxW3WZ930qD2qcmxQxyCiq+FMmxtwVabyAKl:PbA3EEgjcjPk9LHb1Kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686022539, "uuid": "fed709f6-84a7-4a3b-8d09-3507ac96e45e", "value": 1219749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686022539, "uuid": "41cecea9-b964-4bbb-b2f4-8ae002d2c3e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686022539, "uuid": "c4d48435-c91b-494b-a5dc-99effdff44e6", "value": "0f6e4f12eece56cbf783c923b9fb9d88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eccf3cd-0441-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686038930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038930, "uuid": "e46f1473-08c7-481d-928d-a99a435f564c", "comment": "Malware payload", "value": "4c155a4b5c7a7e379b3642a1048a4864", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038930, "uuid": "b73949db-7d0a-4440-9509-587b97197a47", "comment": "Malware payload", "value": "270861db0cd0f712b034a62e1049ce6c2c46ccccac61c62d98e63d22a2ea5b96", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038930, "uuid": "5aa3b1ba-2e18-4089-be92-b902c9b59c07", "comment": "Malware payload", "value": "6c2cdaeb7b3ffddd6231c549aa60845277607b35", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038930, "uuid": "5d42cdb6-9768-47b1-b36f-c4d2b0442859", "comment": "Malware payload", "value": "a7ab400e4a59fbab2545ea0e138c40948eaa156cbaba4362a7938fddfb08bd0065236af5b252e6888c3978d6eae893a9", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038930, "uuid": "6eacc11b-47e5-4d34-8346-e6824db38725", "value": "T1722439A55B504A62E1AC4B3BA8EF05004FB2ED01687AD34679EC71E90F33B75750D78B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038930, "uuid": "cd2edfd6-01e2-4a6c-b58b-93d5df2ef3c2", "value": "3072:dUexiOz3YCn5wUA0TSqCReP91qZYQuemPhABpy9FAeRqNWlc:5IYS8QuxPhA3eRqNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686038930, "uuid": "f748b391-9554-4663-9136-1afc717554e5", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686038930, "uuid": "f72ae38f-9988-4ef2-9528-9d5554c9e42e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038930, "uuid": "6e8efb45-bbe7-4ae0-92b9-6efc89a42c05", "value": "STMTCMB100_20230501.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d18c0af-0454-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686047141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047141, "uuid": "8df15975-59a0-4457-ad0f-f28c0df2be51", "comment": "Malware payload (RedLineStealer)", "value": "57b747f1badc316a721c299f41caa3bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047141, "uuid": "60d6822e-8311-4759-a28b-30f3b99ba9fd", "comment": "Malware payload (RedLineStealer)", "value": "271dc24ce0ec9142ae5e20bf9b09d65032a87c48ad8d44d3b91c5ad2a06b2001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047141, "uuid": "1042adcb-7d93-4455-88b3-4a2b9e6d375d", "comment": "Malware payload (RedLineStealer)", "value": "c9365b7a20a41a6182445a11c80c823a7a83459b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047141, "uuid": "175f0d4b-7b86-4f60-a1ca-76b6647e36e7", "comment": "Malware payload (RedLineStealer)", "value": "7b5e423c4e5545ebbd17b1d6cf9d0e8c1c2d28998b994c63142d1ded51f6ca30c9b266df7f7bbf1cdcee6d9b0c3d624a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047141, "uuid": "59109c89-2526-4bef-9a66-1cac537ebaf1", "value": "T191D41203F6E98972DDB627705CF707870A347C666C38566A27D2A94B1D73AC0A83077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047141, "uuid": "c366fb46-4ae2-45bf-a04b-e3379a13f242", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047141, "uuid": "bfc71e0c-ad15-4c3c-84e2-b150a95044ed", "value": "12288:MMrKy90NWJD0qBzHJBRNXZFMgmSOCPNTTnms2/eLs+:2yE+rJGgOs2/ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686047141, "uuid": "99d9cd6b-27f4-4ca1-b9a7-00976c7adc50", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686047141, "uuid": "caa8cd5b-0077-4eb5-8679-593e28cb0e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047141, "uuid": "8f457dac-4cc7-480e-8184-f9435e69441d", "value": "57b747f1badc316a721c299f41caa3bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0822d74d-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017739, "uuid": "a633cb52-dd16-4d5e-822a-a0b94e4daf3f", "comment": "Malware payload (RedLineStealer)", "value": "17a7002275a81e4575fb2678117d6400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017739, "uuid": "47654f09-a4b2-4418-9bd0-b746e5abeaea", "comment": "Malware payload (RedLineStealer)", "value": "283021b5fab73ef530361f9f028e7e971dc23867a0fdbe00d1d9847a6b4b1868", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017739, "uuid": "6d2a60fd-b9a9-4598-80bb-98ce17db40f5", "comment": "Malware payload (RedLineStealer)", "value": "ab9e2258ed1131588067de7267fec4796f89d060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017739, "uuid": "d1eb7e9a-aaea-4777-8113-2060b326d1f3", "comment": "Malware payload (RedLineStealer)", "value": "e0761f7bac577f9c6d8e3c926a981094da8f8eb9cd7eaf9ea6e2a83e5d50f427107d96c97a77287449ad37e26ac98b10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017739, "uuid": "b3a4121b-1ccd-4575-804c-7f0fd8525bf8", "value": "T1B0D41213DBE84463ECB0277059F2175B0B327ED20CB8939F234B994A59B3584A97673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017739, "uuid": "59b5363c-5cbd-4829-8ce0-d09d58467b77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017739, "uuid": "27d6fefa-aa36-47ff-9669-15cd6e82d414", "value": "12288:rMrMy90Bak5eUK0y0Zq7DTcTF+6K+BlczXM+nReoHTfi//Kob:3y+aTUK0y3MZ+6K+BlczXM+UoH+nrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017739, "uuid": "6da8f143-8f62-41d3-bb57-609c153cdeb7", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017739, "uuid": "c49cea13-8327-4b14-b697-b4d72bed9ef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017739, "uuid": "51a63152-8d25-4001-bf52-0c7ff3bbf9ab", "value": "17a7002275a81e4575fb2678117d6400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2997ab5c-043f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686037982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037982, "uuid": "ac2bc2df-d737-4edd-8414-c795e721878c", "comment": "Malware payload (Loki)", "value": "6eceb7417321e5af21e101b4c3c6fce4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037982, "uuid": "2227707b-54b4-49ab-b15a-fd9c2696b364", "comment": "Malware payload (Loki)", "value": "283bae702fe2d684e28a4847cf259e3aa2d2d52e37774239d8a980033c6da5c9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037982, "uuid": "009745c5-21f0-4016-a75c-0c6769647b37", "comment": "Malware payload (Loki)", "value": "72df66effeb82f190ffd3fc08f17a9dea9e9699f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037982, "uuid": "efcabe56-9c2e-485e-a533-ef4df573a736", "comment": "Malware payload (Loki)", "value": "c5b3279a05cc80e66a6e9cda73d9525c039a74dd77fdb248ad6ddb1f1c44cf05d1a3317aeabf093ede187c44a825823a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037982, "uuid": "a611ffa1-4461-416c-9bb4-431e8c3055c0", "value": "T1B8B423DEB3CC3177CE922A3CAB33B53C17E8534CC47686A898656AE3719230594EF495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037982, "uuid": "590643c6-5a63-435d-a344-5e539bb69536", "value": "12288:qCL/T8SjsvpHfO666L3qX+DfNI5xrUG6UgZMBckueQ:pvLsvlm0zN+gZMSDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686037982, "uuid": "0ddf5eb8-3e04-4905-bdec-412dcafcc1b3", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686037982, "uuid": "d95b640c-12a1-4adf-b9f3-176820092e0b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037982, "uuid": "6732bd55-dd4e-4bc6-9d38-bae813d3ec0a", "value": "fund transfer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc1ed87-04b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686087008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087008, "uuid": "82086955-b9e8-4e8b-b53a-602b67426bc7", "comment": "Malware payload", "value": "391e6e94a391388c4957ee298b0316d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087008, "uuid": "0ab65bee-d359-4b8f-8af6-36d2d0ab23dd", "comment": "Malware payload", "value": "284690f1f6f09f5d12624bcc09a9de774504616d91a3b9ebb2cc23588bfc6e7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087008, "uuid": "047f3736-b8bc-4600-afe7-53d443bc5773", "comment": "Malware payload", "value": "4520197bbbd336ce432c93179fb7b57d68e89b03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087008, "uuid": "7ed9a1e9-4f62-443f-b25c-98a643c1cc2a", "comment": "Malware payload", "value": "1c94aa13a60351c6ad87110c3e85f622de5e05d3aa3cd1f73d53c6b5b71f6ae542fa873076e17fdbc97fecb2cbd6f39e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087008, "uuid": "f3026f8a-6f73-462c-ab8a-1b055d1a6cee", "value": "T17804985E6E228F6DF66C873547F74A20A75D63DA22E1D684D1ACC1102F2039E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087008, "uuid": "0f258fad-7e81-49cf-9689-18353c92243a", "value": "1536:glqznzwy7h5G6qpRFtPvYNrrbJevW3rkved11FCwtNz/TwFyRMZh59Ki:0qzx/cztHYNrHJevW7FFCsqyuZ39Ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686087008, "uuid": "3fc2aff9-bdd8-46f4-ba72-f5d1a1655009", "value": 173316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686087008, "uuid": "0541531b-ee87-4caf-b42b-324a29dc171a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087008, "uuid": "247b7d34-904f-4d70-b1b7-f5ac1c320f9e", "value": "391e6e94a391388c4957ee298b0316d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98679a88-04a2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1686080688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686080688, "uuid": "4655386d-60f8-40f3-a6f1-9b74b65213f6", "comment": "Malware payload (ModiLoader)", "value": "b7e783353c0def085c08410a4a11c15a", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686080688, "uuid": "45b5477a-484c-4c0f-8872-f7e71d00e28a", "comment": "Malware payload (ModiLoader)", "value": "290f01664f61eec328749791f90b438a88bda6d8e7249bdad205847280ac2f3b", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686080688, "uuid": "abbdc966-49d0-43e6-b286-9b35f9647e24", "comment": "Malware payload (ModiLoader)", "value": "84ca99334fc97ce21d77c6cce8640e3a7510dc72", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686080688, "uuid": "3e61dd62-3c9d-4cdd-8650-01b2f2fd4051", "comment": "Malware payload (ModiLoader)", "value": "5211f2850e4b509caff73eb38b7262ae3bba153d2f6006b41b26ce7e71fa86fc56c93712dd5ebec7d8af598720306f8d", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686080688, "uuid": "1faaed1d-5185-4ba8-9480-c82ab0d350ac", "value": "T1B5659E16F6A18C73D46669788C0B57695C14BFA07D249846BAFC3F4C9F3E6803829E73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686080688, "uuid": "d9637ac0-f43d-4c21-8dde-02e2fdd20394", "value": "12288:G39wCUzsHZGNTBQ+qqKY6kROWtMgPHY796WmQvXZb0nSojh:GtwsHZCQoKY6sLHY796WmQvpb0Sot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686080688, "uuid": "39119675-eded-4581-b35f-a90baac8aa3c", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686080688, "uuid": "7dc21c9b-66e4-4906-a96b-36d65b4fa007", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686080688, "uuid": "78241566-8adc-45f2-9779-6ddc2b2fc149", "value": "290f01664f61eec328749791f90b438a88bda6d8e7249bdad205847280ac2f3b.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eba4efc-046f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686058687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058687, "uuid": "b3c7c624-2ef1-4b8a-9bfe-787266e9019f", "comment": "Malware payload (Formbook)", "value": "9376c0bfb76ecde13ae386bfd3a7c60c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058687, "uuid": "5d6e1dcd-982a-4124-89ec-56995bfde511", "comment": "Malware payload (Formbook)", "value": "299291d471f70a3c3b81139ee364d66c178cbc184fb8b51b7bae476f3593c7df", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058687, "uuid": "f319f6c9-a80b-46a3-9803-c003c330b730", "comment": "Malware payload (Formbook)", "value": "245f9228d6b2b84626a60bc7bc9410830f647303", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058687, "uuid": "0faea14a-1d11-471a-b132-e19874f6b362", "comment": "Malware payload (Formbook)", "value": "64ed394882f1b3ad4a83e6b69c14acccde341f442b2abf2261efefd4bc67b793b8154f9e8e5ad2080f75a853cc675dc5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058687, "uuid": "ec8b27ad-f020-4266-b679-8161295d508c", "value": "T1C4E4234534666C3C8B35E99F03F62CA488822577DB7EFA1CBABC908F125ED6D011697C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058687, "uuid": "1ba657e0-d5db-449e-bea1-b184df11c496", "value": "12288:doNTK+tzukAern4EBXInAy6kWzcbxZIO8kOXbZl0SvhF+GcC8Tvxc/MwTg6V1WRm:doJzskAE4pnAdYbr/sl0ePb8roMlwOIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686058687, "uuid": "d006d140-0300-49c2-bf82-c61e9051cb6b", "value": 701907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686058687, "uuid": "3b46d28d-fde5-4003-81c3-4d7f4e7653a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058687, "uuid": "08f61de3-5200-4d33-86a3-098752fb6ab2", "value": "Proforma invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b597930b-0463-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686053678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053678, "uuid": "776844b5-cb0b-41f6-9748-059dac9e104f", "comment": "Malware payload (AgentTesla)", "value": "cdaee4065e73ef384a5e478cc473b150", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053678, "uuid": "8b9b1fb9-2ecc-442c-b8df-98f42c05b0d7", "comment": "Malware payload (AgentTesla)", "value": "29aa707eebea9db8d1fc08ab40b829314c0e4299d79e73dd810cd17421e0ab2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053678, "uuid": "9980aab3-3034-40d4-8abb-0b0a2eb88c8e", "comment": "Malware payload (AgentTesla)", "value": "dad9c3ad78fe2d47f94d18444ae5b67503b76175", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053678, "uuid": "4bee4561-36ba-4e1f-a60c-afe0b6ef0460", "comment": "Malware payload (AgentTesla)", "value": "d8c3715a7d6983ee969e910c9dcb100c43ab4620e985a110e6e449dda133511b5fbfdbdad9419a3fdd89fe8824f294fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053678, "uuid": "d93773fe-d1db-41f8-bb10-1c328323b751", "value": "T1E5D423E557B8244564FD78B98B3A0DEDD4368A60D6833DFAA2809E09C73FBDE10D8056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053678, "uuid": "cd4258ea-0654-4d72-8b82-1ce5b0109ebd", "value": "12288:KvZ58Uq+dZ3Kz0f3e2uyGMMg4erKvITFfY5VK72wCXgXITMyJ62kMR:uZWUq+XazQ3eKGMb4ZvITOG5A68MUrke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686053678, "uuid": "0fb2b377-5db7-4611-b488-c2a0f45578aa", "value": 644070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686053678, "uuid": "7c0dc0ba-4389-4a2b-aa08-8e0f7c46100b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053678, "uuid": "c0e3da48-e28a-4359-95de-b492d8aabd13", "value": "proforma invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5245f790-0477-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686062102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686062102, "uuid": "a466e867-cdc9-4773-9be5-dfad84ee7e4e", "comment": "Malware payload (Formbook)", "value": "33419bd9a927f0170d3a7274482a1ce9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686062102, "uuid": "423df290-14c6-42a3-816d-3d3aac227ee0", "comment": "Malware payload (Formbook)", "value": "2acdfdb04a263fcc0cee2cc095f2b189c25bd882c77f69e8baf7321d2b77ddf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686062102, "uuid": "2cb8e478-115f-4070-9df0-663be4a8209f", "comment": "Malware payload (Formbook)", "value": "5575e8e321109705106766fc2a940f6e3aab562e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686062102, "uuid": "1fa94494-96ca-44c5-a4aa-998ead52b7de", "comment": "Malware payload (Formbook)", "value": "ba96d3433e3c259764c9f07109698d3db0b8430a76b1fcbe97c06bd9eec5aba6dd912d986c51e135a532308e27ccd333", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686062102, "uuid": "3411461f-bc97-4eb4-9f88-e64962acc617", "value": "T11E4412285A61C097D9A34B717D3A4123AFE7BC1914A8AB0B23701F9C3A737C99D4FB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686062102, "uuid": "7cbd3280-f03e-4f44-82b7-d9d13c101846", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686062102, "uuid": "53a84931-0c57-492f-a0ab-8124cfe5159d", "value": "6144:/Ya6RZKpod9pQ5XNfqLgEjbn/Rwy2eCVSB9lN99+zej:/YjZKpskdfEgCb/RwyQe9Cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686062102, "uuid": "67d63064-1262-4d5a-8432-e9b4988d2185", "value": 262201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686062102, "uuid": "6b07d622-9f1a-49fb-8d6b-b938ece8c48f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686062102, "uuid": "1f1f9b5d-c0d0-4c41-a120-981b36e0ba38", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.22780.25856.30865", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4fde2be-044b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686043423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686043423, "uuid": "2b2dd8c6-713f-4fae-ba4c-18b9c2a694d9", "comment": "Malware payload (Formbook)", "value": "b1cb71af672181e608de908c16d4b835", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686043423, "uuid": "d612b4dc-967a-44d8-be66-e2087ad3e236", "comment": "Malware payload (Formbook)", "value": "2b6923e725beaa10c278e54a42de3a19992691872cb955d7ece300beb69f44be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686043423, "uuid": "133ea1af-438d-43b1-a5c8-1e52c6f6e67f", "comment": "Malware payload (Formbook)", "value": "ffa4a6dc94cd90d52b1e1da0e65b20b4aa29f502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686043423, "uuid": "70e16f26-7c59-4a51-96e3-b8d28a85cbe0", "comment": "Malware payload (Formbook)", "value": "056ed17e5e8818c5184f2e5530f08d21feffb34f81233585f5b0b5ae640866d138e8fd7783d495631cdb51e1c71febe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686043423, "uuid": "e19f036e-78f7-4ada-aad6-7062e7e15538", "value": "T10E05011862FADB16C87E7FFC08D0A1B043F0A15A3156E7464ED368DE6E74B428F4199B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686043423, "uuid": "75297c44-6011-4073-91a8-20a44a2f3c39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686043423, "uuid": "d3ebb2c9-8cf4-49a4-ae56-77a0c9e55e1b", "value": "24576:dMwkLHlWxMiQW/O4ue72+fjW3SjbIOqJ/6YFjx:rglYMiQWmS7JW3ybIbRD9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686043423, "uuid": "6e8dcc74-d141-4aa0-9563-9b8949232f42", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686043423, "uuid": "cf7fefe8-7db2-4d24-81cc-10fd7f037c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686043423, "uuid": "755f59db-59eb-4862-9e67-01d10a3430c4", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf33cd6e-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686059278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059278, "uuid": "3ff34d02-3662-4fa8-b159-53560361cf51", "comment": "Malware payload (Formbook)", "value": "d0fcf07578d878049de1599cfa08f0aa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059278, "uuid": "e8620517-7c39-47d6-b28e-34f1716b39e2", "comment": "Malware payload (Formbook)", "value": "2dfdbe81ec48898307cf9d5373df1a1e0eef3d9fd8560726cedf7e68a9dfc19e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059278, "uuid": "05e64be3-0c5f-4c4d-8f74-2dcdfa2027d3", "comment": "Malware payload (Formbook)", "value": "37905e6216c815ba00eb22f8fefbcf4eb49f1e8d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059278, "uuid": "ed5f52f8-ad59-44c9-a634-ec7d05cc4f4e", "comment": "Malware payload (Formbook)", "value": "720a76fc395a41ce0db8b6def903726372f7c3dc77671c76a75f4fde52af58f7fc9e9ff7c0d98695f7f5c1bb75b76af5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059278, "uuid": "4b962882-361f-4c16-ae44-077e0078640b", "value": "T129A51223E057AC7EDE96CB785BC36484D18D7D1BBD8E18452724332B76336E2A29234C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059278, "uuid": "0056e0f5-0770-4d2b-a462-87bc0108f36d", "value": "49152:vLKYsyZO0m3O0txZ6syZO0m3O0txZQsQnnNy3MP+Xb:j7sEmztKsEmztgfn43FX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059278, "uuid": "37904c30-8d18-46b7-bc5b-4d5986e67ac1", "value": 2112512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059278, "uuid": "2593880f-277b-45bd-8c29-480e3e4ab1a4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059278, "uuid": "89f9d46b-0da8-4a90-9a9f-c33875f334a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b51ce5-04b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686087523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087523, "uuid": "7cc62283-4cd1-42c6-96b3-9286d9ffe058", "comment": "Malware payload", "value": "179d4849f8d096122d05de3c7bebb4bd", "object_relation": "md5", "Tag": [ { "name": "1685959443", "colour": "#EA07C8", "exportable": true, "hide_tag": false }, { "name": "BB31", "colour": "#5D69A4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087523, "uuid": "845bec55-95ef-4f77-9033-55dccd64e898", "comment": "Malware payload", "value": "2f6ae770a5d56ed8a2cfe262e196363b5c80e58468c66ff36cdf9c75306c2c55", "object_relation": "sha256", "Tag": [ { "name": "1685959443", "colour": "#EA07C8", "exportable": true, "hide_tag": false }, { "name": "BB31", "colour": "#5D69A4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087523, "uuid": "b9b8147e-7210-472a-8f40-305811df1f4b", "comment": "Malware payload", "value": "ee3ead69ec6801721cde4ca6480f30ecff948c08", "object_relation": "sha1", "Tag": [ { "name": "1685959443", "colour": "#EA07C8", "exportable": true, "hide_tag": false }, { "name": "BB31", "colour": "#5D69A4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087523, "uuid": "936199de-2f4a-4a3b-88e7-650560b2cfa5", "comment": "Malware payload", "value": "07da7c40ce340a2a4acfc5203584053a91d141ec0f7b08ed8e4d33be88becb0a9393fe1878984bf02abec4f368809044", "object_relation": "sha3-384", "Tag": [ { "name": "1685959443", "colour": "#EA07C8", "exportable": true, "hide_tag": false }, { "name": "BB31", "colour": "#5D69A4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087523, "uuid": "1654c483-35f1-4c31-9d0f-6f4a1db45a81", "value": "T1B9B4D011E782D0F2C0AA1076916B6A275AF94B311735D9F7B7B14E2E8F217D01A7E3C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087523, "uuid": "885f2cef-feb5-45da-8849-0f291d78a712", "value": "8e0a1f2284a5f7dab96c697a66241e4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087523, "uuid": "17b5c877-1ef2-49c7-9228-373c650c2c5c", "value": "12288:W5XwIjvPgzGgQChM5u/7hIYArytfqYsgzelZ7CPZUeQ58:njhhArytfqYsgalZWPRQ58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686087523, "uuid": "2cfed97f-d745-48d6-96e8-85a99e24f451", "value": 508020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686087523, "uuid": "232624e5-74d1-4287-a0c4-87a9ae4ad8e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087523, "uuid": "0f259378-38b6-4a98-9003-be4bc1dbaaee", "value": "batteryacid.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a85995-0461-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686052635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052635, "uuid": "c67b0bfc-09ca-46c5-b509-c55e1f995923", "comment": "Malware payload", "value": "0a830748e13c66d1436dc4a7c81f74b9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052635, "uuid": "6fe8409a-9419-476b-9259-6bfe93aa061b", "comment": "Malware payload", "value": "3051e51bb464877b08c81516332edd4997a4a37bfd0d9702b456e677070ca277", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052635, "uuid": "a9387fff-bb79-4cbd-b2f5-11d5981f7304", "comment": "Malware payload", "value": "56f28161ff68750be8fc78a77a49c69df350536e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052635, "uuid": "bc29001e-3bae-411d-aca7-8a7c86c26901", "comment": "Malware payload", "value": "1e44e1677ed01f959c183beb6fb9883ff19108d4a54048f5057ceebce9d85269b02055933e85f0018e35464d4b9dcf64", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052635, "uuid": "ddbe1e37-70cd-42e1-af8d-5e1816705575", "value": "T1EC62194B8D4B1E416FE05BC261DEA8ED5C2D87CF24D0085EC62AFFC9C61A224A2D55FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052635, "uuid": "57ef141a-ec50-4dda-a927-d77d03562c8a", "value": "384:LqW2gahOZFkLObBnPGdYxNAPoIIklxYqoprLlH6QK9o/gWwaThTZbCiQfEW:LqrgaUZFkLOtnPEYxNAAIzlxYNprLlHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686052635, "uuid": "9cfd764d-6ff6-470d-8ed9-128ebad9fb5b", "value": 15351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686052635, "uuid": "5b12df2d-f823-4a64-a257-a4e9d281024e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052635, "uuid": "d5a7f6ad-7e40-403d-9399-59e3bf6fab06", "value": "kte.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591ba86a-0440-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686038491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038491, "uuid": "ab3f28ed-bda5-44d7-8d20-9925731c876c", "comment": "Malware payload (Mirai)", "value": "fd4e382ab60871013969dccac3a36cce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038491, "uuid": "cc987ee0-3afd-4818-8581-9c450a326cfe", "comment": "Malware payload (Mirai)", "value": "311cfc9c5477fdf2643aee997ae20a7b806b34f3b6067259f9e866d82d41922e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038491, "uuid": "1a28a0cf-668a-4999-85e4-7644a2600e43", "comment": "Malware payload (Mirai)", "value": "2d84f508008d2cf21de0a219fd54d1601436761a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038491, "uuid": "f026b732-5a42-4e13-baf2-ef4422500f30", "comment": "Malware payload (Mirai)", "value": "1e0cf89b169f08db9213ace74bfec1af86d7d2681f8b027ba82555309786ce5aa971982d5704a48dc021cd0c1883524e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038491, "uuid": "0f5b12ec-3aac-4ed3-96b1-105885bba064", "value": "T1CEC33B06F5108753C1C2177AB79F561A77232BF897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038491, "uuid": "9198db7c-ed8e-43f1-8d7b-128d29cd4067", "value": "3072:idwracAAviNmLpMQ1xr5hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikxr5hKHKnlAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686038491, "uuid": "2526c76a-02a4-4e2b-ba33-1244955ed0bd", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686038491, "uuid": "a3083537-9e66-4576-9d56-61d8e16fabf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038491, "uuid": "cd819d5b-aff7-4c39-8c58-b35a79d10168", "value": "fd4e382ab60871013969dccac3a36cce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62843f4e-046d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686057834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057834, "uuid": "245eb48f-2dc9-4390-ae70-8fd34d12c982", "comment": "Malware payload (AgentTesla)", "value": "a1366e1500b33cf9d1813ef46cf32dec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057834, "uuid": "458fc24c-f152-4b60-9e69-b377048c005e", "comment": "Malware payload (AgentTesla)", "value": "31fae40dd922e63fd26099fa13a7b790c23e529439ea701a15b5c1c168da23f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057834, "uuid": "466ce006-e23d-47bc-bef6-b51e6d478817", "comment": "Malware payload (AgentTesla)", "value": "25be18d7d3a3eb238435e85d5c602d21003a0251", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057834, "uuid": "429f04c3-2ace-4477-be0b-b4d2dfc03d2c", "comment": "Malware payload (AgentTesla)", "value": "5ae5162b1c22f0121fca4ef5c418187584e97386ffeaabff59a6e3a53224ab55fe1e2cf882040c34d35fc427099d4604", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057834, "uuid": "3ef9427a-0ac0-4bae-867d-ebba1a9f97c2", "value": "T182F4F119F1BB5B2FD4BA6BFD094016348BF4559FB167D3035E9AB8CA9D24B000EC1A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057834, "uuid": "bd843990-96aa-46ec-a3d7-532a4d0acbc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057834, "uuid": "55d97ca9-353c-4980-a486-99e895472fbb", "value": "12288:lPBm70lWxMzIHREJVk/bq4izoW/m7/gfKTARzf3XnVuTsT78ZaHk4fXxQecBPfq4:HmolWxMiQW/O4ue74fKkRzPnsyxshq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686057834, "uuid": "2a134076-8c78-465d-9cdc-c84d7473f99f", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686057834, "uuid": "a14e2544-3180-4272-8888-ddc7c0d4e2cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057834, "uuid": "3b06d238-c278-43d8-8183-de0606c3f71a", "value": "registry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2d9ed7-0495-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686075112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686075112, "uuid": "d8309624-f1fa-42e5-b41f-facd5cd236d3", "comment": "Malware payload", "value": "8752a7a052ba75239b86b0da1d483dd7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686075112, "uuid": "17f8c2de-6ced-4411-aa53-093ebca6bc90", "comment": "Malware payload", "value": "3320f11728458d01eef62e10e48897ec1c2277c1fe1aa2d471a16b4dccfc1207", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686075112, "uuid": "7baca103-4ce1-4c0b-9fef-e9ad2ec56372", "comment": "Malware payload", "value": "6eeef883d209d02a05ae9e6a2f37c6cbf69f4d89", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686075112, "uuid": "4204a838-35da-423f-8e74-893905e2b4ed", "comment": "Malware payload", "value": "903c96460c38b0bfba7042530657141eb1899beea411ed086fbb9dd970124faf7d707109f4677dec154e4bf3d34fd0af", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686075112, "uuid": "61bbb8bf-7e9b-4a8e-9930-eaa1dc9f22c0", "value": "T141A33C00F7D2D471E4734D3129B9ABE18A7EFD601B169BDB3B48062B4E601D0AE36D76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686075112, "uuid": "181f177f-e60b-4e96-bffc-1ac76bf9faef", "value": "ecf8f06eaa7a27093275957985742b1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686075112, "uuid": "7c165a84-5c52-40a6-82a2-3b31f1f77e38", "value": "1536:gHIPkRUedYttp2bd/B8quuaOY2IfpW+VQJFsW69cdCeRk28+axHPjsb5:EYtLqJSquu42CW+VwisCgk2DaxHPj+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686075112, "uuid": "996bc9ba-a7fb-4910-a037-3b08905de7e1", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686075112, "uuid": "5a4cd885-a554-4b2e-a8c8-c2b1b845bf75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686075112, "uuid": "7305df34-7a54-4fde-9372-44a7edfa2c0b", "value": "clop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6dad12-0483-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686067466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067466, "uuid": "32d783d6-7e3f-458b-b309-cf8a016b6109", "comment": "Malware payload (DCRat)", "value": "e64efd4bca4d4e555e9ad7706203cbe4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067466, "uuid": "60de74d0-b90d-4723-b5f8-9bf633109034", "comment": "Malware payload (DCRat)", "value": "333ca48e9bc763c19d65fc7f33feb7cc478576bfdea13f7e1afa585be256bdef", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067466, "uuid": "8c6e91cf-bc0d-42dc-a285-8687c477d55a", "comment": "Malware payload (DCRat)", "value": "4851ace22c80d13acd7cc921cd66d2a19c5e63dd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067466, "uuid": "54f192df-f7e1-4a57-aed1-49a2983700fb", "comment": "Malware payload (DCRat)", "value": "c31b577ad0f3d51f7e69407c53167f07aa1b3f11698af2575b0b183a855cbb16a2c24b390ef5ba3d8270b856cddd1716", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067466, "uuid": "e667c7bb-e240-4f4d-95a8-a354e4d192df", "value": "T1D3235C003BE8C136E2FD4BB4A9F392058675D65B6903C6997CC854EA1B13BC59B036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067466, "uuid": "7dbd0ce9-035f-4bd7-a7a2-c2feb3a3c860", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067466, "uuid": "f6e00ad4-5fd3-4694-a333-823e6636097a", "value": "768:FOEuILWCKi+DiOwhA5ii/YbOgeh1Zk0KvEgK/JPZVc6KN:FOtmOwhUAbx4rqnkJPZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686067466, "uuid": "a14b09f8-c404-4190-9d9c-ea84c2144614", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686067466, "uuid": "bdab6b02-65f7-46ec-a5a4-2b5e5d15b50a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067466, "uuid": "2158fb19-6c29-4efe-93ba-b9f6ae7cc921", "value": "xseZCIy7103c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df351365-0454-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686047306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047306, "uuid": "c2a03b03-0f13-4153-be89-7306ac00463a", "comment": "Malware payload (Mirai)", "value": "8e078c82fb7a028ec51aee0d10f09f26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047306, "uuid": "18110d8c-0925-40c6-a477-3643d5d8b584", "comment": "Malware payload (Mirai)", "value": "35151e8539e53d6915be7ee621c9a98dd62b2764f3c75fc9a36ef077989b452e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047306, "uuid": "920d4ae8-9273-47ce-adc3-906077e6fe25", "comment": "Malware payload (Mirai)", "value": "b07c288f901c41d08e015b2f7b0f0c6c11ff83e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047306, "uuid": "30dbe638-e8a2-40d2-9ce0-6310b997025a", "comment": "Malware payload (Mirai)", "value": "ad4f7de7fe18798af8473a7c1ec243f6bc75edbb52790988abc62ad05a72a119998d43f8431c795b698041398217b1fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047306, "uuid": "27a8b3e0-6f21-43e0-a7af-5cb783845a46", "value": "T151B2D1A48BA19706C2B0B435A37CCF935A3B16A4C5F639262B10D2BCDA9145633FC9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047306, "uuid": "17befa9b-66e0-4791-b58d-8cb4341a17ff", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BDUSthymdGUop5hu7V:4GaKQFH0rs3zWoDDRsjt7LB9U+B5s3Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686047306, "uuid": "63caef55-211c-4785-9580-19f752b87f81", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686047306, "uuid": "54942842-c62c-4887-990c-9ed4e3d14c3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047306, "uuid": "38e5c351-2a0f-4f7d-9e72-50030f1eb8e9", "value": "8e078c82fb7a028ec51aee0d10f09f26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb698fd8-0430-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686031784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031784, "uuid": "7e379519-e893-417e-93d1-0ec4d48393e6", "comment": "Malware payload", "value": "f7d50cc55175762cb1444c2b0a92a49c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031784, "uuid": "5c3bd0ec-bcd7-413d-bba0-a29fbdc7081d", "comment": "Malware payload", "value": "354a141c4ff4d03516e6182c0b28ab37183972c9e7fc632f08899661f4f7f54d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031784, "uuid": "78b898fa-63e9-4705-997e-1fc4210dd56f", "comment": "Malware payload", "value": "43b8fd80fc1fefb57859b57fe19308426312f3d6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031784, "uuid": "2a1a200e-1631-4d55-99e8-5aee4ceed12b", "comment": "Malware payload", "value": "e4b0bc64702b1c0aa96fcf8be5ca92b810267d62ccfa00a86b3e04f977367429d77cad0c651156e9075b5c810a45caa9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031784, "uuid": "9c13a630-10cb-4e87-920e-ff062e8851f3", "value": "T105E2D85EE79B02B48F511376631B0E8996BDB23EB35050B1346C933433E9C3A46766BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031784, "uuid": "fe45f176-04c8-450c-99cb-36b626b372aa", "value": "768:7Fx0XaIsnPRIa4fwJM6pW9B0vgwzfQD09qAW:7f0Xvx3EM6peevFzoD00AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686031784, "uuid": "05af7f19-7852-4c52-8fa5-870780897b63", "value": 31391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686031784, "uuid": "be0db36f-bf58-45bd-9928-a5ad4ee01da8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031784, "uuid": "37ae8639-78ea-41d0-a531-482caad5dc90", "value": "DHL602344AWB.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f324ec-04a2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1686080742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686080742, "uuid": "f6971938-4c89-4183-a188-99977f73d37b", "comment": "Malware payload (ModiLoader)", "value": "22f88126103c3dc10912f5c61aa95de8", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686080742, "uuid": "60a37dcd-9286-4f98-98b1-3e7605b7979f", "comment": "Malware payload (ModiLoader)", "value": "36467ab258014b5d37609f7c360167a3b949f23701b1bc608f71dbef4a3aa2fd", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686080742, "uuid": "eebee148-7d9e-43db-bde1-1b292ce57679", "comment": "Malware payload (ModiLoader)", "value": "72efef79f3d61584eca75a144b204b08ca297dce", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686080742, "uuid": "107ea72d-55b8-4f05-933b-7953e3e6d26f", "comment": "Malware payload (ModiLoader)", "value": "17b91b6d5a31353ebeaecc002e1466d86f8bb361bd95566683f8fb1c6d1c4ad11904cdefc55f9db86f523e9edb75ae73", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686080742, "uuid": "6a3d10b7-25c7-4221-a2bf-d591bfab6020", "value": "T1C2159E16F5A18C77D46669788C0B576D9C14BFA03D249846BAF83F4C9F3E6803829E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686080742, "uuid": "6f40519f-6c82-40a5-8c01-8a93265de2db", "value": "f5b94f87a323eb9c8534a95d7c6241cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686080742, "uuid": "97795ae4-a3ab-4269-bc02-ff20c19b8626", "value": "12288:/39wCUzsHZGNTBQ+qqKY6kROWtMgPHY796WmQvXZb0nSojh:/twsHZCQoKY6sLHY796WmQvpb0Sot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686080742, "uuid": "017b6a77-e2f3-4ffe-9636-189b145b89ac", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686080742, "uuid": "0821dafc-a0d0-4598-ae03-10a77fbf756c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686080742, "uuid": "a0397a2f-7399-4796-832d-2014785487f4", "value": "PurchaseOrder#4232633_document_file9373.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8ed8a5-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686059324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059324, "uuid": "bf4c11b0-ef3e-48ba-b714-6592ec0e0704", "comment": "Malware payload (RedLineStealer)", "value": "f01d05137762dd36a5c548279246b113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059324, "uuid": "2b3d89a0-c38e-47d0-8811-f4a8f00d53ce", "comment": "Malware payload (RedLineStealer)", "value": "36613338c586fb7ddf36d7cda3c336180127030cc16f558e20e725f8542f01e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059324, "uuid": "6fdc9e4a-1d51-4061-bec3-942198c32ca9", "comment": "Malware payload (RedLineStealer)", "value": "7105ba81779f4e2353565819e8b0f8934132348d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059324, "uuid": "c27fc3e0-e812-4e01-823d-2b2ab82e52ee", "comment": "Malware payload (RedLineStealer)", "value": "7f4fc7331026af7511eb4c972130d2c4298185743bdfa21ca9698401f4a7f26ec3181d4d2e67db74b999b0d6ade8045a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059324, "uuid": "10b11fe4-c84e-4e66-b8c7-d75d4aaf11af", "value": "T1A1747D1393E17D64E9254E3A8E2FC6EC771EF6518F497B652218AA2F04B01B3D2B3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059324, "uuid": "3c7972f6-e2ee-47c6-9d80-5db910b69a39", "value": "0af0c6e3fe2b48c822ae2dd664bde01d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059324, "uuid": "46a632f8-2221-47d4-8308-16c0fdb11a22", "value": "6144:8FQxMJ/81O3JSaAdXNfSrU8EI+Pm+Qdl64GON4vLlUVN1M:8iCJ/81nj3qvgm+Q7zfN4Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059324, "uuid": "35d29079-ecb7-45be-bd34-61b76b883b3a", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059324, "uuid": "02141445-e59c-43ee-a6b3-74ab260801e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059324, "uuid": "965a9d18-0d01-45fa-bb98-32b0fea7a206", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8968168-0440-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686038651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038651, "uuid": "3fd7a4ef-8c7a-4639-8ab9-a2b539790610", "comment": "Malware payload (Loki)", "value": "3a815575522def179e50ee205324560f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038651, "uuid": "3e429e39-8d26-442a-ba57-fd7ab75a750b", "comment": "Malware payload (Loki)", "value": "367854e346d9ab5453ec6dcb3d67b211f11f3b6ee56f917ccece38f2eb5bfd68", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038651, "uuid": "b56ecb0a-440c-4a8f-a546-fe45efa7b368", "comment": "Malware payload (Loki)", "value": "43413824ef35c2bc0ab4734790da047040088a8c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038651, "uuid": "6faee90c-a48d-45b0-8f76-db29b0ceb28e", "comment": "Malware payload (Loki)", "value": "17e4b8be497c1fcbe63878d6c0c71cb473162052fb11329256b18d79fb26aacc9f6ff5a945c4416b40aa191c9107bdd9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038651, "uuid": "407c7977-1555-4e8a-bae9-acd3e48fb271", "value": "T16FB423DEB3CC3177CE922A3CAB33A53C17E8534CC47686A898656AE3719230594EF495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038651, "uuid": "2014d286-bacb-4620-b916-56dadef2b82c", "value": "12288:hCL/T8SjsvpHfO666L3qX+DfNI5xrUG6UgZMBckueF:ovLsvlm0zN+gZMSDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686038651, "uuid": "490194e4-a131-4e1e-8ee7-b0c973e2abfa", "value": 542190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686038651, "uuid": "d7e0b845-7849-4d6c-b81c-1791e564c4d1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038651, "uuid": "0b7e042b-b7e4-4869-9143-d8d07d9ee69c", "value": "-INV.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ea9de0-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686054540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054540, "uuid": "4a7b2408-13c0-42d2-a099-345ba6a45e52", "comment": "Malware payload (Mirai)", "value": "b9301ca6c5018b7e99b63f338e91ced3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054540, "uuid": "f1b7a291-19d4-4e81-93b0-54402835ab19", "comment": "Malware payload (Mirai)", "value": "369e420bf7ab1ef7f550c8f4a7e537a4e871481b2410cf2279b9e347dc988d30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054540, "uuid": "913069d9-f6f0-4446-ba98-32bd1f7ece89", "comment": "Malware payload (Mirai)", "value": "718a4aa5c522979c9cf66ab549ef51c32e71fbed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054540, "uuid": "ac3ce1b2-08c1-4dcf-8f67-a4dadb5c987d", "comment": "Malware payload (Mirai)", "value": "78646b60a861bbc48709c60b118b0283a5c8a25c86fdb0dd0121f6a6b9fb42a90b02989b3e5626ef88f4f10da574dd15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054540, "uuid": "8ace4f1a-3f59-4955-b691-67c2d467d734", "value": "T1E933B506BF250FE7DC6FCC330A69134B25CD601A62E53B367978C948BA4F61B15E39A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054540, "uuid": "3d48309b-bdc9-4e65-b2a8-a2b1f6133332", "value": "768:XmF8SuS9INq8c1TguAEBWV/EOd1eyLeqeMIeuLaZe/gJXiTFtAz8WR8WK:Xg8TcIpV1rXpIrWZe/5FPWOWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054540, "uuid": "2f28a755-7162-4c95-99e3-1eab4921b69d", "value": 54724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054540, "uuid": "8fb72672-f706-4092-9cab-7464e4e8b28b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054540, "uuid": "ebafff79-fb87-410f-b67d-b993ff146b21", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.1.23381.32612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c03857-04a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686081668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686081668, "uuid": "1c2e4390-6287-4665-9b87-1c6e2d171015", "comment": "Malware payload", "value": "1839d60cf892ae968e59ad532281b0fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686081668, "uuid": "122b3543-2ac5-49f4-b405-f2948aff2781", "comment": "Malware payload", "value": "380265b82ef7a370c15289a465dd7e7ea094448ab20a0be51656ff676bbae616", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686081668, "uuid": "a0ffd6eb-6426-4028-b2e8-5d3f31bbdb29", "comment": "Malware payload", "value": "abd2b2a281694b01f36d4a3972b242b57ad9b9b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686081668, "uuid": "b72699ee-a7ea-4fef-8687-5c34cb62f4b4", "comment": "Malware payload", "value": "116c2bbd5f0f7da82e21d441c7b457e4d806d718c71945d30f152c35cba95ef2721812a769233797ba9333917c0bbeb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686081668, "uuid": "7f2ec8a7-6bad-4802-850b-1b49b0c9d3a4", "value": "T18A82D01E561D2F7CC798E0B680EDB695C41BFC2E3ACA21CD73165DE8C58870E09D4B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686081668, "uuid": "1775b383-06fa-4ee0-9c95-72b8496de37c", "value": "384:hjbmk369zMPVkcIZ5nAtk0umWn46GxajePojjMCm9UGAtw1cwhHuC1:pbmkq9VaPuv41ajePKtmG5KcwhHh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686081668, "uuid": "f4e8dafb-328b-4f18-b174-c6d08afb1eb0", "value": 19316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686081668, "uuid": "8f267e77-3475-4e36-aecd-e09f0d3989cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686081668, "uuid": "f27a20c9-e9aa-49bb-8d87-9eec65575bbf", "value": "Megrendel\u00e9s_(P.O_5029063)_FANUC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee02dbc6-0466-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686055062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055062, "uuid": "758def77-8c1c-48f1-b7ee-4bda5252e784", "comment": "Malware payload (Formbook)", "value": "d2dec1e1e45f3657e81e308976cb72fa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055062, "uuid": "968f17bd-bb53-4c7b-9aab-bb3a5b418a25", "comment": "Malware payload (Formbook)", "value": "3822fbe64bd0d238de14d35d85d8fdff786456c87481781b6df24dbc9f49b8bd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055062, "uuid": "87ab13d0-335e-4034-bb29-f348b49ba91f", "comment": "Malware payload (Formbook)", "value": "1796d4903968d900e8bb96ac5cc7bd159be275c3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055062, "uuid": "f1e108ab-d370-4b1b-975a-7b53fde3d65d", "comment": "Malware payload (Formbook)", "value": "c587177209c4f445a4a9741ebbcc4a63704d0f2384ff641b39f1da69c7c32f4244f40241883a851f3d9b09fb55a12217", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055062, "uuid": "f1054997-8ed6-4c7e-b809-6f40d790ecb6", "value": "T115D4237B47DF14BA72575FABBFFAA803BD881A4373C8B8B0308615EC6355449487096E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055062, "uuid": "c69c1410-3ec0-4f30-8e5a-5cbfe51397ea", "value": "12288:sAGFDFclM/aqn1SIOoeAuUQIM2ilGm+gGEoEPCQORVkTVEX:gqyacdOcqP2iltfoEP2cCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686055062, "uuid": "897378f2-2861-4b6d-a735-6758db58393a", "value": 638538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686055062, "uuid": "cae02299-0d67-4674-ad41-361a34f32932", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055062, "uuid": "2213ce30-bee5-4a7f-9213-e62628f67830", "value": "AWB728590890733.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1680ebdc-045b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686049976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049976, "uuid": "5cf0f823-04c0-4f02-a36d-3a5247f1207b", "comment": "Malware payload (Mirai)", "value": "5d059bca1a12cda60ee34a588dedc0ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049976, "uuid": "c7cee9f2-3739-4110-bd8e-35f2d26841f9", "comment": "Malware payload (Mirai)", "value": "38e867122fa87ca5b60bdc5133b961a1cecc4f2ec4fe6e18e92372c13a2a0e84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049976, "uuid": "1a1df991-4767-4aae-ad62-cc098dae36bf", "comment": "Malware payload (Mirai)", "value": "e4919a8390676d38ef67dd8e6e1dc4064dcf489b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049976, "uuid": "c0061e29-1089-4a0d-818b-160f22b05304", "comment": "Malware payload (Mirai)", "value": "52e5319210704b754e829a85ce8c583d83803187438f8489399b1d56e93fa57e14d13f48d81fc6df42c58287c87d6ae6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049976, "uuid": "669404c1-da22-4c52-882b-bf900ce20ef0", "value": "T16D431925AD792E26C0D8B57E11F78724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049976, "uuid": "a9d3e71b-d60c-43e7-bf56-e7db119f5030", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDv:eL0AxvSHfymp0xgunvCkV6vTMDauI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686049976, "uuid": "36cd5039-08fe-4a0f-886b-466807ee310c", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686049976, "uuid": "e0708fa8-da09-4dec-9b56-4ac982e897c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049976, "uuid": "46c73f69-6bc1-4e7a-9870-1ae1f8bab297", "value": "5d059bca1a12cda60ee34a588dedc0ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672d944b-0411-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686018328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018328, "uuid": "161dbd04-6e37-4f4a-bddd-5d081c64ac1d", "comment": "Malware payload (RedLineStealer)", "value": "78c9dcd34cce57c4a857f53e8fbaa1e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018328, "uuid": "7c556476-187e-4b71-af46-ad157df05c77", "comment": "Malware payload (RedLineStealer)", "value": "39593f168c0f86d88313c6d563bc9c1ea81bea98328b2920031aa4839f21248a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018328, "uuid": "5c5fc04c-ebcc-40e8-9b7a-bbd800f7b8e5", "comment": "Malware payload (RedLineStealer)", "value": "a2279c456e88a69a4f01c267ec2303672ec68bf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018328, "uuid": "2914418a-c97f-4c5a-97e8-aedb167e5248", "comment": "Malware payload (RedLineStealer)", "value": "a57dc772e76115e4243c831615e98431ce4ff9e6e846a9bb4637a1c1731f04be7bc02eaebf72ae8fa19501d3d17e47c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018328, "uuid": "92ab1719-1857-4f3d-b029-3aa25957dc65", "value": "T115D41283B6DC5972DDF61770A8F203931B36BCA29DB4872B3784994E0D72685B172327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018328, "uuid": "2d622a29-4ec4-43f3-ad6b-7c35e3c38419", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018328, "uuid": "1cd5d249-61bd-4e36-8d34-949d0a107719", "value": "12288:WMrBy90Tpe/IBiVkUTzi0HTaNamOECh3Ry714Hv8XBY5O7zTDH:LyCQIaTnzap8R2GHv8XB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686018328, "uuid": "dfd88c94-eee9-4560-af28-ce3e41292056", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686018328, "uuid": "658d7d1f-52d3-470d-8483-b7f212800ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018328, "uuid": "2220de01-d08a-408c-b3c7-8a38a468193d", "value": "78c9dcd34cce57c4a857f53e8fbaa1e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c42213-046d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686058032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058032, "uuid": "e7b676ab-2dfb-43f1-86c8-43461ff5fbb7", "comment": "Malware payload (AgentTesla)", "value": "93413d2f6a56d47ab583161e965a8c12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058032, "uuid": "b143bb35-f7e3-4e26-80dc-18df50d68886", "comment": "Malware payload (AgentTesla)", "value": "3ae239b553f4ff12412127a6836c15558f4fb22f0bdca0789acab6714a01abdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058032, "uuid": "f4764f78-eb94-4966-a080-e8f5f6100085", "comment": "Malware payload (AgentTesla)", "value": "cab65826a68109815d1f31a8a5f331ae103c701f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058032, "uuid": "8facf0c2-c8f1-4a90-8621-ac160993cfeb", "comment": "Malware payload (AgentTesla)", "value": "526480ebc6d6d1ef8224b934a8932e255ddd1c716d16156898b72e51a2c35f3760e4df3c7a8b9731ed3541b0a9703251", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058032, "uuid": "23569968-eb4e-4d84-bc86-d9a56791437b", "value": "T18C126B71EC94F1EFD30261F1D1D9321FDAD9E9A26215290F7360AAB8C8735CA5F40B68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058032, "uuid": "a5951980-2522-4b0d-980a-815b95cc3e5c", "value": "192:kya0N8wJCWZYpcPrm3OzpJTJY94ACKAogucWegd9l:kyX8wJCWWIJTJY9zmXuD/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686058032, "uuid": "6086bde4-3a5d-4422-be9f-39d562b4568c", "value": 9289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686058032, "uuid": "a8dd2135-45df-44f9-834c-9e48f1af4868", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058032, "uuid": "c0051f1f-ec45-4e7e-b502-318756fa6eb7", "value": "SO #14470.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5958ed-046e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686058361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058361, "uuid": "e9c7e7fd-72b4-430a-9508-53e16352d190", "comment": "Malware payload (AgentTesla)", "value": "fd20abca016a7adf06a96e1e102feb30", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058361, "uuid": "1306d273-77ea-464a-927a-2b49bd5826b1", "comment": "Malware payload (AgentTesla)", "value": "3ae42ecf7bb90d10e2f9104e4e9a7c9866a5042d3543836b18f7ce6cf32356ea", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058361, "uuid": "6b0e2a94-51d3-412e-bcc0-0b110563e792", "comment": "Malware payload (AgentTesla)", "value": "34892393f556fbc6bf81cf9f8e86487770bf9351", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058361, "uuid": "8d139856-52ce-4c05-922a-63fa014373a1", "comment": "Malware payload (AgentTesla)", "value": "f335f941df9bdc9118073b16b57c6c363657b2f5b6b8e2a766fcc172e6a31b636fd2ab4a18ccb2f74c0dae575930fa31", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058361, "uuid": "f25e3054-8e39-41c8-ba13-a52cb0467226", "value": "T14ED423478251451F7A4E7BCB73F84B98BEBAF6BC31318F2D2602AC42720F5F55996A40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058361, "uuid": "bd177315-3133-4aa4-bc2e-a52b59a93d30", "value": "12288:DhlG88MXFjsK4SB4fWfhNszzl0nMWXa9qyxSaJwzFrwpzFU:9ld8MXFwDSBDhNsl0MVIpEppU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686058361, "uuid": "d04da528-d280-42dc-9956-e04f3fd3d0e8", "value": 633389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686058361, "uuid": "75b57fa0-0afe-4a5f-9269-45a95be6e159", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058361, "uuid": "5632a909-eb6f-44e8-918c-25589a147fb5", "value": "DB_DHL_AWB_001833022AD.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1147da8c-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089910, "uuid": "ab72d1e7-c6c4-4ca9-b8de-22b605f859da", "comment": "Malware payload (Mirai)", "value": "a78c1d731419ec2432fd05733fa3ce19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089910, "uuid": "4ec1dd88-422b-4b91-80f9-abb7d8841ee3", "comment": "Malware payload (Mirai)", "value": "3b1b8b0df9cb29f443dd3507d0c33af383972c45b55450780a73e98fe60661ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089910, "uuid": "be2727a5-5e3b-4018-8fd0-6de3b79f8edd", "comment": "Malware payload (Mirai)", "value": "ea487ec45610d13c74617ae2e3803afd4db808fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089910, "uuid": "6796d5c6-3178-476a-9247-d6e54f17e784", "comment": "Malware payload (Mirai)", "value": "3bd78810747f67adce518e5c1d2629c1012c7e675f5483963240f8db961836081a461acd6607fb29a1f760e806e0d4c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089910, "uuid": "9f215d5c-3aaa-4468-8e3c-d3367a0f216a", "value": "T10C33F1B692ABAD61C1B052B7152E54AD64162778D3E5F00357224470EACB2F38AFE7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089910, "uuid": "7a81299b-61e5-42bf-a463-fbdcab45fc39", "value": "1536:JCoqsGR4eB3g0Vmh1IxIpC8J5L9VE8amFZP7R3E:Qoqs2Twh6P8J5LJ9ZP7R3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089910, "uuid": "74a0eec5-7a42-47be-92ee-cec9ce4c3a67", "value": 51436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089910, "uuid": "fefcac88-f8af-4ec7-ae06-991dff489416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089910, "uuid": "a99b7dbb-0160-45dc-a5de-870d2e67bd4d", "value": "a78c1d731419ec2432fd05733fa3ce19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c4cefd-042e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686030939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030939, "uuid": "548c0eb2-7fa8-41f8-9d2e-f503bca47fb9", "comment": "Malware payload (AgentTesla)", "value": "9c57399b4a6adb4b7b8edf354e7f2c0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030939, "uuid": "8fe4f499-768e-4e71-93ca-83e0337f5062", "comment": "Malware payload (AgentTesla)", "value": "3bdc4fb579dbfd37752bafc023e9eaaf2788ad91afe542f8d86e097e5ca62176", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030939, "uuid": "e7d5d79a-1ddd-4e65-a018-073387e0fa7d", "comment": "Malware payload (AgentTesla)", "value": "430652c21c0f8fe6989428cfffaff2754c5b5ff8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030939, "uuid": "fb2a415a-ff9a-44ca-bba8-45ae41e153c7", "comment": "Malware payload (AgentTesla)", "value": "dbdbcb32fce0aa76a3c078fa24b5236bc81841a68045ed0eebe992c9be42fe09b42a035b1716081f0521f1d237de785e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030939, "uuid": "2ce17eb0-9cfe-4386-95ec-049e3d9740b6", "value": "T17B05126C27B7022EC58B3FBD0C201575D7E99E41B423D21B1FA7A9CDDC2AB140DC5A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030939, "uuid": "2717596e-bdaf-4a94-a22b-db7a8977607f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030939, "uuid": "741f3b63-3930-4ad3-9b19-960e896e29c4", "value": "24576:4/thewlqB6pAKbSVEGlC49haxZGT88vpBQ:4e2q8pNbX25Ign", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686030939, "uuid": "3ffde555-62ff-4f26-b266-e0c13eb224d3", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686030939, "uuid": "d6ff886b-3d5e-4531-b50c-6f9a35e755cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030939, "uuid": "eb085f83-7bdf-4cba-a6d3-9ce312eae98d", "value": "obizx.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc184f6-0442-11ee-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1686039331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039331, "uuid": "fad5be26-a239-485b-879a-4e3f1aa664eb", "comment": "Malware payload (BluStealer)", "value": "9c8ebe5eb36367cf02012d0664b97202", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039331, "uuid": "6ed9f549-0825-4539-a39b-ed640d37ebfd", "comment": "Malware payload (BluStealer)", "value": "3c4bb89b988346aaae821e6b5ca65572da9e265bf00dfa5d0df0870634711545", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039331, "uuid": "4d52d95c-ad06-45bd-8a31-86e2e469bace", "comment": "Malware payload (BluStealer)", "value": "e1fdfe7d35e0241eb17e501dce0586f37bef4ac7", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039331, "uuid": "12df8e19-bc99-4f98-9295-33ed43fe0e26", "comment": "Malware payload (BluStealer)", "value": "90f315bf49a8ee738d152970baf8aac614da85a154eeba3c5bfdc65bf6a9a721805c721369daceb7f5f634d385894de9", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039331, "uuid": "fbf0218d-83c9-46fc-8930-c887b2d0271c", "value": "T1B125126827BB421DC8573FBC0D508975C3FA58947433D2476FA2A9DDED18B090EC6AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039331, "uuid": "50defc8e-d31a-4c93-8f7b-5896f7b3eac6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039331, "uuid": "08b51633-a9ba-43b0-a37a-41b203f3ad74", "value": "24576:E/thewlqB6pq4ptiyuo0urd0XAa23zgS4mU3yUt7T6O+uw+:se2q8pFpt91yf6U3D7TX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686039331, "uuid": "181b3520-5b91-40ac-a21e-d0ae77454227", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686039331, "uuid": "4c797125-3df6-4937-9758-41aadc595177", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039331, "uuid": "a5f56a29-481b-485b-8220-2a9ee20f8626", "value": "RFQ-06062023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13cfda1c-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089914, "uuid": "f86efbdf-3da0-405f-826d-6ddf2ce6e7bd", "comment": "Malware payload (Mirai)", "value": "ec826ec854269772acd722c1e2ee70e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089914, "uuid": "33491164-51e0-4e69-8429-bc12840e18ca", "comment": "Malware payload (Mirai)", "value": "3c553001bcd00120dc78f143f7e0f9506006c06aef901dda3497358bcc643f7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089914, "uuid": "56976fd8-838d-4792-a585-7fbc20afebeb", "comment": "Malware payload (Mirai)", "value": "e78bfb62c0c78069e18682b1e9d192f4ca78ba35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089914, "uuid": "05f4d6e2-b509-4dc3-ba43-b12e8cc92bb4", "comment": "Malware payload (Mirai)", "value": "44492b5d1c8f6f4fca0ed23e539981accc9c0ed593a625c6d9ddb5a4f187affab16254902e463a16b21256c67a55d0d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089914, "uuid": "5274e8ec-6898-4bbd-b2b8-5749b32a78b2", "value": "T110630A86B8818E11C5D413BBFA2E118D331767A8D3DF7212DD206F24778A92F0E77956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089914, "uuid": "7c14130c-dcc7-404e-9da1-ad676bfeb33a", "value": "1536:bUnIhnb6Bjs+RedMX9UfUWI+012zhz+/ICi2vgfd9IwA:JbGjBIWUcWI+01vRvgfd91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089914, "uuid": "72743bcd-e4b7-434d-aa35-73fd6de9e5dd", "value": 72104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089914, "uuid": "7a309a88-a4ac-4341-ad38-89b4ef3329ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089914, "uuid": "76a7db23-10d2-41a4-9023-1ee1ec577760", "value": "ec826ec854269772acd722c1e2ee70e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4fb016-046f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686058634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058634, "uuid": "abcea471-ad89-4601-958d-eb95b33fab77", "comment": "Malware payload (Formbook)", "value": "8acbdf37e4dcb2acb442c2e7d7c22f44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058634, "uuid": "18dd22d7-ae14-4a1b-9787-eb3c47f38331", "comment": "Malware payload (Formbook)", "value": "3c7d0885dea33735ccbe857a343fbb7f66a0f03a3e91e4f677ba880b7b670216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058634, "uuid": "c99c39af-2aa9-4fa4-9d6b-c174b2fa9fcf", "comment": "Malware payload (Formbook)", "value": "686f0687a531327ebc303bcd5dae631a6deb49aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058634, "uuid": "757c61bd-f17d-47d6-bfca-b0ca61303677", "comment": "Malware payload (Formbook)", "value": "886e4ae207977d9d4c1889f5d24437c65c6e7be025383223781ceb4ebadee822617fb4a290f3799179d8fa46cfcd7bb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058634, "uuid": "8aaad83d-aa40-40c6-a2df-dbe0e7ba950c", "value": "T122F42244B29BC4ABC69B177D0841BB7854EC1BDAF966F31B1E9FF4A49307E5B8080391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058634, "uuid": "9ec34d99-9c05-4dae-be46-54979927c53c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058634, "uuid": "af422c1a-60bd-44ee-92fd-8d36221bd593", "value": "12288:/HRP2B0xTGlxNqvNu2hZ+nUEsn9f9AbbZIYXausvkp8+ycg8Vvtc/8MTXEDFJRxh:pPLaVUH999f9AbVXSO8f8BU8dXRz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686058634, "uuid": "03e528a5-2cf8-42f4-a718-e3a4b121587b", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686058634, "uuid": "4f03dbb1-f139-43ab-9d09-f677aa53d3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058634, "uuid": "c9f63c92-7e90-4cbb-bf79-cc96aa66e790", "value": "Payment receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b97cd7-0457-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1686048310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686048310, "uuid": "c5052457-6b00-429c-b6e5-0c250c815156", "comment": "Malware payload (ModiLoader)", "value": "40c99aaf4aa9832ba5d446b1550776f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686048310, "uuid": "56a7a145-bdd1-4b4b-af7c-eb9313f34c20", "comment": "Malware payload (ModiLoader)", "value": "3d0a4a349eeeac6e36dfa03303badaa361a3eda756b06aac487479e0a4368b99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686048310, "uuid": "32767e13-eac0-4bf0-98d5-6ec51d89e7bc", "comment": "Malware payload (ModiLoader)", "value": "239538b09cda3c33db1303fa0549c186692f43e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686048310, "uuid": "92d16972-30d1-4be3-afd3-09934ef7ebfd", "comment": "Malware payload (ModiLoader)", "value": "ce894f4e146cb53bde13ecc08bfc7da787c81d789123029a99bb35f3ad73491fcf889e3b46b17c14382f9f5bbb33dbb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686048310, "uuid": "bbce751c-5d55-439f-9c5d-6e23d3011c8b", "value": "T1A105AF1AE6B0887AD42722784C17677DD8257F603D28544BAFE97E0CAF392503829F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686048310, "uuid": "dccda906-f2e6-4216-a717-cfb9d6d67b98", "value": "0e3a57917dc42fbcd9ba577c5afd3603", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686048310, "uuid": "381f50cf-d860-47b3-9bc0-608c81e4443f", "value": "12288:tqcXKzYRKvoT9GfENy1H+n4J6m39o8K796Wzk0SDpcCMZMg:tfXKoT9GfENy1H9Q7f796Wzk0OpcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686048310, "uuid": "977d3f4a-2f64-4dd0-9cdb-ad29afb51159", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686048310, "uuid": "cd3ef1ce-0b25-46c6-9a35-da78a4b2186f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686048310, "uuid": "06b79e82-9ccf-4ff3-9631-76a5999e8cde", "value": "Potvrda narudzbe u prilogu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b417d880-046f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686058830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058830, "uuid": "ebb8eebd-43ef-465e-b898-151ac1463980", "comment": "Malware payload (AgentTesla)", "value": "93070581c5f5a6041234e1818766e857", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058830, "uuid": "3e34c7d1-87b4-40c9-844e-c41d12a1d4e2", "comment": "Malware payload (AgentTesla)", "value": "3d63b4a40b975fc997e2b48c64d8f77fcc63af6069228a28d0d75bd5ac5b528a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058830, "uuid": "840985e4-b15b-4773-85be-9d695be08927", "comment": "Malware payload (AgentTesla)", "value": "8dec419458874297f87417613e0bfd686c2e7a7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058830, "uuid": "71d330e8-f2f3-4002-9929-4d27b5c867c1", "comment": "Malware payload (AgentTesla)", "value": "6864cba585356b037015ee2fb10f7d7cf18c4833d349aaa938ce78c5fb6d533f82be07faad7662358e7bb0c0ab245ad2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058830, "uuid": "1732e475-504e-4acd-8ffb-e57587468986", "value": "T1F0E423AEFBAABEB10A8F1D5AA2C99D46043177208D17D7F12C58F589BED7213018EC51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058830, "uuid": "b60b829d-b418-4bd4-96b1-2bd4f73764f8", "value": "12288:fhefTlfqqNdJ2DUddwa2tJR6cVteasTBFF+r3pCi1xW8v7NDN+z6+EhxtAYuzn+A:kRSqNdJ24dez6cfehTBwCQs6A6+iC+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686058830, "uuid": "e669a162-a2fc-4197-b9c5-c1e5853d40bc", "value": 675958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686058830, "uuid": "13ff7324-29f1-455a-8eaa-a336e87a92de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058830, "uuid": "87a4c196-87c6-40d0-8b44-114d6024fefb", "value": "delivery arragement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f533056-0431-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686031978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031978, "uuid": "73eae314-5a80-4e24-833f-2c57112a74d3", "comment": "Malware payload (Loki)", "value": "094e7546398b790b00c0a1095373b0e1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031978, "uuid": "5f37b79e-b5ac-4e4f-b9f5-fad87072c0a8", "comment": "Malware payload (Loki)", "value": "3dbe1ced53ed10496507f3b244393f9526f6492fa119c76e72a215be5dd84857", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031978, "uuid": "86ff3d24-70cb-487f-a8ca-81e16e539358", "comment": "Malware payload (Loki)", "value": "fa9b263930316a64340ecc7d1652b040d10693ee", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031978, "uuid": "7366fbdd-d2f0-40f5-b203-bb116e8b44a4", "comment": "Malware payload (Loki)", "value": "5c902d2c54fc87011d01b12e1c766b94f99c573c7370eb424254dbe0c2d9f24337da76b4da904ef6f481e0d2bd56745d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031978, "uuid": "24fab1ca-41d8-46c0-b36b-1c585e35f826", "value": "T11BC423FE2FDBB0F84BDC5662645E30EE46496C1A367A6AC7ED227A061F3191C784D042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031978, "uuid": "b72b7432-338a-4c32-847a-bd2297e3ccda", "value": "12288:8jgYYvHyghA11JJF5TPZXScQHzkLz3UHquvBD7:8cjH7m1J5TPcdTEzkHl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686031978, "uuid": "cd37a589-42c5-4355-b1a6-2f8e5208b880", "value": 545078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686031978, "uuid": "b8077ef5-9ddf-4ddc-8832-ccd4989c8516", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031978, "uuid": "d4759ccb-817a-4a9e-8105-c4c454becb1a", "value": "Supplier Registration Form.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691d2225-04b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686087051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087051, "uuid": "49e96dc1-fac5-4068-9abc-464db5d8df19", "comment": "Malware payload (Mirai)", "value": "e5a366b1318675bd49a0581fdd522c4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087051, "uuid": "b4b516ef-86fe-473c-8e86-b1858af7e916", "comment": "Malware payload (Mirai)", "value": "3de1988c601fe5570cd82b1b1023d6039778ee1f703019cccd9f05948c09ee64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087051, "uuid": "ed3d733f-8853-4ccc-819a-8cf0a89393e9", "comment": "Malware payload (Mirai)", "value": "6915b40c1b7e707fadd7f2eda782b26bd7d05d20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087051, "uuid": "f7cb1e21-445a-430a-8f7e-df5b82639932", "comment": "Malware payload (Mirai)", "value": "ec61c8f4baf2b538b27d571415d25c9376c48db540690917eac7b401d8b4d5af903debfde44b640c75ca710117a2d9ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087051, "uuid": "22ecb241-ec8d-4f6a-b931-d54973d52230", "value": "T1FBD2F2F6C6E88B09CCE5A3B5CF85BF153B64304CF25EEC6978448C9A15616C91A70D61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087051, "uuid": "9414b512-5cf4-4743-807e-132901fe2489", "value": "768:reXmx3/Lk87d3NGxeZyWU+N86oLqmFkbEfUGt4T/2/r2fUKw:reXmBLk87d3e8yn+N86yqxQfhtM2j2cL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686087051, "uuid": "57677249-a6b7-4beb-8ee2-7f8307fc15c5", "value": 31088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686087051, "uuid": "5ffedc18-4425-4489-9417-a272d72ad5fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087051, "uuid": "f40e0a9a-8baa-4584-a80c-a6bae9497144", "value": "e5a366b1318675bd49a0581fdd522c4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1bda2fe-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686018024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018024, "uuid": "3510933e-308a-445e-9d84-fea65d063a80", "comment": "Malware payload (RedLineStealer)", "value": "1dc2848a3148fe0e99e4af43dc1fd420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018024, "uuid": "f42b0939-e9a0-4c82-94ae-67114f799ca1", "comment": "Malware payload (RedLineStealer)", "value": "3e2c67bf6ce3493e86bd6292aac14390f590f5b4ad56729c1b7087cea73ef5c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018024, "uuid": "6178b0e2-fb5f-44bb-be0c-f5ef02db9ed9", "comment": "Malware payload (RedLineStealer)", "value": "b430b256be90a55e2373504af67aeb118a24978b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018024, "uuid": "e53d4d68-0e80-4540-9978-c3527adb625b", "comment": "Malware payload (RedLineStealer)", "value": "7baeac8719024a61d03d5f35e206c02a2c065fdf14bf33d6af046bbbd57d8d6356c72147ff674c25c69733e268ec931f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018024, "uuid": "e8903572-af63-4adc-bcd4-e4f3d251cbcc", "value": "T162D41256A3E88433D8B1273164FB07E31A36BC609EBDC71F27996A4A4C725D4787132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018024, "uuid": "18ac8db7-874c-4aa7-8e98-6011742bbf1d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018024, "uuid": "6aacd470-9783-4632-8433-0bbf0e792572", "value": "12288:qMrUy90MJ1yHm6oVzThCYywyol1QvP1pRBMGvMjCQg0Ka:aylJEH/QyOGV7BvMOQLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686018024, "uuid": "861d481e-024c-449d-8933-1b492a03f0f9", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686018024, "uuid": "b76f7bd8-0c18-488f-a441-572d8be002e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018024, "uuid": "86d446ff-ccc2-43b4-89ef-9ef3fa49e02e", "value": "1dc2848a3148fe0e99e4af43dc1fd420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f16afc-04b5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686088760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088760, "uuid": "30fe8bd7-e131-4cd8-9795-375c640abf6d", "comment": "Malware payload", "value": "6ad5dc964915224942ef4ff6352ff422", "object_relation": "md5", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088760, "uuid": "923dac0d-3e5a-4f25-aaa9-3a1ea10bad9f", "comment": "Malware payload", "value": "3e61556107cceeff2006d4ba2ab2dc597edd0db7e55b0b2189751d80220e40f9", "object_relation": "sha256", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088760, "uuid": "aab94208-2270-4ea3-8af4-ace7701a216a", "comment": "Malware payload", "value": "ceac76adf0f9e78c1911ec988318e43f0f196c8f", "object_relation": "sha1", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088760, "uuid": "88d15ef6-be3a-4261-ba27-d6f7d5af34d3", "comment": "Malware payload", "value": "e07a030c8c6bc6f56f2baa83d0c37e3f455f2694325cc8a49174bce9e1881fa6b126cd758850f520ee88fa3dfba0dc41", "object_relation": "sha3-384", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088760, "uuid": "9eaa6a1f-2c9f-414b-845e-5bf92d476b0b", "value": "T1B4C4124E07364FA8E6CE3D8C14A62A4C07647E32BD70EDD1EC6B70431D676A630DA56B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088760, "uuid": "e63886e0-cfca-445e-8eed-518f342bb5f4", "value": "12288:PCmm9yftDLcCERVnxAwcxAwcxAwcxAwcxAw3hkrzOo99qkZ:Puy1DmRxi3i3i3i3iiEzOo99qkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686088760, "uuid": "e2c8edd2-538a-4183-a91c-0d574e57337d", "value": 575023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686088760, "uuid": "6e54b670-27f0-4d17-bebc-da2a8ceaf7f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088760, "uuid": "d4d96858-e132-4574-a237-7579ce107836", "value": "Release.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597df059-043d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686037203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037203, "uuid": "a14b31e5-bcc2-4909-af4e-9014c27f0576", "comment": "Malware payload (RedLineStealer)", "value": "ae0420654394805ac73d71f3d398a7ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037203, "uuid": "e14ab367-3b78-4b27-8585-0084c7f187f5", "comment": "Malware payload (RedLineStealer)", "value": "3ec7eea3e358213d4879289355b240a222367d8dedcc881107e1b0fc5287daa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037203, "uuid": "6ca58929-55ad-4ad7-9a09-8a432f6383ec", "comment": "Malware payload (RedLineStealer)", "value": "f47789745306b364d7fd991fabb3facadecc3bb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037203, "uuid": "4dcc7a46-f86e-49b0-93f2-744dadaef131", "comment": "Malware payload (RedLineStealer)", "value": "411e2e427ad1a491664c2eeec0eaa36d697b7cd669d5cc681fbf1f9ab27ff3e5e18eff728470fc12291652c7a060b37d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037203, "uuid": "d0a6243c-1bc0-4ccd-ab9c-7e120ae83588", "value": "T1B7442820A755DF2BF14650F6E823B0C6C397FAE68B1E0093D78077202D589D9A9E7B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037203, "uuid": "48fb4ecb-2b41-4a0f-bbae-39cdabc33dfa", "value": "af455355974e9f87f1b4e5df199340d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037203, "uuid": "1636c3c6-b8b5-4f18-9833-53ea06c2584f", "value": "3072:yY3LZGmm6n0Wbywn8Svg8DkNXeOXgX09Nu652uR/mACy7gxcj/6:x3LZGmRzg8A8lX09l2unux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686037203, "uuid": "4f5ae67a-4fdd-465f-a1ab-a1aa9ab69fc3", "value": 276408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686037203, "uuid": "93e1ec2e-fe00-4947-bfed-6f21f7b8a5be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037203, "uuid": "5c9b305f-ff37-4158-b328-a6fbc02e6299", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888dcbe2-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686035994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035994, "uuid": "b4966f59-e843-41ea-88ef-071eb3ec8308", "comment": "Malware payload (Mirai)", "value": "a2ddab84847cd937b561eb1c5edcc932", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035994, "uuid": "57ae3023-8591-4f26-bdf7-d13c8b8e2361", "comment": "Malware payload (Mirai)", "value": "3edb2d1c9174f88fa1a47aa51e378de912c419a6ce5ac9229948edba549fbfbd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035994, "uuid": "869c90c1-6a1e-4979-8f98-62fbf746e26d", "comment": "Malware payload (Mirai)", "value": "c40296b5e215bee9af17de4b6e1edbcedf264538", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035994, "uuid": "710bc6ee-ea41-4dbb-983b-ab1b7f253103", "comment": "Malware payload (Mirai)", "value": "bfe053bc7beb9a65c80998bc2eef329c50f5dffd65d12b13ba1a5113d0c9b4c87af9a85a4d34f7dd34d292a5a07c68b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035994, "uuid": "c3cfd675-3ea0-4ce2-bcfb-82b53a81b4a8", "value": "T114C2D07828056470D3310639FFAD86976BA7D1F082E432051A405AFF9A0B886B8B778F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035994, "uuid": "12880ae5-1fa8-436c-912a-6f148c455c56", "value": "768:4RSa8ZS/L6rze3OXrFKg9KZrqoDuxLEXs3UozYw:eSjFJXZBCJDu9hz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686035994, "uuid": "89516dc6-c8e5-4af9-8b78-1811d96a0606", "value": 26292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686035994, "uuid": "1bd91497-15d0-454e-a45b-a7ef63bcafa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035994, "uuid": "a6777fdd-77f8-4298-8a17-ca5e775e1fdb", "value": "a2ddab84847cd937b561eb1c5edcc932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7e5329-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036029, "uuid": "3c929f23-7f47-4a65-b84f-7a58749d17eb", "comment": "Malware payload (Mirai)", "value": "d2bffe8fed0046d3b1fa46a396e9e491", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036029, "uuid": "0c467ac7-bc9e-4890-8844-9c356869c640", "comment": "Malware payload (Mirai)", "value": "3fc5369eeacb1b68e1f57126dc7aabeef41965c3d4a43840368926a14b12060b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036029, "uuid": "98774228-9845-4cf6-95cc-39d539ffead8", "comment": "Malware payload (Mirai)", "value": "93cf708814d278a4cda052861904ce5b130feb56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036029, "uuid": "04b7c451-e573-4aee-840b-bca5e10fb907", "comment": "Malware payload (Mirai)", "value": "be2a720e60f7c11c6dba951ae939a078000925bcaaec4dad535e040cf63efe788d0e092e76efcb0fc4d4962550d8bd8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036029, "uuid": "4a4d6f8b-b7bf-4324-bb90-786cc0de5542", "value": "T151C2E045E3143E89FFDF6CB59E29D0C43B2B175E978B94A3B67891127163C2B6800ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036029, "uuid": "d096f224-7f40-4b4b-b542-cc7229ea57d2", "value": "768:DUbgeS1f8Dnz+AHyRas6JAshPVy8tN4uVcqgw09r:DUbfaAQGAiNyYN4u+qgw09r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036029, "uuid": "2279fdf0-0d12-4859-9a84-cabe57d34c65", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036029, "uuid": "fb8cc206-8ac8-4f6f-a566-bd1e29511312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036029, "uuid": "f64641e1-4d1b-4984-ad30-747c8cc8bd76", "value": "d2bffe8fed0046d3b1fa46a396e9e491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8136b75-0454-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686047294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047294, "uuid": "d53ced6b-51dd-4035-bd36-c8da5c07a9b1", "comment": "Malware payload (Mirai)", "value": "2f2afffd4b319c5d8096a9ecfa2f7e48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047294, "uuid": "b227306e-7142-48c6-9593-c51bf4e728e6", "comment": "Malware payload (Mirai)", "value": "407c8fa8c55d8368de85580be9e7aed500fe9434d0cc2e0f5a1394d0b3310a45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047294, "uuid": "8cb19fbc-1b18-45ec-9c6c-f8b4914ec396", "comment": "Malware payload (Mirai)", "value": "d3443e9d1e2ec391fd3723a04fcf47d4cf0e6586", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047294, "uuid": "bbf2ee99-8ace-4106-85b2-75a63b7efb87", "comment": "Malware payload (Mirai)", "value": "d9ab813cda5c20256361cef382870245b2810f501b1f285b56be147329e5ceb27790aaf17688550d45c8e246e6f59a33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047294, "uuid": "448b97f8-1034-4bc5-aac7-d1accd4a38fc", "value": "T1E6C2D044F041DE41DBEA69F42E84DADAFFE07F0F66658E8066A053C25E5D2B38206DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047294, "uuid": "39f62966-98ed-43ca-bbfa-c5b5d51c0dc8", "value": "768:CVdafO76jpmNJJKehmA7trpfIX9KeA7P3N34uVcqgw09X:mam+AnKehPRa9aPd4u+qgw09X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686047294, "uuid": "ee3a5449-8d3c-40fb-9676-38463591f0d9", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686047294, "uuid": "bed80929-0fe5-4fa8-bb84-452984496442", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047294, "uuid": "7736bd7a-34a1-4ebe-a1ff-916563dc5990", "value": "2f2afffd4b319c5d8096a9ecfa2f7e48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2928cc41-0463-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686053443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053443, "uuid": "c2b5110b-5b78-43fc-977e-f47d8f1887c2", "comment": "Malware payload (RedLineStealer)", "value": "9ac066c2722c5faa7dd81e0464867d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053443, "uuid": "0e726365-e420-4cb6-af90-a47627f78477", "comment": "Malware payload (RedLineStealer)", "value": "4080c84465e2d4e74c47adbeec71ee3b99ec1ef8a58427410a212a69cbb81026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053443, "uuid": "d45e9d41-6ba7-4f8e-b8de-7f15a755224d", "comment": "Malware payload (RedLineStealer)", "value": "8b376f0a831501bf651df5331b71c854d584fe7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053443, "uuid": "80f7bbdc-1ee7-461f-92b2-6015b2fd68ba", "comment": "Malware payload (RedLineStealer)", "value": "ddd10d3b0c203f882e0141116885d333bd6066648daf396403264c6229bd2ed1f865430cd3a576e1692212b1e023c8cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053443, "uuid": "f96be974-57ce-43b2-81b4-901aa4fbcb81", "value": "T122152392A9E88923DCB22B7019FB07D31B35BDD5C8B086AF2741BE955C71784943237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053443, "uuid": "e790a73c-cf27-465e-bfa1-97de90f575a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053443, "uuid": "259ebfa8-143e-4ed1-b7fe-047419eff7e9", "value": "24576:NysTw8jxD2O5OmOkC3ekwJuMRZxQJr9mLM:osTZt2O5OmON3ekv+QJr9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686053443, "uuid": "dd9bc8fa-64e5-469c-a99b-bb3acfe74d20", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686053443, "uuid": "5991f3f3-122f-4d9e-a8e7-d5d0c52c35f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053443, "uuid": "fba816f4-8e01-4209-a56a-c216104bc884", "value": "9ac066c2722c5faa7dd81e0464867d26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa390f08-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036050, "uuid": "dbc9e6f6-284f-4096-a8d8-5db39d37fc44", "comment": "Malware payload (Mirai)", "value": "abfb223ed438ed8098599e429fab8a4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036050, "uuid": "bdd12137-af66-4bb0-bb33-8c192cb636eb", "comment": "Malware payload (Mirai)", "value": "40e16b2dbb35e56f6982b4dfb9b8a751df0b4230a4b62e6a7e244acf9ac25e7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036050, "uuid": "1d643cef-6aab-4482-b533-6bfa506f4120", "comment": "Malware payload (Mirai)", "value": "90c0d36dc294c64f22c07c65200334d945b7d048", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036050, "uuid": "b66ea0b0-244e-41e5-b388-37fe721fb1d7", "comment": "Malware payload (Mirai)", "value": "836e9184ad509b7f65d14b8d3bb42ae2f87c7ca30835023829b03d348cbdfc8d8b3fbdac7200994e1c533573463e2524", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036050, "uuid": "4efb0a9c-5156-422b-bb54-6a456f47fb3c", "value": "T161333A8A64112E6DE9DB5CB981664F0ACE541210B093171BB3BBFDC339333A4FE66549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036050, "uuid": "d66148db-dd1d-43c9-8b49-0e7bec4d551d", "value": "768:oaXTrofl4ghoueg2me2nPQCHEM/ArPwqLWHm2T6oxol7gSu9+f1prtkO60eViM:oaKdhoRg2mew4ChAVLD57gSyg1pRrpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036050, "uuid": "4687f798-0525-4bc0-962d-db7338e63a8d", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036050, "uuid": "8ce1d888-aa71-4720-b30e-3ffeef62f497", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036050, "uuid": "a27a098e-faf6-431b-9bec-d7bce61aa616", "value": "abfb223ed438ed8098599e429fab8a4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf7e128-0476-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686061850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061850, "uuid": "a1dec57c-8e06-4e0b-a239-e46e20f0d775", "comment": "Malware payload (AgentTesla)", "value": "295363767db1d699dc7212f3fceb3031", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061850, "uuid": "9a96dced-71b9-4ffe-a05f-028ee4255531", "comment": "Malware payload (AgentTesla)", "value": "4138eea760aabe4ca16a933974783e4b7ab96cdf33a7ba41b792fdfdb40d0c6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061850, "uuid": "f18c64c5-7785-41c1-bfba-dc7d1eabfdef", "comment": "Malware payload (AgentTesla)", "value": "6ee61a550cd5b6cc4655a6f35b4735523c4a5dd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061850, "uuid": "07b4d1f2-14ce-400e-a236-cf141adfd95d", "comment": "Malware payload (AgentTesla)", "value": "bd6ec205ea6830b54e8a1264e0a894f9fbb33d53c9c6368e604d85003e444de3747c98f69f552d98772c280fe72ec0cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061850, "uuid": "459914b7-2d67-46e3-b6cf-dc21d1048cdf", "value": "T1BA9423C6CFE99B686CF913304159E68AC40B4050C4DB32F2A56BE1A7DA74A4C5EF4E37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061850, "uuid": "8a1bc9ac-071a-4e9a-9be7-0569571df8b7", "value": "6144:1RbrvrzwekhVKnMn/62dSPJiVDheMOZvNamRy5kQOKd9wNzyMYWy1ZQQ2zyie:1xrH/k3KM/XdSREHqjg+eqVnz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686061850, "uuid": "dbcfd7b2-3bba-4f5c-99f1-93f7b4959de1", "value": 415046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686061850, "uuid": "0986d268-e8c1-4a19-af05-b09ec6076e32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061850, "uuid": "872fbe00-a040-442a-80e3-0b1f8b8e0c2e", "value": "PRE ALERT DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a91a20a-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686017770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017770, "uuid": "472371a0-6512-4d3d-aee9-5d606aad4d4c", "comment": "Malware payload (AveMariaRAT)", "value": "e95b75bed4147d8cc8fb08f9910a003b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017770, "uuid": "b40582f0-602c-4f84-8cd7-1ac633ffd3fc", "comment": "Malware payload (AveMariaRAT)", "value": "414c47132ef2e34f5ba9cf5bc4575a991477626ed9819f30c60f99cbc78eb50d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017770, "uuid": "5744aa9b-7d2b-4b00-81e6-832795a9e4dc", "comment": "Malware payload (AveMariaRAT)", "value": "77475a6e5ef38c54fac262defaf231875dca6458", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017770, "uuid": "979c7a59-50bd-4871-8099-3b1afd0912f0", "comment": "Malware payload (AveMariaRAT)", "value": "c3323483390f9c2586440b77f949f2706f42b1f9d9c2bbedf9cc80598c576070a0524a149fed541d0e89ca81a354319c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017770, "uuid": "8d60681b-65c0-4bda-8623-e764d35407f2", "value": "T1DE64F164376AC866FC338F3418A9FA564AB9DCE366A00A461FD7355C733D088B815FC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017770, "uuid": "6305c263-5900-478a-9d72-deb2af3577cc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017770, "uuid": "8c467d3e-3328-4f0c-915c-f81f6c652659", "value": "6144:yYa69B2Ap7norLRcFrrmiALza18Uy+mKtrwJkBTeLmK:yYJxMLRUat/aeUyIFL6mK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017770, "uuid": "a12cad14-2ae0-444c-a2b4-20bbff4dd33d", "value": 315546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017770, "uuid": "7b9c6c4a-8d34-48db-9280-d3ad2bb9d29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017770, "uuid": "e09d9a6a-0ed5-4ffd-bfa7-8298bf2e2749", "value": "NewOrdersSpecification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53f3eae-0464-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686054161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054161, "uuid": "23abd4b7-c060-42da-9ff7-32f3c1a711aa", "comment": "Malware payload (AgentTesla)", "value": "fec84f73fad8937c03ce55bc1b22a416", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054161, "uuid": "a9a5e0f0-6764-4e2c-be74-5c98a2a29b81", "comment": "Malware payload (AgentTesla)", "value": "4183872bd7e864f4880e58c1817b19b859b08e254c93524056745194c49e7db0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054161, "uuid": "8cfb42f8-c17b-4a97-83e2-d35c2a119b2d", "comment": "Malware payload (AgentTesla)", "value": "38290fb99f78abcedd8f0b83e121e04b3df19d7c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054161, "uuid": "2691c5d7-053a-40a0-800c-78cf9a6eab9b", "comment": "Malware payload (AgentTesla)", "value": "101b11bae504049f8df9cd0870d0af2cd3b3163d87422d9e75e8089e42fcc442278c0c42f4abf55d0989bdef8beaa1cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054161, "uuid": "c895e072-20fe-4239-b03d-43f762ea9971", "value": "T12CD4236863AE5A4ED2E1F81B08E7FBCEA4E1010112D973FE08B375A587D4C7F55418E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054161, "uuid": "8686d26b-4768-409d-abbf-a620e8ec43d8", "value": "12288:76k4HDwIIr2nKqm4SxZxjBmRVJVOX2czqrFbI3YWEOL:x4HkInnKqiqxOXlzqrCYW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054161, "uuid": "3646af46-8247-44f7-8c5e-15b6192ccf73", "value": 629420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054161, "uuid": "b3e08119-4742-40e3-a60b-a1e2f10c58d8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054161, "uuid": "1ea4dc47-a6dd-43be-a78e-933bc2910406", "value": "Purchase order #10009924.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8941d904-0431-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686032129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686032129, "uuid": "43583cc9-dac6-4b95-a434-be52f025133f", "comment": "Malware payload (Loki)", "value": "867cae014bc41d658fbf6264d1e00c93", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686032129, "uuid": "b2e83448-75e4-4e4d-b06a-9d630fee9fee", "comment": "Malware payload (Loki)", "value": "41d5891380ba5900b931d127c6c70247b5976b44f68c282efae3c3729bf1b788", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686032129, "uuid": "9ab98da9-b07a-4838-be10-a89e32592b88", "comment": "Malware payload (Loki)", "value": "c532ee034aa5c9a53224beafba7c99769e83c072", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686032129, "uuid": "730b6401-7970-4983-82d6-7228a8f37e6b", "comment": "Malware payload (Loki)", "value": "990b79754d023d375e9112d7353bff05fac9d69e71b92f6e73301a5c14ed38c63c2ac3abbd72b2d761362bf2d02ae59c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686032129, "uuid": "86cb416c-e3cb-478d-8bcb-5f61bb8f6a8d", "value": "T1CAC423FE2FDBB0F84BDC5662645E30EE464D6C1A367A6AC7ED227A061F3191C784C042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686032129, "uuid": "6fa1b5c4-f89e-40e4-8e6c-61111d49dce2", "value": "12288:0jgYYvHyghA11JJF5TPZXScQHzkLz3UHquvBD3:0cjH7m1J5TPcdTEzkHlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686032129, "uuid": "bbcd662d-ed9f-4f48-9bc5-d1f81196d428", "value": 545074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686032129, "uuid": "941658e8-3d8a-4a0b-919f-6130cb18de04", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686032129, "uuid": "a2b96b78-26d5-4e1f-97db-b5632e088aa4", "value": "-Certificate of analysis.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22649be-041f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Redosdru)", "timestamp": 1686024547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686024547, "uuid": "5717de9d-d939-453d-bce2-b07edb682622", "comment": "Malware payload (Redosdru)", "value": "ee9f9565049005c3fc1dfd32db706ef8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686024547, "uuid": "61207d66-e85a-4c79-87a8-c6cdafddb6b8", "comment": "Malware payload (Redosdru)", "value": "41fe567d55eb7815d15fe5f3408a902f5743a42b2d6b58a6eac7455a06e52d28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686024547, "uuid": "49e744ea-d2a8-41be-8435-3416fcdcfc51", "comment": "Malware payload (Redosdru)", "value": "1761611775aa66b437e8e79ae2e7cdb295501bf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686024547, "uuid": "7454a339-014b-464c-8709-5f48785d0800", "comment": "Malware payload (Redosdru)", "value": "3c448f8141f5ce3a9efcd230d7f0262ae2d916efcaee0a5d83a2ce13efb8b84e4ddcdcb3cb955177164f52e78091ff5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686024547, "uuid": "a7a0a991-a151-4983-8196-8b6c06e29575", "value": "T105648C127BE1C077C5B315324EA62F3697FDB9A05B318AD733944A4DDD309C29A3A31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686024547, "uuid": "e1bac427-9dbd-40cc-9f26-ef2717681238", "value": "58c5d357101428118c079002a7efbddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686024547, "uuid": "a1922904-b2e4-4929-817b-89f4c317b0c4", "value": "3072:gIH9W+aUwWAKRpHFeyYMPg0GQx/KD9tlnZ9OrsL1z17toIhRXIB7NE4:gIHaXW3HFOMsZYM1znexE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686024547, "uuid": "8b29b3f9-6dfb-45f6-b54a-bfa576f26510", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686024547, "uuid": "72618f49-98a7-4753-af1f-26e9204b818f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686024547, "uuid": "76e2f941-e1b7-4a0e-9b77-9fd563b5b2e7", "value": "ee9f9565049005c3fc1dfd32db706ef8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b62ef5-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686054543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054543, "uuid": "9a2bc63c-9b3a-400d-bb44-977dc0d06d46", "comment": "Malware payload", "value": "e08fc0bcde3bba93f13710f5d05c1ac3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054543, "uuid": "a328bdcc-3b04-4a64-b150-4fd6461d9f86", "comment": "Malware payload", "value": "422db303cc57ebb6ec3b866cf5feeb634ffed6dfc14a512371a551802e82e910", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054543, "uuid": "db99f508-37f8-4a71-86d8-8ad958513a04", "comment": "Malware payload", "value": "b6a038a8f340e0c7357cb24d067a1fff0814ec3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054543, "uuid": "3927b3e7-6daf-4d6a-b96d-9370bf41dae1", "comment": "Malware payload", "value": "bcf67f37a33718392350071298776c3dea6c3be233b4462b456b55570c309ae952f1507354779f9b095def0228c96d99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054543, "uuid": "33e7e0c2-6362-4fbc-ba2e-0a4dbfb23642", "value": "T14BA2D0C47601EE65F21048732D5C9AEC8DABF75A0BAF24708CE5BD4DC34A496188E386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054543, "uuid": "17436ad0-ff96-445f-b6c8-0d444e25075a", "value": "384:flzEBkDOvTCZuQEkymy/Gf+3pK9pGr39KKD6sq+GJ4kjNBrHKuxTnxl/y:pwkyTc9pHiGJ7bLxlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054543, "uuid": "65c4e13c-d372-4863-bb97-03d1cdaa91d3", "value": 22368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054543, "uuid": "a52ec228-0615-4708-9bac-ca61cc650f70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054543, "uuid": "11ca7773-d9ce-4a15-9e21-5c815572f697", "value": "SecuriteInfo.com.Heur.20230606122911795405555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6c8f17-045f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686051942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051942, "uuid": "132803fe-5eca-4fd2-aeb6-a401086aecb6", "comment": "Malware payload (RedLineStealer)", "value": "18da7365754d4e7f7b795244721b4893", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051942, "uuid": "08e3bbad-b728-4573-a309-54c439d92b58", "comment": "Malware payload (RedLineStealer)", "value": "425ed78c210d322bf2dbb6afe695c68093632809c56bcf99af00baa9cd6479e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051942, "uuid": "3a025861-381b-4e90-8d16-f1050f202361", "comment": "Malware payload (RedLineStealer)", "value": "e7d48dbe6975a1a9d408bc94fdb3d112af5e93eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051942, "uuid": "87e0a7ce-1e81-4325-ba41-092bc7352f74", "comment": "Malware payload (RedLineStealer)", "value": "1afe07c8fe834adbedf8dd3425be70ff9126e4a87defb52d59893c2b7e00ad60c0db045f16ee21f513f38ffa19ef9cd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051942, "uuid": "274b2e13-2248-4085-9f8d-81a64465dddb", "value": "T13DD41297E7D84432DDF91BB018F502D70B35BCB56D78C2672781AA892CB3650E83672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051942, "uuid": "63c8242d-39a1-4714-a4a2-2dae527c474e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051942, "uuid": "e90abc0b-60cf-4647-b0fb-6dfef6685ddd", "value": "12288:0Mrpy90ZzkDHh29LJ78h2E5i1WF+H91mfULkQhiWa:ty2Aw9t8hv4H9EMXta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686051942, "uuid": "e43f53a8-0a44-43d2-a373-c9da41662669", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686051942, "uuid": "585ad76d-eb69-44f9-bb1d-b14f5ba78fdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051942, "uuid": "14ba34b6-2ecd-4c17-9d1d-0e56006714a5", "value": "18da7365754d4e7f7b795244721b4893.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f299ecb5-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686090288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090288, "uuid": "53d38ee9-af5b-460c-be22-cbaa34ab4fd1", "comment": "Malware payload", "value": "bdc77afda6b9fc1d82ca1a0750b3e1dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090288, "uuid": "51ab3c8d-47a4-4bcf-a22e-52e8ecae2410", "comment": "Malware payload", "value": "432e01a3d3a989e847fa25458ed4aecb610f1983f868474b8d2816f7a08f5c5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090288, "uuid": "c3fe1eef-dd1f-4fb5-bf6d-640ab59e7e61", "comment": "Malware payload", "value": "9859792e4f0ef2d18f4977ca8b690f46ff08e8f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090288, "uuid": "42ae173a-98d0-4da4-a298-55ef3a0a5c64", "comment": "Malware payload", "value": "1920314281e47c4fcca01833c667d88345c0d8ba03c3428271528a6d0a65d07099f79c4d521602b9e3414e2112eadb16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090288, "uuid": "61e34d85-e1d6-4acc-a222-67f23317b372", "value": "T1E8D32C46FA818A13C4D5177ABAAF41493333A764D3DB730689186FB43F86B6F0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090288, "uuid": "3d5b06a0-f057-4b62-ac37-877332697593", "value": "3072:IIrDhJl8rkne9XVbe5YjsZgK/BPPY2pWZU97Yz1OoM/9BjUG6:ZrDhJl8rBS5MagK/BPwqWeuz1dM/9Bj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686090288, "uuid": "f0435236-7309-4a87-a9c5-b308105ed7c2", "value": 136218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686090288, "uuid": "c1acab92-8030-4318-884a-ba7de80b613a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090288, "uuid": "8cc3904c-6711-4956-920b-60b9abafd106", "value": "bdc77afda6b9fc1d82ca1a0750b3e1dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e69752-044e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686044441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044441, "uuid": "4861ccf5-b153-4c3a-9be6-d76c6c0c4994", "comment": "Malware payload (RedLineStealer)", "value": "df202d8bfd8d4fc017b3dd43ae93c32d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044441, "uuid": "b6823a4c-1e2b-4981-9688-771adb367661", "comment": "Malware payload (RedLineStealer)", "value": "434015a42546ee6b0e5f117631d9b594cd922889dd7223dab5fdce04f5efbb93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044441, "uuid": "49fc0a7d-7b84-483f-b339-40d97a72cab3", "comment": "Malware payload (RedLineStealer)", "value": "8ca333235a256a5263f2364e26ef8a9db7e2b758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044441, "uuid": "8f193b50-45fd-48fa-a204-8f214fbd2bd2", "comment": "Malware payload (RedLineStealer)", "value": "64b2b89780e91e13fa60c6df6ce6f6a355e21c03534e33f488b5190df53be3fde0f194f3c0617ef5a86e9f9e0a4ef64b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044441, "uuid": "de6f4ee1-8b4b-4646-87a5-e700a197fc8a", "value": "T107F41292ABE480B7E9F917F04CF707870B35BC6059B487AB26482E290DF35D9947136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044441, "uuid": "13e2bb34-1d9e-4305-b90b-356cfab994c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044441, "uuid": "cd4289c7-c936-4542-b8ac-b5b6a5dcf3b7", "value": "12288:5MrAy90H24AtlaAOO7t5WzhaaFSMjvfu936KZqTe86JKeW7BvA3:Zyi24At0e/WzJSH3LwTiWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686044441, "uuid": "9706a306-232e-4084-bfe7-948296e7a7e2", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686044441, "uuid": "a55bf1b8-ddb4-476c-979f-f42a4532eb49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044441, "uuid": "04aea471-1003-488e-9c27-e263521bfab3", "value": "df202d8bfd8d4fc017b3dd43ae93c32d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e9b65e-04aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686084125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084125, "uuid": "5efe9449-5c15-409a-b185-55c8704495fc", "comment": "Malware payload (Mirai)", "value": "415195b2b182e696073d9855aedaff4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084125, "uuid": "cae0e7b3-f774-47c6-b042-eeb2b92f8bf2", "comment": "Malware payload (Mirai)", "value": "436efba9c5b2e3ef1dcb131929d33edffc49466365efa6c495101e1f7865ce1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084125, "uuid": "2d00386d-4d46-4843-98c4-4c370c7d04eb", "comment": "Malware payload (Mirai)", "value": "a48543effdcc920c3c83d2bc90c972d1752b6513", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084125, "uuid": "cc610024-8143-4b69-91f8-255a8675c2be", "comment": "Malware payload (Mirai)", "value": "7ba8bc0c4406319471e3c5504ce6d4e61c4edfd38c32a87f7264323ca4f3f3c4ed52e9b66ca14f3411e673fc2365defb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084125, "uuid": "fc11b7c3-7293-4642-bd84-0b141fde6143", "value": "T14F23F2A4CB0B67B3E9187D345A7940C3FD9257BCA09B35423A913FA8D7D1489717B232", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084125, "uuid": "d534a002-8a9a-45d4-94fb-dbb4d305978b", "value": "768:sQgWaJILZuVijzVeQBvqfpc80NrYfn/QSmOd99/AJBYSTKWCq3UIoYJ:sQ7EI93fVeQBMpcz5iYy99/GBrJFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686084125, "uuid": "6751a747-b772-4856-a484-7e951d57c59b", "value": 48716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686084125, "uuid": "20f54d70-9339-4142-b9c9-52d6ff6d18eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084125, "uuid": "6e877e4e-7005-4402-ace7-1ab50a863c2b", "value": "415195b2b182e696073d9855aedaff4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb654e3-0461-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686052622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052622, "uuid": "a4261c1d-16e2-47f4-a9b4-eafdd13d3ee1", "comment": "Malware payload (Formbook)", "value": "ea38c3193e6ba454b56e38904a5d3536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052622, "uuid": "99956b12-59fd-48c2-ac5d-90f7e9296a05", "comment": "Malware payload (Formbook)", "value": "43b5cfd70c439d116d7ec6381d664d5c8e7f89f84eb4186675db11bf830ebabb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052622, "uuid": "b1d78dab-e528-46f1-928c-ad9b0bdd198e", "comment": "Malware payload (Formbook)", "value": "cc4ed96d9c5b05aa4e24f03151d334d88475dc29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052622, "uuid": "02efe429-2158-4558-84eb-4d46d019f87e", "comment": "Malware payload (Formbook)", "value": "1d6cca1e4bf3b4f64e34eead1ae2f5620cde8627d9036675afe73511d2874a5778aecc4e395708b5003acd533d87aae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052622, "uuid": "f63c62de-55bd-431b-917b-406ea9898202", "value": "T11225D57D0AF506DBC26BC674DFDC9D17BB24942AE9C4EBA858C123137642A4FA09307D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052622, "uuid": "f1f4b10f-4331-4d51-9a59-85a63c5d206e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052622, "uuid": "b90a58a2-2481-4035-8ec5-22f875eea308", "value": "12288:NZWKDoEh1DghRVmBLiQpTdw6fHFI/17z43P8eOPcUK9AFydA6o:N77IiB9KUG/143P3OPxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686052622, "uuid": "0bfdd14a-fba1-4733-a0d8-a73f6fe8a34e", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686052622, "uuid": "083a6bae-95e6-48de-ba82-abb53fa564fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052622, "uuid": "bf86dd87-0e59-406b-a182-da1978379a7d", "value": "Receipt089838.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18f6481-0466-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686055068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055068, "uuid": "06d014a5-940a-4bbd-9195-475543401790", "comment": "Malware payload (Formbook)", "value": "87b004d6cfed1e107af2c41fddfdbfaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055068, "uuid": "06727015-7a75-4ae0-b006-f3952881bb72", "comment": "Malware payload (Formbook)", "value": "44ca2fb5336865c635d0c1f4c75cfecec1b4fad8fe3de812c048c223cc06fba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055068, "uuid": "f593018a-5447-4c74-ae12-6fdf18f7104c", "comment": "Malware payload (Formbook)", "value": "9eb4da63763dd7bcaaf674476fd746dfe555a462", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055068, "uuid": "52f8b9d6-c176-4152-b5d8-258f1ea76e87", "comment": "Malware payload (Formbook)", "value": "d6150d2f3b6c992ec48f827c282d3db0925bbf45f4bc2b6d09dc5f555dc320be4b161e9a0e860f01bc980cce09040af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055068, "uuid": "bca60c81-9007-400b-8392-22bcdbad48db", "value": "T1B4F4026853FD4655D6B363B616A04634577BFEAEB335E30B0F87758E2A61B0089203B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055068, "uuid": "9774087c-9f43-4d6d-82ac-7c9da78cb793", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055068, "uuid": "b12a9619-a863-44c8-83fe-28eebaf1fb16", "value": "12288:YsIduS2iNfmFx2iqNhujGjUE11rBrUPLjsRG8oP+IAs3Nl6bAlzbuDCpq98:YsIduS1lmFxU3NrUMR4P153N1zbQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686055068, "uuid": "7ef36bf9-19e1-43fb-b418-01963f25b18d", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686055068, "uuid": "e7a6024d-ff1b-44d1-9239-0164978fc31d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055068, "uuid": "348b206a-b9a0-48ca-bbdc-48b6d6835e28", "value": "AWB728590890733.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68830cd-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036124, "uuid": "4d33cd3d-fa8b-40ad-8fea-97ea8e759940", "comment": "Malware payload (Mirai)", "value": "81c22d8a7fc9c333830875e15c232828", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036124, "uuid": "64233ae7-964d-4002-a458-ac332be9c762", "comment": "Malware payload (Mirai)", "value": "45291fce31a7fee2245d41c2efbf60150f75428f9943904dbc62e2f60fa3ade1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036124, "uuid": "7159a592-83f0-4c39-94db-ef13b5cd5dda", "comment": "Malware payload (Mirai)", "value": "97c735428787f719b55a60e4c592444e1cee3247", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036124, "uuid": "7693069c-56a1-4e07-b134-e4eced2305da", "comment": "Malware payload (Mirai)", "value": "bc86143157f26ec8fe800938ed06df0fb1fc45f7cb08d423d3fc6c2bb691dd3b08f86453bf7d90b1a80e0b828c4465e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036124, "uuid": "5647caaf-1d54-492e-b4db-8332ba7c2e62", "value": "T17253179178D19A16C5E423BBFA6E40CD372563E8E1DF32178D216F4077C982F0DABA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036124, "uuid": "c6bb2d89-dbc5-4a12-8b25-8a18c603ebce", "value": "1536:9amD7RhzxhC4K+jbxEGh/VVzT+u/WhKXcQ7dfWl1dW:9aQDFphheuuhY7df2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036124, "uuid": "996d1cfe-d834-475c-8853-970312736dfa", "value": 64408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036124, "uuid": "4e72187f-d991-4dea-8049-004c56f24781", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036124, "uuid": "8f4345b5-6015-4814-bfaf-d29a2789b71c", "value": "81c22d8a7fc9c333830875e15c232828", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7e6fcf-0474-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686060881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686060881, "uuid": "145ebe5b-3af0-4549-a167-0243a3074d7d", "comment": "Malware payload", "value": "51320d80f0eb4017cea697c92e199405", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686060881, "uuid": "5c8d1690-b791-4248-b941-934138183608", "comment": "Malware payload", "value": "462795caf5a51d5427c0a49a51137f22ef0043fa5d23d9b2f1d6a2ae555b3c6a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686060881, "uuid": "a7e010d0-7fc1-4fd1-9c1b-66b232614df4", "comment": "Malware payload", "value": "b9a05deebd7c23d0d03693b6ba6e627d0a31d21d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686060881, "uuid": "f99b81e2-30d3-48c4-92c3-74117a5578da", "comment": "Malware payload", "value": "05ebb5b3274edee3cd3922c6dd9ed0837e2f1b81684cd18cfea9bcd6d93e961ac1c95d826f61883f6e39524b3f1396ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686060881, "uuid": "618cffe4-15ff-4837-a885-bc7bc8c6925c", "value": "T14B8173AC14935B3D92653085BA3A1239C0F72F4167B62C14447492B37A7B05DB2F67BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686060881, "uuid": "0d4c0b56-0e44-4575-accd-a646a0a9b5ae", "value": "48:AxzPy0wUeINLZINRcCXrM5Sp7qjfHKQt5G3cunDSy4h2kvDvD1Va32PNmv:A00E7Xg5E7qjvKQtAvnDL42kvDvD2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686060881, "uuid": "47f70bab-6f6d-44b8-80e9-6e123fa73edc", "value": 4204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686060881, "uuid": "583289b9-8cc9-4880-a4de-3cf2911a81e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686060881, "uuid": "20a61589-05bb-47d1-bacf-a23a2c8d9c7a", "value": "10764.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160a8fb9-046e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686058135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058135, "uuid": "d2095ca8-cb45-457b-b2b9-bd7da7f7c39b", "comment": "Malware payload (Formbook)", "value": "7c4b689dca23188e3b088010add245ba", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058135, "uuid": "50db7f8a-31b3-4b81-add5-a6018243a402", "comment": "Malware payload (Formbook)", "value": "4629ba2fd5e560099ecf3eb0e47fc621236aacaf90b08abb56976479435d1e11", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058135, "uuid": "679f8829-9f1e-4b7b-8037-d7818a335bdb", "comment": "Malware payload (Formbook)", "value": "fc885670d9b928e86c09151bef9eab5c490ad531", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058135, "uuid": "65c737f4-22bc-4a52-a090-56ad39f7c41e", "comment": "Malware payload (Formbook)", "value": "ebeecdf56abf7ba7410105079ee6630176e75d82bdb599585133905ee0ceb8f7f7fb71573c9b2c137777e76ea5311429", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058135, "uuid": "b8170d4a-4639-4298-8369-830b0e4c8808", "value": "T17FC238565B8C4C61E26AE8BB474DA00E58BCF23630C255C5BDDCE6743B7E10E4B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058135, "uuid": "e599cbfd-86d3-4630-8bc8-1899bc014585", "value": "768:pTFftaIYSTa/R+wR1dTXa+IszhPdZDDL6JthSVFjmJcANsrz7vOn:xqIiR+wNTXa+5PLDL6JtwyJczvKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686058135, "uuid": "16eda33d-4400-4383-b607-fa37308f6f06", "value": 27782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686058135, "uuid": "a9eeeee6-212d-48c5-9ca4-037919baab54", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058135, "uuid": "0e96f96a-5b8d-4338-8f2d-4acaf1a7596d", "value": "SecuriteInfo.com.Heur.20230606132832680639403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e306d8-04b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686087017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087017, "uuid": "779fc82f-8623-4b7c-a81e-dc67284039a9", "comment": "Malware payload (Mirai)", "value": "8701e201eb915924e0d00b1fa90003ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087017, "uuid": "737096a9-e6a4-45ec-9e0a-32dd20ebea2b", "comment": "Malware payload (Mirai)", "value": "4686221759fce73960032650e126955871b55e68c210c2b0256819b879ae394c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087017, "uuid": "f4a3dafc-d460-4271-94bb-a100956db331", "comment": "Malware payload (Mirai)", "value": "2ad4c8f5eb2e34f590445d8bd9a8cf4209740b21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087017, "uuid": "2675b777-55cf-41ed-b912-e1600d1340ed", "comment": "Malware payload (Mirai)", "value": "a5a70ec6292b3f5a871c901c508c8fc4c2f1d8362aec4c28d7b798361bf357c5d70abd450db7b7877e7858788ad3331c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087017, "uuid": "8d65b04a-c4c8-4dcf-a6d4-2cc24ded1940", "value": "T1D7E307C7F800EDBAF80AE73748530906B130B7A259925B376257756FED3E1980477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087017, "uuid": "c8944d77-3ad3-4574-9c06-890b15ee5d95", "value": "3072:AGPO17dkNw7zOzHG8kuauarRV6+VEjbiDL9JO1NyfPdQ:4/CzHxkF1V6wL9JEyfFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686087017, "uuid": "5501274e-e6ae-4537-ad80-8c06cfd15e97", "value": 150956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686087017, "uuid": "0f6c44cc-f654-4da6-8a61-b19902507cee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087017, "uuid": "5a4748a5-3f9b-4704-84e9-94f55f1c994e", "value": "8701e201eb915924e0d00b1fa90003ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676f29e4-047d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686064714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686064714, "uuid": "554dad43-3997-494d-8f9c-d41a2e656d3d", "comment": "Malware payload (AgentTesla)", "value": "b7475f585b317b4cdb0f385f147e635d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686064714, "uuid": "c99b1397-b898-4f10-a304-ef0077d9c6ae", "comment": "Malware payload (AgentTesla)", "value": "46887ad939b1f8d5e6588548aef4ebcbb3e924df26efc74ee5ddcdad4a23ed20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686064714, "uuid": "206d1f3c-753a-46c6-8f2e-9f225058c2e0", "comment": "Malware payload (AgentTesla)", "value": "c88c9416ffc3d97ac9ed1aeed6558c6f1b610207", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686064714, "uuid": "8d8a6e81-fd99-48ae-aa02-d6f93430f936", "comment": "Malware payload (AgentTesla)", "value": "30de9a2dabe038e63dac625cd7f17c40e62d85dee53ad9c93e0bc2cfb7fe9386bad0c40814dd6c19407b1a05860aebc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686064714, "uuid": "951e104d-fa70-4a54-a9dd-b5f2ddbd82f5", "value": "T10D24DF8D7650B6EFC99BC4329AE81DA4FF6075BA430B0257A027159DDF4C687CF280B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686064714, "uuid": "2af0e691-53c2-4c71-b26f-a5c945cc67e2", "value": "3072:7CNkuMjNMFLm5HLcWbMRtBpzAGpyycA8g4qEs95M/ZAB0BoAXgihJxP91fNWCs01:ZuAMlm9XbMBpznVrjEs9ilggCUhVvj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686064714, "uuid": "288104a3-9aad-47a8-bf7f-70d88c5e9f01", "value": 217664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686064714, "uuid": "133f642b-db77-4cba-ac0c-5261d23d3c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686064714, "uuid": "eb164723-886f-4c58-a7db-72d97da539c6", "value": "SWIFT05062023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54dc7a05-049e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686078857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686078857, "uuid": "9ed28c3f-d70c-4a75-996d-89310857953a", "comment": "Malware payload", "value": "dbe0a497334631b0f7017ec42c20efdc", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686078857, "uuid": "b1cedd17-92ba-41e1-a22c-eb617741a7eb", "comment": "Malware payload", "value": "46b7366f88fd44a82cd00e4979f676b464c9f7c0169450ff3dcc014d9650b517", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686078857, "uuid": "e0e273bd-fa8c-4bdc-a738-ed101604f5d4", "comment": "Malware payload", "value": "eca99a602e3d731f8ecc23bdf479566c0685c918", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686078857, "uuid": "5c598c2e-ae59-4579-869f-a957d178d44e", "comment": "Malware payload", "value": "3b76ea033ce0f46e76ba5e35cee54a73d246c2ec843be4d6fb6949c616cb2c8b035188e9b84af3ecc754b96aef5f689d", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686078857, "uuid": "35f37df9-007e-4089-a3aa-208e20269497", "value": "T143956B05EA92CE27E3E45B7EA153502A9230D6233716BB9F0F7C95793C923B80D523D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686078857, "uuid": "cac820de-23e0-4ecf-821f-18e3cd526611", "value": "24576:GFlE1xrJfxT1el3KSquRG+Z7Kvodi4I4dyu+QUF0elQKL8INXV9WR1df9Uf:H/Jfx3Y5UFeKvNCJ9Uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686078857, "uuid": "73c1889d-8691-480e-93b5-2da56d967d46", "value": 1916928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686078857, "uuid": "5177ca80-6aa5-406f-8604-ead6df3ab741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686078857, "uuid": "9173f7be-b56d-4d7c-917b-42cd817c970a", "value": "16860788551c671273a746f68e2ccdc1e7af013f84ec6bf0f6fbd323f0341d1130eb44e5ca942.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4cb5ee-042c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686030039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030039, "uuid": "2b855a05-7197-4875-b1b7-b1cd221286b2", "comment": "Malware payload (Formbook)", "value": "e1a3106f748936635720e92df26b7235", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030039, "uuid": "c5eb7aa1-18b5-44f2-94e7-4d0fae20fb34", "comment": "Malware payload (Formbook)", "value": "474eca1ef80533c60080a208a15b3f8f3a73d0e8cc1af138f07272a6bc178f7c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030039, "uuid": "0a6bcb7d-6817-4567-a85b-31f59e5aedd4", "comment": "Malware payload (Formbook)", "value": "b57bfe227ae17386ed6015857b7947a11367f200", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030039, "uuid": "16051185-4836-4cbb-9bcf-01c05cd461ae", "comment": "Malware payload (Formbook)", "value": "5b348fc02328cea20fb11b43a63c614c424be182f762e52398ece4c125e319b166c981fe45a3c118a29ce6a875d181f8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030039, "uuid": "e29ab05c-8d18-45e0-b6a8-702693803f84", "value": "T18A5423C7EC044CBE460B42A4F526981E9FA7EDB6E41F25A13533EF1D886440FDA9F419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030039, "uuid": "1346ca68-4422-4457-9a01-273635df67a8", "value": "6144:VK89CVCXbCjT9OV9VXh5MMzmzN318BCl6XoSC9P8Pw6CX0Zi:g89/sT9O9BYOJ4/Ywci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686030039, "uuid": "a9446785-27bb-495e-9745-2161102d140a", "value": 281645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686030039, "uuid": "7d0427ee-c8a4-4bcd-8d83-4c6923663adf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030039, "uuid": "e7674304-280a-4581-b72f-a186ca7361bb", "value": "003737.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8930079-0435-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686033900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033900, "uuid": "9de1f592-2d12-4a94-be8e-aa6f3c7181e2", "comment": "Malware payload (Mirai)", "value": "083307adb09966b317de4e55af9408d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033900, "uuid": "ad46e368-81ab-4e6a-8cff-b59641bd4eb6", "comment": "Malware payload (Mirai)", "value": "478085727aa8c00b90fade008420d692260b9bf786fa9da62666321584786fc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033900, "uuid": "11b28363-f587-4189-929c-87ea26a74492", "comment": "Malware payload (Mirai)", "value": "4151cc3bdeaac68793186bfca725cfd6470e9ddc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033900, "uuid": "32a7d98c-85da-41d9-8452-6efd139d214c", "comment": "Malware payload (Mirai)", "value": "bb9e35e1ae83020bd514d27b6b4cb5bbbc87a17c98ff7c60dc825212753f49f30aec4185b7ab5de8726c8bbb0153375c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686033900, "uuid": "f8a18c0d-fca0-4a3f-b0c6-bb672672fcb2", "value": "T166734A23E952C67BC0D756F81BDB99314823B8BA1B23320673E47DE92F168C91D6DB05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686033900, "uuid": "534d9925-3510-4255-94b4-aa367b3a88a5", "value": "1536:pG7XdrqFQ5i1jSn77f8EGJh3+UszMJ9TYh6mAITWOWjAHZW1e:iQFQ5uOnX8rP+UfJhvmjTWOWEHZW1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686033900, "uuid": "ccded30c-73cc-4dc3-b78f-494742177aad", "value": 80291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686033900, "uuid": "c0ec885f-7773-4965-aa27-f8cf1583e2f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686033900, "uuid": "3a08095b-55df-40df-b28a-927d43ae43f3", "value": "x-8.6-.Abbaddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa221ee-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089934, "uuid": "fbf67c93-ebc2-4be6-b131-2fa5f4c8f258", "comment": "Malware payload (Mirai)", "value": "76ad9f15f14d5d689b86be40a4778618", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089934, "uuid": "d174064d-dd40-4179-8d75-b9fac7d59d7e", "comment": "Malware payload (Mirai)", "value": "47dc9db578e5574a7f618677b8092e66a14ce66b617dc2b85239a1d76fafaca0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089934, "uuid": "c55405e5-1ebe-48dc-af85-d5dd57846d75", "comment": "Malware payload (Mirai)", "value": "03f0bbd5645078fea11a12a05a872b33cdbd7c04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089934, "uuid": "c986842f-827f-4562-a20d-4e557daa34bf", "comment": "Malware payload (Mirai)", "value": "78bacf12382b7019d9105780f33a20e92ae51925562781f66db55c883e70a1677fae6e28ef0958d2c11521fd366f19ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089934, "uuid": "d77dc4a6-aa02-46d6-b6c7-edcc058c4a8e", "value": "T1F8C2E1E0B726FD31C420AC3DE52B4D897A51167C90FF393654258C398FC1A4B67B88E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089934, "uuid": "e93fddf8-eb3b-40d2-8c5c-44b83972c82b", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrT9q3UELuE:NKy4qfqoeJdXWgSLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089934, "uuid": "d6fe04a8-c925-4324-a232-4b6448ff34ac", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089934, "uuid": "ee2f9e7d-ea28-4f03-af2a-b1573b2add4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089934, "uuid": "d2566c2f-4e8c-4c6d-a7ec-bec9070a1ce5", "value": "76ad9f15f14d5d689b86be40a4778618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008ef23d-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017727, "uuid": "d7f47460-5ca9-4067-b5c2-74cfce01cef9", "comment": "Malware payload (RedLineStealer)", "value": "4eb78fc6596621408c0483355b3c9796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017727, "uuid": "b95a85a2-1bce-4dcf-846b-ed7c1a946ab3", "comment": "Malware payload (RedLineStealer)", "value": "487a9ee3317232bf189ba7772f96f91e54b27e559ffeb6082a47d19ddb473f0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017727, "uuid": "a83e0fc8-571a-4033-90b3-be01cb03fe65", "comment": "Malware payload (RedLineStealer)", "value": "9cf05e59fa68dfece79284b37cf5cb13614a5230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017727, "uuid": "d1bbdc84-2157-422e-a748-0d7b0d4b46b1", "comment": "Malware payload (RedLineStealer)", "value": "4cbfe5541c91f6835af8b1f17cadeb0122dea59bf43ee95f39590363fca63dedd55089a2827049e2e5dfd943515840f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017727, "uuid": "9dcf2225-6b97-496e-b395-e223b1f475b1", "value": "T188D41253A7DD4133ECB42B71A8F712831A3BBCE14D78455B1782AA4E1CB27887634B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017727, "uuid": "64a45c8e-5a24-448a-ae6d-a9a177c52a95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017727, "uuid": "c5ff6e70-6c46-484f-a329-0cf6d34fc382", "value": "12288:fMrMy90AUgjKGu/hSzjMajjx8w/cD2fPJUjTD2nIHU3N7Icvg5+YtDv:Py5jKvSzQ4acmP/0N8cvI+YtDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017727, "uuid": "f3823c24-f94f-419c-ad10-c1ec08b5fb98", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017727, "uuid": "1520e39f-80f6-4cac-967f-f5d4a1f7eec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017727, "uuid": "c7299036-c64d-4fba-a873-069fa8866d67", "value": "4eb78fc6596621408c0483355b3c9796.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff98b30c-04b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686087733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087733, "uuid": "e0b99445-885a-439c-879a-30d7ffbfc87d", "comment": "Malware payload (Mirai)", "value": "5943b544ea4be539454ba3e99a7e849f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087733, "uuid": "c22cf7d5-50d7-402f-a00b-d30d9d720aca", "comment": "Malware payload (Mirai)", "value": "489ea72f88af19a27a0d5fd340ee057fe3f4c877bbd759df6c4ef362de39ef22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087733, "uuid": "d772c4a9-51d9-4fe0-a31c-b67e7bd71e06", "comment": "Malware payload (Mirai)", "value": "d2f4dab18454fe477036eec626fe2e964a5d2de7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087733, "uuid": "e2505c11-71e3-4f0a-8ba4-588834a55f2d", "comment": "Malware payload (Mirai)", "value": "d2b5193b345ef804aa1bce92e9cc9b9bd800090c7c0450aeead5354e3375225517a532f40db4b5ddc89673b47a621283", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087733, "uuid": "c9c5d658-e1c0-4b33-a9bf-450a52ac18ac", "value": "T163C2E15390E98D0AC463423B6E1F156B61282539138DFE2E373BEFDC62464B8A539DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087733, "uuid": "f9c53754-e0b2-4535-be71-851a31fd65b4", "value": "384:MRGE9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5dwapDyCTYHHJC8oytPFnAqV/LlgM:+5+Kcrb9VDJe5FLTYTlPFnz/ms3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686087733, "uuid": "641a50eb-69db-433f-a47f-2f27a4aaca05", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686087733, "uuid": "4770cf63-5152-45c3-9318-64d12d15e49e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087733, "uuid": "c3fb73b7-27b0-4ff9-9fd0-96090ca0039a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa3dc7c-04b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089872, "uuid": "f7afafd4-4978-4f04-84ca-429a7859455e", "comment": "Malware payload (Mirai)", "value": "25d59325b2f76e7fab754948ce103856", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089872, "uuid": "ffb776fb-ee58-48fd-8afd-e175b03a2efe", "comment": "Malware payload (Mirai)", "value": "48ff09364a835cc9cb7c2aa934c6860c4df38a8de75487404e48374a6d9a2edf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089872, "uuid": "90ebc412-7a5f-4ef1-9812-0c7c67b26b98", "comment": "Malware payload (Mirai)", "value": "c5a5532199e0322fd699823b92dd38d995cdb465", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089872, "uuid": "350c0932-ef4d-40de-8065-6b9f54762297", "comment": "Malware payload (Mirai)", "value": "f6680333cebc33b7c6f1b3d7e9f5eb5ef696894eb2540585742a47a7b0dd1ddd323e2af00ba5e35fc9304ef1f7d1dfde", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089872, "uuid": "9ec4e7d1-7e14-4c11-996a-fce49e559338", "value": "T1DEB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E76C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089872, "uuid": "f0f3726d-464f-445d-b45f-c9067b4e8424", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1p/LWy:c9sSyzz36YaWWgg1pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089872, "uuid": "d495055c-2f71-40cc-be58-ddeba14225d6", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089872, "uuid": "8cb6f54a-391c-4740-bb59-b7ec4bd52edf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089872, "uuid": "6d14e656-cb58-4477-9f1d-2c258a12fe1c", "value": "25d59325b2f76e7fab754948ce103856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23606c26-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1686059017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059017, "uuid": "683f1afe-7d7a-4cd4-9f28-452a114a6651", "comment": "Malware payload (STRRAT)", "value": "3b98c79de87287a290be42a8b6024135", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059017, "uuid": "9fb44cd7-2653-4f90-9147-24c66fc8c35f", "comment": "Malware payload (STRRAT)", "value": "49b485e3ac70b1de37749d5b9dda713833b1448f2066875f0882e87a73dd4133", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059017, "uuid": "0410e509-fe96-4628-86e3-b807468f2c58", "comment": "Malware payload (STRRAT)", "value": "d1a0960f21a9ac148b4d0f55bd2b866dd87355e5", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059017, "uuid": "6027ca5d-8584-4c3d-9615-31737fa5cbce", "comment": "Malware payload (STRRAT)", "value": "9f057347c2242e6199bcc0a554be5c84e2f221a8bdb115b2fb3d1546e500cd7dd6ab148ab0eb33dc2acd3cdd45859656", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059017, "uuid": "2e342df6-d41c-4ecd-9a2c-7fd69578b408", "value": "T1A724236715AE89877175A5CFC6DB3C26AE387A053F50B64D429C2E02C53BCB0D24BE27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059017, "uuid": "3a7885ff-63eb-4e0d-959d-ac4d5e5a341b", "value": "6144:a1vACEX3NWmUO4hU7KaP9RJOqQDcY/+FbEwQQM7ORl:O4CEtWW4MOqQwdFgvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059017, "uuid": "f0c82309-a00d-49d6-ae68-7e893b314a35", "value": 225364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059017, "uuid": "377ca931-8db0-41f7-bc5d-0660060cffc4", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059017, "uuid": "cad1fdcd-fcbe-4ac7-ac3f-e955ee40027e", "value": "Order.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16092b2d-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017763, "uuid": "6b9e6cad-fa38-40dc-af18-23668734b0ad", "comment": "Malware payload (RedLineStealer)", "value": "c1d562bb8c2a4cc3216c15cc0be933b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017763, "uuid": "50eb7569-3a75-497e-9410-d676e8946caf", "comment": "Malware payload (RedLineStealer)", "value": "49cdd234f2ec75f7bbbc9381c86876da14fc37207c4c9facbf24c073b6be1514", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017763, "uuid": "47fc905f-8a8a-4832-92ad-0a89ea5a8a09", "comment": "Malware payload (RedLineStealer)", "value": "ffcf35b22a33b2b29811ee064866462f4c368cf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017763, "uuid": "98aed34f-f263-4558-8ebb-a1b7ad7a5599", "comment": "Malware payload (RedLineStealer)", "value": "620a46ab83fa8e0357b90a912d8efeeba36a789fcf2b6abe658eca89f11e19852f35979ea27ac3b628bb344ed0b07270", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017763, "uuid": "d01b3178-7759-4113-93e0-9a39b561a78e", "value": "T1C3D41243A7E854B3D9B517B458F65383263A7CF16A30875F3396AD4A4CF2A847430B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017763, "uuid": "9f04109c-33a5-48b5-9851-edf2102be7e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017763, "uuid": "3d2bd459-bcd3-4b29-8edd-110888701cce", "value": "12288:qMrmy90Lb1ZwlTi7Z0Vi4mFEL9BfNYbvRZWQlXd1QaUmy:oygLwlTi7Ci4/LabXPXz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017763, "uuid": "fadb6687-a2fd-429f-a9b9-357d95c134de", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017763, "uuid": "f1977a89-4f77-45f5-9c3c-99a33d3232e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017763, "uuid": "db357dcf-56df-4e51-8b4b-c3db90e74e4a", "value": "c1d562bb8c2a4cc3216c15cc0be933b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de2b001-0431-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686032083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686032083, "uuid": "ab4e25d5-5c3c-4de2-95b1-1dc400177e59", "comment": "Malware payload (Loki)", "value": "5899546936fd80e385ec5104f9a63363", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686032083, "uuid": "3f2ec59b-bfc8-489b-b3e9-71d57e3571c8", "comment": "Malware payload (Loki)", "value": "4a2182d3e23731497e11ade3c490dbe91abdc30355539eaa429f4221f959a019", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686032083, "uuid": "07b2edb9-6a7d-47f8-9d6e-8ac36312610e", "comment": "Malware payload (Loki)", "value": "b2d97ed379b488ef0ae43f28ea80a423756a2d14", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686032083, "uuid": "4ec6ed5c-cd8a-4cfb-9dfe-77e81c0b5b9f", "comment": "Malware payload (Loki)", "value": "e8b99346d62a21776d58fbeed8bc8ea3dd64ca9c65a7da6aad65196d7a8b65fc75d62052b24f2842eed7808aea7871d5", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686032083, "uuid": "69999012-682a-488e-a6b4-0edbee3964fb", "value": "T1EBC423FE2FDBB0F84BDC5662645E30EE464D6C1A367A6AC7ED227A061F3191C784D042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686032083, "uuid": "4d9ad99d-9b04-4f8f-b818-d184c8389561", "value": "12288:hjgYYvHyghA11JJF5TPZXScQHzkLz3UHquvBDM:hcjH7m1J5TPcdTEzkHlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686032083, "uuid": "baa312a9-ff02-4052-9671-ded6fad839a4", "value": 545042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686032083, "uuid": "3dd715e8-1efa-4332-84f0-4133da95b530", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686032083, "uuid": "89f14f5c-bd36-402a-b513-2da38e19a1cd", "value": "-INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b461b9f5-046f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686058830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058830, "uuid": "2c78d6f2-cf15-4020-86d6-fe68a586c996", "comment": "Malware payload (CoinMiner)", "value": "f72b1d9e4780f7b1b63fc2e2e88f1593", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058830, "uuid": "ed718cc5-0fba-475e-9799-75ea5d9734fc", "comment": "Malware payload (CoinMiner)", "value": "4a346ad97d3b8093e61c3a0ab67a1a6611fb5c399725eea10becbdd0f331ee13", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058830, "uuid": "2b56ae8c-9760-4330-a312-4a892785b0f4", "comment": "Malware payload (CoinMiner)", "value": "95f3a182de433dac071eb353f1abd50b8643aabe", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058830, "uuid": "5234cdd2-9eb4-40cb-ad60-80907373a328", "comment": "Malware payload (CoinMiner)", "value": "026e90a41ce88a1a09d6f979b4065bd2af9918bda79d8935d6ea2542c1a88e6c82049c541d24621b723be90b0fe93891", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058830, "uuid": "18f73c61-e1e5-4d3c-ab00-8dd8c34f3584", "value": "T10654A7C58CC08118DA57E0B081EF52232B45D8FABB547626CC74A1549E3FF58B72DADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058830, "uuid": "8199465d-bbed-4e2c-a213-55423a45ab7b", "value": "192:ZxI1d8fxPUiXdKUV+lxq3S+JLGJGaxn6AZs0tuPQaZrr1HVSFNC7aFAZxJpSFqaS:rI1ifJjAXq35G3s0t4Q1C7PLnH03y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686058830, "uuid": "d03ac595-a1db-4c69-85dc-d6d401b09886", "value": 283689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686058830, "uuid": "6c3d0282-26cc-4d4e-8232-799965d09fcd", "value": "text/x-asm", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058830, "uuid": "25e014d7-e242-4ed4-9658-de479ea8807c", "value": "curriculum_vitae-copie.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c274635c-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686059284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059284, "uuid": "4e845ed6-4d92-4232-98d1-704dc23946e6", "comment": "Malware payload (Formbook)", "value": "a3cca5119fb6fcbf4e064b562619aeb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059284, "uuid": "971a4b11-1762-4616-b7a3-0fe155533914", "comment": "Malware payload (Formbook)", "value": "4ad6c38be212777a181c374f391ebecdaed23e1a6449219005228c8a4f3a7ca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059284, "uuid": "3605ff1d-62e5-4c45-8345-e726ce63678c", "comment": "Malware payload (Formbook)", "value": "1e4dcd4f07c83f23ef1d365cb61062d877bf845b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059284, "uuid": "4dfba8c1-18c2-4835-a472-d749a970cbd4", "comment": "Malware payload (Formbook)", "value": "da307dfa32cb2a1921e423792a30c397b41655e9e5242bc28afc79b58aa3e6d3c695794906ce43d3e1993906d1c27085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059284, "uuid": "4076b098-e9c9-4a0e-b0e5-ebb909cd6dcd", "value": "T1DC64D0522159BC13EC4D6EF2382BE9DDAC735E70067C567AEEE03A252770B4FA705141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059284, "uuid": "e524df55-3b7e-49a2-9bf3-e4d250f070cb", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059284, "uuid": "f52901d9-0032-4644-a326-7159beceb121", "value": "6144:q6dIKbO+/bZcnbIKmp9HW+argxbYGedp2GJD3aXRoKyQePD:4aO+dcnb69ajdp9JDwCjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059284, "uuid": "6c4491b9-e934-43fe-b405-efea0196f29e", "value": 325320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059284, "uuid": "697635ee-1444-41cd-b0be-91cee5c841d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059284, "uuid": "ab9d337f-9231-4f18-8030-5f96527e005c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a3b365-03fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686009813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009813, "uuid": "227cfef8-1590-4548-8b90-ee517c5a1449", "comment": "Malware payload (RedLineStealer)", "value": "86c921db6798a284b97f489036e0bde2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009813, "uuid": "a596f9a1-3cf6-49d3-b41b-66bd0d581eb4", "comment": "Malware payload (RedLineStealer)", "value": "4b2eafaaa864645f665e47c8a81669e48cd109e828696ebbb9dfb8b4edc82be3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009813, "uuid": "8a2686d0-4c91-47b2-8705-44462c12ff4f", "comment": "Malware payload (RedLineStealer)", "value": "dd2c1b54ff6e0c4b72310ff5271d102681815607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009813, "uuid": "099f3911-4cf1-4925-bc0c-f937ff8a5b07", "comment": "Malware payload (RedLineStealer)", "value": "9f294c8294eead2f35a325ab46befa3ab5708a81e287496033475530bd3d11174b6f11d6e2b8aff806c3f7b6c4a2f073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009813, "uuid": "d35a076c-d921-49b6-8309-148f0152fa7b", "value": "T183D41212F7EE5032D9B51B7058FA02D30E36FCA26DB8861B2745A85E1CB1681B531B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009813, "uuid": "7eb0c4d8-dce5-4e64-a4c7-c779783fc4a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009813, "uuid": "028a7393-ed02-4817-a68c-c8fd54c1ae5b", "value": "12288:pMrSy90YW1Lk9pLIx5OZAvxQpU+52QK5jQP04JRQK3uJprnaJguTZSsZm:LyW1wHIqZwaCXQ4QP04bQK3irnazZXZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686009813, "uuid": "bcbd1dc2-57a6-43aa-8b7b-107166c1fd04", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686009813, "uuid": "ab638299-5116-4aba-aaed-4777f9aab234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009813, "uuid": "ea40ac7f-3d29-4e2f-9627-0aba99e4171e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f44945-043c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686036689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036689, "uuid": "95e0b7c9-1d2a-428e-87d6-bb8841cd06d9", "comment": "Malware payload (AgentTesla)", "value": "7514c1af57264d742f3e5f8451ecd211", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036689, "uuid": "3cdf227c-62f4-474f-a636-1348681dde01", "comment": "Malware payload (AgentTesla)", "value": "4bae538cec6b390554cc43c799e51dde1132a39f7b20f66acb3ec0800e62b18a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036689, "uuid": "6dbec1e6-2bf1-41ca-a46e-79164d033082", "comment": "Malware payload (AgentTesla)", "value": "27b91170b464fc47de56e01caa4907abda09160b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036689, "uuid": "cee75d81-9896-46cf-b0bb-9381b7711cb8", "comment": "Malware payload (AgentTesla)", "value": "a3daba270c1f2f990169cf68a0d030a95a873f993e0b85f3a277f5ba4f9ea10c69fc2c97c206f9ce1b3a4fd13dda513a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036689, "uuid": "c4cd1c81-a87e-425a-94d6-0bf5f194de2a", "value": "T10ED433DE6041857F8932FC78EA0C7F356AD7CCD841E261B0BE9873AB9A4B1A5179140F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036689, "uuid": "ccb02038-c61b-4510-9d81-20721dd952d4", "value": "12288:8y5yOv9FMUpy/5g+AWFtSTRawJhFTk2EwRSHJlswvMjRil5Sqimxp:8yv9tpy/5gpQGRXLmwcXvMjslJi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036689, "uuid": "091cb7ba-96dd-48c6-8f8e-f874d5ce2cad", "value": 616952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036689, "uuid": "db218797-c529-4246-bc0b-97d212a4f780", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036689, "uuid": "eeaed7e5-6143-4e06-a652-0f52d1405fda", "value": "Purchase Order 4301023185.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2b7bf4-047e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686065123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065123, "uuid": "6067012e-e3f1-4769-931d-0b3da658572f", "comment": "Malware payload", "value": "7f02e16ac1f73ac15f8996137dbbbf53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065123, "uuid": "20196d5a-3b96-47d3-a04a-ea6f28e9e473", "comment": "Malware payload", "value": "4bb389a73d743f7fcd5b99ed109071a0a4413d858f9217d9f3c8eeaac92b164a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065123, "uuid": "67c00c47-dd08-44f0-abc7-0232dfd69f92", "comment": "Malware payload", "value": "509c3c12958e8aafc94ad4b6772bb59a30ad6e6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065123, "uuid": "8e6f9fb4-3709-471c-9076-fbc5322c0896", "comment": "Malware payload", "value": "7f10d9c3c17d9608d759f84dfe967ccd132d6f03cdd975f70b0734101c525913fb77d47ef703415761299bc5a2c83d4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065123, "uuid": "ce7c60df-c61a-4167-bb1c-1969774b1632", "value": "T16715122813FB462DC4A77FBC0C5136B0C2FC1489B123E6535FAB5DA9CE657024AD58AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065123, "uuid": "b2347db6-e046-4f02-a7b7-42ee3fd8cddc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065123, "uuid": "73fec1eb-51f5-488b-9e6f-9c2f0184e6c5", "value": "24576:q1iewlqB6pFvGNuMxLpcSBBc3nResXFopworAtYf:qQe2q8pdSLpcSrYRe+rEAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686065123, "uuid": "fb6ac776-06bc-4218-96f0-1d0276d6be64", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686065123, "uuid": "df580ada-47ea-48c5-bab0-8d0bd0625285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065123, "uuid": "6f735ee2-02bd-45b9-a2ab-3e158834c958", "value": "Fiyat Teklif-Analitikkimya (23) .pdf_ 0323017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b311f2e-047e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686065150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065150, "uuid": "b1137d2b-ad63-4920-9339-4e370c37839f", "comment": "Malware payload", "value": "36db3e4c8bf47343f2cf7b7052577535", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065150, "uuid": "b0a85570-7506-4f7f-ba17-898ba4fbbe59", "comment": "Malware payload", "value": "4bcc680a0712df2480c9bd3542074f9e172655f406856a839e6b6daad584e622", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065150, "uuid": "2ec0df6b-3b8d-4680-a075-4ee291a6cbd3", "comment": "Malware payload", "value": "8c039eebd6d83bef57392ffd6e5fdb7c3936ba54", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065150, "uuid": "3e4f69be-ec49-4b73-a761-c93ad308f6e3", "comment": "Malware payload", "value": "fec2fb4db90fdfaec33d2e5ddccdf43e5e8a1c0bf7e9f45e3f5de406be61213096dd8cd3099a4c1c46c16230b3fa4313", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065150, "uuid": "91466d5f-2014-4370-a315-3b55bfeb5ae0", "value": "T192C3B0E47B809CD1DADE6BA795592D9D1233307BADCA14CC4086FBC92E777924E0CC86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065150, "uuid": "ac9c665f-5396-4623-afc8-0ca1b23d5b2f", "value": "1536:asxaeoPK52/ro7rLMugfCmCub0A98Gpu1NbRVZ3ZaqUxPpJcY34NNI7P+03LMRM7:aSzluqslpINNyCjaZNNkGuAvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686065150, "uuid": "b8dabe54-fbe3-4721-92d8-397f02eb50b8", "value": 129314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686065150, "uuid": "b007093b-5875-43f6-9d99-9ee5f7d9753b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065150, "uuid": "6c6d3052-2467-42fb-a95c-bb49f24526ff", "value": "ROCA_P.O-4501226854-WJO-001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350e1197-046b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686056899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056899, "uuid": "a0b0e281-9106-4168-a634-f8d9b3d73ed7", "comment": "Malware payload (GuLoader)", "value": "f6427112ea99494544e03172afb1a267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056899, "uuid": "3fc38b32-5aad-413b-901e-c91a7c67dc6f", "comment": "Malware payload (GuLoader)", "value": "4be39fed46206303c4a25cac7a411aab459796ad5d1c640f465d225af618f174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056899, "uuid": "a5acc1cf-5952-4277-9248-10bcdab4ab72", "comment": "Malware payload (GuLoader)", "value": "af8b16f7d07d979e517b2f303be3f24a8122d15b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056899, "uuid": "17f835b4-aa51-45b6-b0e8-7c3e2fdcef89", "comment": "Malware payload (GuLoader)", "value": "393beed18ac56ec8b553489127cd7707d3ddbde0ecd2d5ecee5ac7673afdf72b391df1b3ca11491448f65ec69ada56b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056899, "uuid": "7d2d67a0-7c2d-45da-8920-bed9d01ebbb7", "value": "T15F64DF5126A0BD43CC5DAEF6781F99DDAD331E700ABC523AEFD07A252B31B4EA306145", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056899, "uuid": "1c06cf09-70db-40c0-b883-ef7910483c34", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056899, "uuid": "d6a784b1-0edb-4212-8820-65956cb7aa6b", "value": "6144:P6dIKbOkt5SnT/fb8BWOCig4p457SF6Mpn+i5l:raOlEWt4p4Vu5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686056899, "uuid": "3d2c8833-c66a-42a9-9ff9-e1f92dce8a73", "value": 315240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686056899, "uuid": "f8b15a1c-ca2f-46b6-9200-3d1a316e4a90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056899, "uuid": "f7fefdf3-9af3-4953-b6f3-2de0fb479128", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92edc36d-0499-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686076813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076813, "uuid": "e30edff1-12bb-41ce-b659-4ce826da3a47", "comment": "Malware payload (AveMariaRAT)", "value": "b1fe7f3fa300c9143c589cd81ae4efc0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076813, "uuid": "b135c88c-d64e-456d-8958-150c78bd7738", "comment": "Malware payload (AveMariaRAT)", "value": "4bf150ce502d82ba3385bacc84c724245ad6f279432eb8d6055879e6ce8808e6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076813, "uuid": "3def6af4-451f-4165-a46f-5ee60ee16263", "comment": "Malware payload (AveMariaRAT)", "value": "d59c85c6d0b6b797424c97e98932d8297bebc824", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076813, "uuid": "ba308c24-51d4-4aac-897b-7308ab3bcc5c", "comment": "Malware payload (AveMariaRAT)", "value": "e37b36390fffb046ad00edb525b484c5c05ab0cf6b09a8bbaccd49002b3bcd319b50337c434c0ef8acee370006fb68f3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076813, "uuid": "ba7b25ce-80cf-4477-8280-5487754265a9", "value": "T103D38D13BBE64436E6F202B02DB97E7597BCF9341A25C68BA3945446AC32C44FE36353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076813, "uuid": "d4c2c5c4-701d-4195-b70d-1ec01cab821f", "value": "56fc94e02d7bc310030753938e49a91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076813, "uuid": "e62e2194-2f91-4001-a5a6-cac3fcc7a149", "value": "3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686076813, "uuid": "e45b3ddc-28f1-4aa3-90ab-c4a9a89e52e0", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686076813, "uuid": "36beb4ca-837e-440a-91f8-52a93fe390c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076813, "uuid": "329d7dd8-eb42-480a-874a-2938da6500b4", "value": "b1fe7f3fa300c9143c589cd81ae4efc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fd7b55-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089943, "uuid": "d39d4006-b0ee-49ea-aad9-bcff0de2e1d5", "comment": "Malware payload (Mirai)", "value": "589d55e17c441727b725110e2c4c6846", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089943, "uuid": "39a6f03e-ae97-4fd9-95ee-00e8bc1f645a", "comment": "Malware payload (Mirai)", "value": "4ded8683f7e4e2931b92e02f1c8a4065542b884d3d03c17f91871cdf5570b0d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089943, "uuid": "3e9c21e1-227d-4254-8a58-e4da54ba89f6", "comment": "Malware payload (Mirai)", "value": "aa0eb06303bfa5c888e0e0e12ef9f85aaed858a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089943, "uuid": "42886740-6a1f-49cc-adfb-391da0e4c509", "comment": "Malware payload (Mirai)", "value": "475bf26d31f1dfd73e4d94a06e0fe4f476cac302cb86f76f58e26cd72b753b6993a76dd849ca591504715f65830b4d52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089943, "uuid": "4e0f3c3b-4c88-4550-a953-d4aa4529ef1b", "value": "T180330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089943, "uuid": "4549e9e5-44a3-4e2a-ab0d-5fd8bfcaa14b", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oG2:r/hqaJMDg9eqK806MHdkfQX6HuC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089943, "uuid": "bdd151ee-945c-4732-a655-d2916c7c21f9", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089943, "uuid": "85517fdc-c9e8-4aa3-8813-a858ccc3fcdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089943, "uuid": "ad3cc8cb-3b68-4ed3-a6d0-512c44e4ce47", "value": "589d55e17c441727b725110e2c4c6846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226a0a83-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089939, "uuid": "2857b1c6-edc4-4a55-a56e-37dc84262441", "comment": "Malware payload (Mirai)", "value": "90eb5ef8245f731aca3ccfa644de2630", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089939, "uuid": "96bf7447-ba6a-467e-927e-656a72384e95", "comment": "Malware payload (Mirai)", "value": "4f5aaae28c16a6521d57dba88ead9bdb6a3be854e57b4090f6057c8058c7675b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089939, "uuid": "ef6b8c99-e7a0-4a86-9705-7c06c11939fb", "comment": "Malware payload (Mirai)", "value": "af57dbb787547b89ccf29c6259923e5036b1d052", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089939, "uuid": "f740da7f-8040-41a9-a676-f650a55f9f11", "comment": "Malware payload (Mirai)", "value": "ac33ebbacb32f7f66997374fdd852ec93a89e3c1ca9159c89f3630581d25372b27c540d31a71d5f3e7c1dd4d8b0d145c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089939, "uuid": "5cc4a759-143a-415a-9f61-7263148a7099", "value": "T151534B99B4028E3DF88FE97984160E05BA2023D112931F276BAFFDE37D331659D16E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089939, "uuid": "4b8fd1ca-a097-4ee5-a0a3-8f12e137bcaf", "value": "768:2eY49YE204qEkRf/36fmODeiuQlJZvTgFHq1euk8B8vpG97ErlfXySJ1oXPo7Pw:2Y7EkRfPh3iDx8Fq1Xk8B2aErlfiSJps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089939, "uuid": "fd5f4619-53f1-4124-9065-706fcafca49d", "value": 65096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089939, "uuid": "734a5e3c-6306-4bf7-aaae-62e47c932c91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089939, "uuid": "87a221ac-8a00-48bf-8aa2-ef95f2ed7bff", "value": "90eb5ef8245f731aca3ccfa644de2630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edef0a7-045b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686049990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049990, "uuid": "d143bdac-dd98-49b6-b3f2-353f45f1cec9", "comment": "Malware payload (Mirai)", "value": "934b6711a71d131a30338900d1c9d6ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049990, "uuid": "93cd1dbf-d113-40a5-a1b2-3973637c2b59", "comment": "Malware payload (Mirai)", "value": "519d85994728d2e086df6545b43bf33f02cdc61517064158f5c88181b66bd295", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049990, "uuid": "0d18e020-2996-4b45-8202-dde3ddb112f3", "comment": "Malware payload (Mirai)", "value": "6cfdc9e3374017e1426e0623f1e8fa14e37346d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049990, "uuid": "a1e6f7e1-88bb-4c58-b8a7-0b73b32ee4f5", "comment": "Malware payload (Mirai)", "value": "c49723dd07d0cbe1c5439b1ba815aa75b5426fc092ef24f24b9f89057a446b7b5002788a63a7499a200d997bbe2a894b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049990, "uuid": "d8824823-b14b-4a69-b763-28390013a857", "value": "T130333BD6B902AD7CF98BE6BE80270E0AB53123541053073777EBFC937E321949956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049990, "uuid": "7cfad6c0-b12b-4a6d-be7e-bc40bceef55f", "value": "768:8CeKEfhe5Xdrben4I1fN5KQnaodgFHx+iPuvWeffpqmUJT6r6Lu380D4:dsfIBZeXl5nKFx+imvppqmUJQ6Lc8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686049990, "uuid": "2c2b192c-9aa7-43be-8160-79e26326d801", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686049990, "uuid": "14790bc4-73d9-4890-b610-d32dcaf6a380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049990, "uuid": "b8799fd3-0faa-4cdb-9076-54a9db55cc64", "value": "934b6711a71d131a30338900d1c9d6ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c03f42-0481-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686066349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686066349, "uuid": "4ce98730-923c-401a-ac05-d55cd3514673", "comment": "Malware payload (RedLineStealer)", "value": "2c7c2abddadddc4eb190d66c65412fe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686066349, "uuid": "7cadf99c-ba49-49bf-b6f3-68528d29ed60", "comment": "Malware payload (RedLineStealer)", "value": "51f0ef264a73c56b191eeeca19c29cd70d445e5b2f110176d9c21a681838c42a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686066349, "uuid": "0366701d-59ad-46aa-a86d-3e400be3e90e", "comment": "Malware payload (RedLineStealer)", "value": "0aaa7f6509d1f33da676a510b06a2c0379818f20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686066349, "uuid": "2cfbd097-6604-4406-a1a8-767d907db92b", "comment": "Malware payload (RedLineStealer)", "value": "9a0c91b3dae5b68502a6dd915dc59b21fd88918b7c8dadb138c30b0981ad49d254d01619349dfc07f3c7ef99a93c4548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686066349, "uuid": "f8a0910f-75b0-45ba-a62d-48e208e49adc", "value": "T197F41303EAED81B3ED712BB454FA03830F397DA12C35876A2755994E0D73296B53632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686066349, "uuid": "d9fb89d1-ece3-4753-b34d-6df7a3accb66", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686066349, "uuid": "22d99163-ab70-4d73-86be-b0338cbfaea2", "value": "12288:OMrey90ArTyG78Vwy8jsyFFXI0NB5VXeK+YyoiS42wtiBKcjZUK/jUE7:cyTTyG7V/DNHteaCPViBj2SUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686066349, "uuid": "773afa71-360e-40f3-ba55-97fbeb590278", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686066349, "uuid": "36e5e35a-b81e-4126-ae58-8495432b1ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686066349, "uuid": "9f5f3555-e336-434a-b08d-a3765332bed3", "value": "2c7c2abddadddc4eb190d66c65412fe8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cad8fc1-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089956, "uuid": "4ccc85e8-65ce-49c4-879f-c4d2b6d20bae", "comment": "Malware payload (Mirai)", "value": "b913e4a7b49910d2fb7c1d215df61f8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089956, "uuid": "d777c82b-5562-442f-8866-65dd0f14576f", "comment": "Malware payload (Mirai)", "value": "52168ee6565c091352d3c804d5274480a794e95695f0a865f57e76bf0e2819cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089956, "uuid": "0df1adb4-7e6c-43a8-9b05-f6f5e08aa5df", "comment": "Malware payload (Mirai)", "value": "15c690615970dbfedb1d66ae044e6ad165341e16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089956, "uuid": "30291567-6b4d-44fd-b688-4c15bb5fe685", "comment": "Malware payload (Mirai)", "value": "1c86b2988500d4e0d770f7f19d90e09c9f3a145866c985f88b9e38440a38e871f689f7f9da148471b35a7b2915c6f734", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089956, "uuid": "14b83e45-23a7-4b8a-8a31-be4430884ccf", "value": "T112531A81B48B80F6D4078D3091A7F33FCA31E47A417196BEEF5AAF36DB67A424107249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089956, "uuid": "0f0d7b37-b185-4dbe-a9ea-eff05a4fb640", "value": "1536:8Xzi8ItMeU4Zlq3WEhstAiiM/pRDgrez2T1zdHm9P:oziHtMeU4Zlq3mtAii44S6T1ZH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089956, "uuid": "cf2365e9-afe5-40ff-95c1-c22a5d03ffb5", "value": 62320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089956, "uuid": "d6aa19e1-fce3-4c6e-948d-98659bf7a87a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089956, "uuid": "0edb9887-5352-4184-99dc-7ce996aec3b5", "value": "b913e4a7b49910d2fb7c1d215df61f8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbea57f5-0425-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Redosdru)", "timestamp": 1686027168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686027168, "uuid": "2ce22504-5c81-469e-9697-4a7a9bc2c3fb", "comment": "Malware payload (Redosdru)", "value": "25214ee067e1480fa57f0ffd143ebb03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686027168, "uuid": "5ad6ffbc-438d-4d58-bcf7-25bc743a88a5", "comment": "Malware payload (Redosdru)", "value": "523461b6e1b7beb0ea5596ecf7e4455c3b5930e4280db607cc19a73c88a11a58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686027168, "uuid": "d5e790e9-169f-4030-84d2-7da82a765a44", "comment": "Malware payload (Redosdru)", "value": "799662eb1072181e2d816005b6b105650b605075", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686027168, "uuid": "0b0e33c7-075c-4ba0-aef0-8edeba413693", "comment": "Malware payload (Redosdru)", "value": "9a792cb379ce2bd253d9bf151fcbc582f8b9018288abd0aa6680d4de0da91b7a54e3b1c351954050e3034bb95474f4eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686027168, "uuid": "3eb2fc70-2863-419d-9fba-ab681dc1584e", "value": "T168E36B2431D1C0F2D45601FB8415C73B6672B8785F6669873BCBC7BA2E386E29B39342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686027168, "uuid": "6c2c6be0-0ae0-4ca4-8295-ddf6bd08308c", "value": "4eac46eb01c65a7e209bb87f15f9e46d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686027168, "uuid": "4f2e31e7-3054-4a09-b686-d314bff0bb83", "value": "1536:BwL42hI3IetDA3F39dOPD4IyuKUc7H8LiYHOv3YHV2m9zrPW4B5:BwL4mOIet+uPNyOLiQC3YE0zrPLB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686027168, "uuid": "38a0cadf-a1c9-4b7b-9a27-07dca28864d8", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686027168, "uuid": "53d9eab2-e2ad-4c95-8634-76b2477e42b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686027168, "uuid": "9031e7f3-4a75-4441-9d13-2f57303858f7", "value": "25214ee067e1480fa57f0ffd143ebb03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b145c7ea-0497-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686076005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076005, "uuid": "cb1196c5-459e-4639-b866-9c18611e97f9", "comment": "Malware payload", "value": "5d73628bbc55be7a97b165793ff89a29", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076005, "uuid": "bd0e1b14-63bc-41d8-a625-4e0e418c35d1", "comment": "Malware payload", "value": "53cb0d6fcea0691c567f874309df843df7d7386842a5443907825fc3ddeb235c", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076005, "uuid": "6476e44d-21bc-40d9-a09f-9e2ea74931e2", "comment": "Malware payload", "value": "aa7a4f5623d7bf83ce017f34e1976781b4389d75", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076005, "uuid": "bc7c0bb8-df84-46e1-999f-9394415d6a90", "comment": "Malware payload", "value": "e7713f5c3147b442cbd80213549737363f07f9d76ea6e442970e44117717a515dc1bbcf372dd4fd532599fe7f2925416", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076005, "uuid": "500a598b-2569-4788-9cec-48d7f8bc5930", "value": "T1E133D03950C3F88CE40397D6AB2DB9464B1DB36636C818A7297C9E074061EDDF6B78C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076005, "uuid": "0c9a9985-b703-4069-b18b-6cc73f94abfb", "value": "1536:mxsFbT3XQwUi/qznO9/s8KhhbIqt+8YAJXV35gIuOH4GB:4abT3XQwiznO9/5KhhbntIAJXVii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686076005, "uuid": "791c10fd-3e97-4a64-bfb9-e01d92482dc0", "value": 55071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686076005, "uuid": "4ab2980a-6a90-487d-819d-0fc796117ce0", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076005, "uuid": "2b7c4d26-f45f-4331-a594-77048b66d4ae", "value": "bank_statement.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbeafb0-048f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686072701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686072701, "uuid": "e3023183-9fb5-41be-8796-d59a459ebfc6", "comment": "Malware payload", "value": "21e13f2cb269defeae5e1d09887d47bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686072701, "uuid": "884559da-a4fe-452b-b51a-12e83ed2d27f", "comment": "Malware payload", "value": "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686072701, "uuid": "c6b6e31f-27fc-4890-bffc-ed0876d797a3", "comment": "Malware payload", "value": "16d7ecf09fc98798a6170e4cef2745e0bee3f5c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686072701, "uuid": "43f3a870-1a65-4c59-9117-a7bcf1ddb11a", "comment": "Malware payload", "value": "900890d9e15e24335b8ba87ef692fa50acbc807744997529187e31d2699e3a63f4ea0aa542831589739eb62e13866185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686072701, "uuid": "f3cf472c-a26f-44a4-9567-0e0d84d0d634", "value": "T157144BA4BEA034F8C95FC538CA7314A2E9E1F275137462CF4A34E2252F297D0E5366D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686072701, "uuid": "4022e4b9-26af-463a-9319-9a1e018b8ee9", "value": "3edc60bda68569cac7ad7604728ff40d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686072701, "uuid": "6e6f17cb-1d90-4a1c-a52c-3a74334d5d40", "value": "3072:uIYCsz96ZvVJ9b9sJCfShQ0/COLYYfUFtKXFZHOaIKyAYrPcQL9Rsm:uhCS8Bh3SaeCWYE1Oncovsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686072701, "uuid": "472753f5-473c-4ffd-a4b6-7c98ae6459e7", "value": 203680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686072701, "uuid": "79ecc916-7398-41b6-9f52-da422c5e4f14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686072701, "uuid": "793de552-876d-4f08-a8ef-53c73cc5ab21", "value": "SecuriteInfo.com.HEUR.14546.6891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1538d20e-047e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (FormBook)", "timestamp": 1686065006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065006, "uuid": "bad85ec2-efdc-4ff2-9ab1-278d0f0ff8e7", "comment": "Malware payload (FormBook)", "value": "03f68e754aaa9699ee2ef3396020e5ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065006, "uuid": "79e4d878-82af-4cbd-8949-35ea3e1fdbfd", "comment": "Malware payload (FormBook)", "value": "54be9ba2765771cc0ba840828116938a88a6bc48732f79113afd36b3e1c264ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065006, "uuid": "7d3165c4-c22b-445e-aa49-62431160507b", "comment": "Malware payload (FormBook)", "value": "1006050371550d0a31c17664e51a1ad91473ff6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065006, "uuid": "b81b68e5-993b-446e-aaa1-18ef8918d9e6", "comment": "Malware payload (FormBook)", "value": "2eec7ece4ca8e22d799f2982a391fe40bf3a8afb9b76ea2437b33bebee25576bcece891c0d014d5b2ac0925b3c0bce32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065006, "uuid": "3d44911c-d89a-41a7-b8b3-66c5d87df526", "value": "T11205AE26FDA18C77C47665745C0B57A9E8287F903A38584AABE53E4CAF393403835E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065006, "uuid": "3046295d-66ae-4a26-88d0-90e044936ba6", "value": "0e3a57917dc42fbcd9ba577c5afd3603", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065006, "uuid": "a3e67602-ba1b-4bf2-a595-98164e86614d", "value": "12288:tqcXKzYRKvoT9GfENy1H+n4J6m39o8K796Wbk0SDpcCMZMg:tfXKoT9GfENy1H9Q7f796Wbk0OpcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686065006, "uuid": "44de0840-6867-4a0d-bab6-e3d5ee2c10bb", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686065006, "uuid": "2d85bd09-688e-45da-ba3f-5c55a1b15ba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065006, "uuid": "75da5040-0a9b-4249-9d02-626f3ac0dc27", "value": "proformaXfaturaXpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd081d4-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017752, "uuid": "20b11ddd-3636-4025-a787-031e344cbe90", "comment": "Malware payload (RedLineStealer)", "value": "b7c2e7ebe4f0e11dcb135f9933549f90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017752, "uuid": "b13a568a-a8a4-42f2-b189-aaa5b2839e54", "comment": "Malware payload (RedLineStealer)", "value": "54f062e4a883ec745fd527adab8e20ce0b636afa12c60c17e65be759e0337c37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017752, "uuid": "bf395e55-1a44-450c-aaac-08ce10cff0d0", "comment": "Malware payload (RedLineStealer)", "value": "01ef1721c56adfae181d9cd04a820389fc343600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017752, "uuid": "73cf014e-bfaf-4c7e-8373-eaf0a45f7470", "comment": "Malware payload (RedLineStealer)", "value": "9373813c6a2e9cd38d867f7a45342ebd812f21e081b14c24cd16b74c9454bdd776933dc55e98a88fd96d373b94317442", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017752, "uuid": "c191b3c1-7221-422a-b88d-3e94812d1fe0", "value": "T134152282D6E65132D8B41BB46CB503D30E31BCE55A7C476B27924C4E0CB27E9A4317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017752, "uuid": "1abcf4df-981a-44e7-a147-7efd07b1216a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017752, "uuid": "b09a2e5f-29a1-47e9-9db3-2719a60143ec", "value": "12288:9Mr4y90nA9WFVWIP6lWECTebBIWk6akF81ualEvIHCaDlTy3uT9FEc6:Nyj98TaFIWk6ah1ualEvIzDlGuLv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017752, "uuid": "de844ffe-305b-4c8b-a25c-925ee4b604f6", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017752, "uuid": "2ec74e81-f770-4a41-9f96-9a2b3ee4d932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017752, "uuid": "05514caf-aae0-4db1-9d6a-327db8ff77ae", "value": "b7c2e7ebe4f0e11dcb135f9933549f90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d5ed30-042e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686030808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030808, "uuid": "d3cc633f-e7ae-4bfb-a447-f6fae4731bff", "comment": "Malware payload (AgentTesla)", "value": "ce9c82e5d11b11812e5419826afe7b27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030808, "uuid": "02a9150f-f4a0-4af8-87da-7579a05b8fa8", "comment": "Malware payload (AgentTesla)", "value": "559699ef7f04f7b186ad17c34f1fd54e856f6f2add3d1ed2a3a3be49afef8d02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030808, "uuid": "56bf208c-2e06-4b0d-abb5-d2f03dbe4030", "comment": "Malware payload (AgentTesla)", "value": "d762070b78ce86dafa563d82bad1eb57ca837fbf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030808, "uuid": "ee635842-2c3d-44f7-b358-4531ba3b85d5", "comment": "Malware payload (AgentTesla)", "value": "d0f0c63a3ffea45a228a6d441f5c3aa3db51d0482906624898c29403f445b3084b6627b80ce6aad3bcbcf7ce1f13a745", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030808, "uuid": "f93718d8-5b0b-42fe-9df5-3b9a464040b9", "value": "T16792066DD78B45A58F54A336432B4E4946BCB22EF74640B678AC473037EDC3D0AA25BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030808, "uuid": "ca9ebbf8-7263-4f05-b225-984eb0fe387b", "value": "384:B6Q/v2BAtN8O4ZrZM6yjUvvd1Tvb41zfrTLaNLI0vIg8v2Tq:pm9Oi+ZjM/bgTT2pITpvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686030808, "uuid": "f9140478-f97a-4d56-ab78-d6ecaa337be2", "value": 19347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686030808, "uuid": "77ba5332-8987-4669-9432-232db1e5c9e5", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030808, "uuid": "8a16b64c-7eb0-488c-96a0-464df8383b26", "value": "FILE-4291937.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bd06f7-043d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686037113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037113, "uuid": "2b517142-d03b-4d1f-b610-8fd25f2ed07d", "comment": "Malware payload (AgentTesla)", "value": "2d5ef436970fb7d3134130d2fab6059b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037113, "uuid": "b4944111-cc49-40f2-8ca1-e4ce43de8046", "comment": "Malware payload (AgentTesla)", "value": "55ea1950784318ebf5ae03a91d1099868bc0f17568ceab1786171b50299fef11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037113, "uuid": "7cf9993c-0572-4141-a979-a89a71a12604", "comment": "Malware payload (AgentTesla)", "value": "e58547da72488412643a447737bf6841da501fac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037113, "uuid": "98b4cddc-dcc8-4f94-9354-736141fbbc9c", "comment": "Malware payload (AgentTesla)", "value": "8c3ac9876487e174e245edc3a9b0c1d76d132d13421a4bfa42bbed76ce19480da31a6e8bfe2d02922276ba736421528d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037113, "uuid": "4cff4add-a650-4d20-b1c7-9c04e4df430c", "value": "T129D4233F746C11982A9F3F068D52893BEDD8A8787D935CA1F1E3AB5085DC10690EF5AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037113, "uuid": "cbddd29a-5dcd-4cb7-b247-0402d9e2d5e6", "value": "12288:oKiRK/CStd17IgmjjZGkhom5Krm3hrwCFPyn7UtV6gpUK1SypyE:obRK/jtUZVhirmRsCFMwtV6+oyYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686037113, "uuid": "77b23a55-934b-4d6e-a564-fd0f1f826200", "value": 629415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686037113, "uuid": "9732399c-ebcf-4699-81ae-4ae4abbba661", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037113, "uuid": "21a8ce95-a3c4-466a-82e6-5b9c7585550f", "value": "INVOICE NO. 29998172.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c0b62c-0462-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686053271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053271, "uuid": "aba29dac-c14c-494b-9a52-97c826de7e57", "comment": "Malware payload (AgentTesla)", "value": "13fd070805023a32789bd2f33cf03672", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053271, "uuid": "2166fae2-26ec-4a0d-8a8c-66a4bd24555d", "comment": "Malware payload (AgentTesla)", "value": "57612efa1affde339955e3a1337dfde2f1fe43b4ce05222eb4f43320919720cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053271, "uuid": "6a546d74-fc22-4256-9df7-8e403759291e", "comment": "Malware payload (AgentTesla)", "value": "2722fc99e5d223f3e29b031c9bad3170851c2041", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053271, "uuid": "b5f2e2c5-26ec-4cc9-90b9-0324fefdf39f", "comment": "Malware payload (AgentTesla)", "value": "9a906a84a518df915640f617db651e413e60e99a00b1871c7bdacf67e23a644d493481f1d877c3cc84839cf192646dc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053271, "uuid": "59a828e1-d345-41f4-b563-ef1cdf86a372", "value": "T19CD42344F64C2F516C12E5DDBD3B377158E94E0ECC87B1AE9588BF113228777A910A8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053271, "uuid": "ed7b3e3c-6e5b-4f0e-a850-96605ce38bf4", "value": "12288:Yzsfr+Seo51N3MGfmTXneWV8n60Wct4L8JIVB5w6PEX1tkt30Sm7Bt:Yzsftf51N3aSW2n14QJI5w/12t0SSBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686053271, "uuid": "b031d5bf-b0a9-4f6c-8b80-8668e5891443", "value": 621342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686053271, "uuid": "3864d5bc-2825-4102-bb1c-4ebd5bc1aac7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053271, "uuid": "3442b56e-263e-42cb-bd9a-f4234c948d3d", "value": "INVOICE NO. 29998172.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665db427-04c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686093918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686093918, "uuid": "fe0d5a33-657c-45a9-a289-b60fabe547df", "comment": "Malware payload (RedLineStealer)", "value": "5e46335e018a22409430e9b58f8f90a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686093918, "uuid": "906f3ce4-d20e-49e1-8055-d7edf0809cf9", "comment": "Malware payload (RedLineStealer)", "value": "57641aef77ca6506c2ae922b35261631de04da377750a3494acbf7ca8951ac9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686093918, "uuid": "ded0f442-3547-4878-9079-e01f375e5dab", "comment": "Malware payload (RedLineStealer)", "value": "37117a8e280621dd8d0f1ccb2613e19f83973589", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686093918, "uuid": "ddba912d-dbaa-4726-90a0-e3b0f4e36135", "comment": "Malware payload (RedLineStealer)", "value": "5bbd21d2b38f0262f59ca19e5fd47b618a5d4ca0788e2bf2012016b219b8d90c754c942fbe8fbf99658a674428fa2971", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686093918, "uuid": "300cc485-19fd-4e26-8c80-07d342b42966", "value": "T1DF744B53D6A37D54F9254B32DE1ECEE8371EF9A18E1937AE2218AA2F04B0171C163735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686093918, "uuid": "50253173-d6fd-401a-911b-f5f67b363749", "value": "cffb13fd9da7f89cf243dfbae0e78962", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686093918, "uuid": "330d87eb-c6e1-40e7-b6cb-2b50d1684ba8", "value": "6144:1GgPQI+5PJfejn6QmFTfhLfWSvDXRRNgVB:1XQI2P4bG1DWS7RgVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686093918, "uuid": "4aece260-2293-45f6-931d-3df1b0888769", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686093918, "uuid": "b33bbbd3-7658-4754-9fd4-5b1bcd66e98c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686093918, "uuid": "28f58074-608b-46fa-9a30-4ae2fabd8c09", "value": "5e46335e018a22409430e9b58f8f90a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25e14c2-046c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686057565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057565, "uuid": "ff00a719-4ae6-4355-8554-1a4629407ab1", "comment": "Malware payload (DCRat)", "value": "e9bbece92ef2c356a8de741afe5c030a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057565, "uuid": "1601f145-8266-4c78-b3d6-d2c064f3ce90", "comment": "Malware payload (DCRat)", "value": "5a1a08326c4e32d6b5c9558918bf6e0d31ba8646cc8fbc5974e929f364ebd824", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057565, "uuid": "784655fd-73c4-4e12-800f-14222cebb068", "comment": "Malware payload (DCRat)", "value": "d0b90cb7aa514bdf3473165a4fc8721effe41528", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057565, "uuid": "4887f0fd-af01-4b3d-b37c-abfbc68f4b77", "comment": "Malware payload (DCRat)", "value": "0c0411069a975fc0f74f72a793cd9ddde95e93001dd7175538977a61a6c7c1d676d8b29f2b4b24d627ebf8115acbe011", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057565, "uuid": "d43c4ba8-f923-401e-ab4a-25a297f081ac", "value": "T123236C003798C136F6FD4BB4A8F3A2458679D66B1D03CB496CC811EA1B13BC696036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057565, "uuid": "5d5e69ae-7c94-43d1-b91b-9157cdc5b90c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057565, "uuid": "ee18e1a1-9a1e-4bf2-aa0f-6eca378fa974", "value": "768:Eq+s3pUtDILNCCa+DiP7K9owXhijHe8YbtgA2R84fBkbvEgK/JDZVc6KN:Eq+AGtQOgowXo+zb6hR84onkJDZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686057565, "uuid": "31bfb4ff-a9c3-4726-b71e-5426412d3ac4", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686057565, "uuid": "ad04c8b5-7c0f-4998-8933-4cdf2a5a01b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057565, "uuid": "4fd80b5c-e40e-46a9-90b0-daf31b235e69", "value": "xCkL80xnVGP4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b684f509-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036071, "uuid": "dc676acf-3b56-4df8-877b-f7d467e238ac", "comment": "Malware payload (Mirai)", "value": "54aabc4ecb657f870c23649665051f4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036071, "uuid": "d095c711-98d2-436d-82d7-6369bf4f5f00", "comment": "Malware payload (Mirai)", "value": "5a92bb57a3bdba3b3368c9068f04a553de10b6d09632946fb3f4a962e6cb80e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036071, "uuid": "d677c449-ed7e-4649-8bce-ddc4ef5e4ca2", "comment": "Malware payload (Mirai)", "value": "5d7cc1e7345e9787e1381dca4845364576613b95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036071, "uuid": "14cf2ef9-0b37-4a77-9e0a-c7c49998e301", "comment": "Malware payload (Mirai)", "value": "76adcfb128440b29ab110654d8f10af32ec9e6295aa01647cdaef6b3e785b51c57aa80eef6a768c30f128b61e40e7393", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036071, "uuid": "0fefd2ad-a8bf-4b2e-85f3-04173dc75ea9", "value": "T12E731A52B8818E15C5D813BBF93E018E33126778E3DFB212DD116F547B8A92B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036071, "uuid": "64ae045c-7cfd-43bb-93c5-226a9b567a38", "value": "1536:iNnUhIjLs3+4vJZMEmQ8ArVh6Wzq91BIUUXznEcIbni/HeF/lkl1d:dIjY+KJZRbLh929LIsCHeF/ls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036071, "uuid": "9506b47d-3538-4332-bd01-ec3933a22624", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036071, "uuid": "da0b285d-ee9c-4792-8799-43fb830e81b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036071, "uuid": "9b3cc5bc-b695-45c5-8eff-bdcc8b1d7dde", "value": "54aabc4ecb657f870c23649665051f4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f50c60-0454-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686047319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047319, "uuid": "f5665de7-2d21-4de2-8352-0ac0bacb0ec8", "comment": "Malware payload (Mirai)", "value": "182e677b5a85c8097e179f2de2abe5e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047319, "uuid": "92a5cbca-92d3-4d07-a541-7e9fe4a482cf", "comment": "Malware payload (Mirai)", "value": "5bd717a75cf3597a1a5802dfd678da7a4a038fe430021cba664526c919e9f8d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047319, "uuid": "475780a0-6deb-4502-8564-3250dbbe0970", "comment": "Malware payload (Mirai)", "value": "6e9e91e74eab3fe182309c07db1dd581c4c0d8a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047319, "uuid": "4892610f-5686-4943-918d-4346bce0d497", "comment": "Malware payload (Mirai)", "value": "953b4a8e42a1b57f8c47fe54530090ff6915376621b772e7c95fd4cde7031d674f0c221fa55888b11858c426493f6a2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047319, "uuid": "1b8ee857-127c-48eb-95c6-b7eb7b06452d", "value": "T12BD2E12CD94D6D05C99D3EBD51CE5AB9364CB1C0A35DA98E1712844CB62BF97FC0B0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047319, "uuid": "a8b50a46-d960-4603-afe1-601bf2199bae", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KN0tVJbUWUe:kbDs06t4BEub4sU/MbU0tVYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686047319, "uuid": "0124c507-3b33-4df4-969a-61e471d197b2", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686047319, "uuid": "80b4f9a4-29ba-429e-af22-610e05678e3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047319, "uuid": "78787fdb-1f6a-4fc4-8ad0-fd089c44dc1f", "value": "182e677b5a85c8097e179f2de2abe5e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3911cd01-046f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686058624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058624, "uuid": "afeff10c-6a51-469a-bc3d-03166c09b9ce", "comment": "Malware payload (Formbook)", "value": "a35c6738c0e7c5b1d96cd50273e02a6f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058624, "uuid": "533d3489-00a6-4c68-89d4-633b02bfb4c4", "comment": "Malware payload (Formbook)", "value": "5bdd320afaee4853c7af7c5160aaa42f320f4d035295770016c85581a6234345", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058624, "uuid": "d672880b-5fec-481e-8006-e0666a4e53c9", "comment": "Malware payload (Formbook)", "value": "a8b3372b8b9c93cd0326c96c9f1f9ca0018c7ccf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058624, "uuid": "5bffd63a-e509-4913-b6ae-a9d0453a79da", "comment": "Malware payload (Formbook)", "value": "6b224c69718e928c8dfbf37a14463c6c0d61ca05c00693bfebd189b2ab6bbcd4082e123c71c120698d851de68094b871", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058624, "uuid": "e048f590-2510-453c-8e6a-e6fe7919f665", "value": "T164E4334534666C3C8B35E99F03F62CA488822577DB7EFA1CBABC908F124ED6D011697C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058624, "uuid": "b1bf8d45-a1cc-4c86-965a-64ad63670fa0", "value": "12288:roNTK+tzukAern4EBXInAy6kWzcbxZIO8kOXbZl0SvhF+GcC8Tvxc/MwTg6V1WR6:roJzskAE4pnAdYbr/sl0ePb8roMlwOIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686058624, "uuid": "ef7f7836-e4d3-42cd-84c9-228d317a1f12", "value": 701905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686058624, "uuid": "e5486398-d53b-44e2-a792-99d6d5a34828", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058624, "uuid": "6ace5caa-cbdd-4d9d-81e3-17ab3c455273", "value": "Payment receipt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bfc2910-042d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686030443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030443, "uuid": "e61838c1-ba88-4d2b-93a2-46a77cd541a6", "comment": "Malware payload", "value": "23b7b0e6737283bdd1b75f61990adbdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030443, "uuid": "dfe14a4e-20e1-46c2-b6b2-c3e32fc261cf", "comment": "Malware payload", "value": "5ccff9af23c18998221f45396732539d18e330454327d1e7450095c682d8c552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030443, "uuid": "0b8b9ac1-b486-4a8d-bad1-4c66ecbf4c43", "comment": "Malware payload", "value": "332ac6e86dfc5868f0f4d2de8400e93a85cf7a9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030443, "uuid": "c4c1346d-5b64-4037-a981-dcf52ac0b0ab", "comment": "Malware payload", "value": "ee8557d59fe39d6eb05bbb60f49d2004ba4b21311cf574415a47c566b21b1f03e09b72ac0b31854e8f8cef925d9035b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030443, "uuid": "ac09ba18-fad3-48c7-b5ac-d3e59620bdf6", "value": "T1BFE37C52BAD184B1E6B709311970EAB14E3EFC700F61AA5B6394067E9F30AD1D931E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030443, "uuid": "ed8b1277-7211-4080-bb98-05904a693e76", "value": "f0ce77ca084d84a10de3be29240ece63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030443, "uuid": "b64df4fa-f927-4576-a97e-6b31fde10dba", "value": "3072:Lpc1E4n5QgtYCSb28r2854eEehSsSKBHdinqN9mIi6YLSLKlUpv:LpcV5Qg2728HKT2SUHNKapv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686030443, "uuid": "0e21b32b-d025-4145-8bd3-2834796f1826", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686030443, "uuid": "870ffb60-954f-4c8b-a418-dbfbe66a0e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030443, "uuid": "c09f5686-51b1-45ca-b7ad-6c797d633b1a", "value": "mallox.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371400e2-03fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686009658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009658, "uuid": "4a5d4909-9e80-4996-ae39-3cf37f4090a1", "comment": "Malware payload (RedLineStealer)", "value": "f1b938966a4435128b9e8f5ca98581e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009658, "uuid": "d2e2eae0-e44f-49c0-9348-79e245490f55", "comment": "Malware payload (RedLineStealer)", "value": "5cefa4451ba39e3cda769c249affd714b50695df30f8158bc9693bc9a8832db3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009658, "uuid": "2c185f57-96cb-4d39-87ea-5c469740b1fe", "comment": "Malware payload (RedLineStealer)", "value": "a10fadc853c3722e604efe1ccf6c489c44e0797e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009658, "uuid": "75fd295a-3746-43cd-b6e0-33e562fcbaac", "comment": "Malware payload (RedLineStealer)", "value": "66d2234face440053046b681302bb7b8a2946631793c200e33004b218a0cd7095930451524a9c31e84cf4bb3a36501a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009658, "uuid": "c7c0f43e-91c7-4bd5-9fd4-7932c10552ef", "value": "T1F2D41253EAD48033C9F527701CFB13930A7AFCE15974866B2646689F4DB26C0A97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009658, "uuid": "e6872072-82be-4367-93e0-de958d8fe76b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009658, "uuid": "2d623d63-63ac-4056-a10c-d612c0cbeb77", "value": "12288:gMrfy90lkBuf6NgvN8qVnLd4/Ex0OlKLwWACm7AYGJWHT/dm:Py2kBI6NkN86LKExht7Aadm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686009658, "uuid": "e6b1979c-894b-4009-b550-1766cd2c1ca4", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686009658, "uuid": "fc2b2b62-d235-4c4e-835d-f1424c2d557d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009658, "uuid": "d03a26d4-4b50-4cbe-8c2e-9c32e98548bc", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04b087a-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1686059253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059253, "uuid": "32246b8c-9a76-4d33-9781-7831a39828ee", "comment": "Malware payload (AZORult)", "value": "6304e54325ff26109e8dcea07bfd74ad", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059253, "uuid": "0b4b1654-2655-40a1-8e19-17dd2d4bf0be", "comment": "Malware payload (AZORult)", "value": "5d2e841645576d0eefcc6bcc6c0d480c0c6874f05a56e92441319a5c41b38979", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059253, "uuid": "524f09cd-3ad5-4150-a9ac-35f136f0f7fd", "comment": "Malware payload (AZORult)", "value": "73f324a4eaca1309f0442fa1cd48a88c8dd06067", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059253, "uuid": "20edf851-a6dc-4d4e-be23-4ea539dde08f", "comment": "Malware payload (AZORult)", "value": "12865b99bf1e961e416ff3bc8de612aa25d68be50bc1a17530e967c6bf5add1e2b25e9eb02d2517ed47f7438639c65f4", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059253, "uuid": "cb67456f-86d4-46a7-9e60-4c9b42e29823", "value": "T1AD86013206A3FCFF97AD3944D4422B510CC868B3621857ACFE5104EF29F5768A97A9F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059253, "uuid": "a9fa21c5-5459-459a-b689-4318c064c5ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059253, "uuid": "ee8e95ac-a59e-47fd-8543-fec5032e295d", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka6U:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059253, "uuid": "d4dbbf4e-3562-4d27-838a-5a68c72aa2ac", "value": 8157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059253, "uuid": "10ebb231-cfe6-4988-ada1-427cc41ce3d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059253, "uuid": "bff0a0df-62bd-4a0f-8ad4-718a21dc9182", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32f715b-0449-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686042508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042508, "uuid": "3fc41cdf-b39e-41e7-b9dc-c0119056625a", "comment": "Malware payload (Loki)", "value": "ac9fb655112fabebd6bf695a1005f878", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042508, "uuid": "73460064-27bb-4360-a9eb-ed4f1766cfa1", "comment": "Malware payload (Loki)", "value": "5d9fb7714788f97c046f3b3c1c2a1e02ecfe10686ab6f2696db8d25e4bd86316", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042508, "uuid": "e582f1ed-43cf-4f57-a550-9e1ac49522e0", "comment": "Malware payload (Loki)", "value": "48247ffca4ca860bdb30a3f9212c0243841fd861", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042508, "uuid": "a3649a08-fd2a-482f-98e4-e9ce5bd5114e", "comment": "Malware payload (Loki)", "value": "c1fa26303bd42ad36a707835842b5e65a3031464b49a4a0dca0e81e8b65969f3312483b3f47475037427e4b03aa9cd85", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042508, "uuid": "9e5455f1-2246-4c53-8669-341a96b42c93", "value": "T198A3D65967E69E13E25C063C646326891737D3086EB2F757F86C813A2F533E29CE0392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042508, "uuid": "dc4c6d0d-d1d0-46c5-a7bc-80b34dd983e9", "value": "768:/6Nyecx7gKng+pF0WeIUDNC6YGcoMcRC7n8Yila:C0ecx7g+70dIUpC6YFoFo78lla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686042508, "uuid": "430dedbe-a45c-40c5-9699-6aecbb380772", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686042508, "uuid": "a473cfb1-77cf-4858-be9c-cf063012aede", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042508, "uuid": "b23ec8ad-5875-4b90-892b-39f259648d2d", "value": "Sipari\u015fi_P.O_4029064_Decorgru_pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6b2776-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686090279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090279, "uuid": "758b8c66-3ebe-4592-9e85-995a863690da", "comment": "Malware payload (Mirai)", "value": "fce914b8fdb5efbeb87e389fdd29ae76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090279, "uuid": "d4a1b06f-75c7-4222-b2b4-957d59f91ef5", "comment": "Malware payload (Mirai)", "value": "5e29125088ccd66b75a484d8f3b68b9424c99c6bbec4302db2d3df8a5434c1c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090279, "uuid": "a09236e4-37c5-490f-844e-637cd3433e0b", "comment": "Malware payload (Mirai)", "value": "e037b676f45410433b047b5b726330f09eb8d827", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090279, "uuid": "2957a5b0-27fa-40a5-b9a3-3a43d7c58d22", "comment": "Malware payload (Mirai)", "value": "889379b9a0e2b598080485d2c9df4a64b6a2ab137848da1d1add43ae9aa059cc556cded3bb3c1b3d4faed44589cce5ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090279, "uuid": "2291908f-f0f5-4f87-bc84-34c520a69f66", "value": "T1C082DF3051AB74F8CBF14430EAEDCEC697260BB8D1FC36A317596B78894210661F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090279, "uuid": "85ddd39a-663e-479b-95ff-0414184d3500", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaChymdGUop5h5le:6/V0P6+kom0tVAoNvm+to1Cs3Uoznle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686090279, "uuid": "16ecc37e-15bd-4522-9d2d-b31ef06a2aa2", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686090279, "uuid": "9b457e47-f667-4587-ab66-23dadccbd890", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090279, "uuid": "f6c3d11f-431a-4473-a27c-c6b38be6489f", "value": "fce914b8fdb5efbeb87e389fdd29ae76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884b0f4f-0457-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686048449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686048449, "uuid": "41db494e-69f4-46b2-bef5-a6c98e1ba6cb", "comment": "Malware payload", "value": "db88a583923a13c4bc61215eb15953fb", "object_relation": "md5", "Tag": [ { "name": "implant", "colour": "#3A798A", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "side-loading", "colour": "#36A022", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686048449, "uuid": "b686eb6e-1bf9-4352-8565-eef76498f7dd", "comment": "Malware payload", "value": "5f9de1f10695367283b29c0baa660cabade8cc74e17a98431c5974e224806b49", "object_relation": "sha256", "Tag": [ { "name": "implant", "colour": "#3A798A", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "side-loading", "colour": "#36A022", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686048449, "uuid": "df9b3c5b-eb73-4a3f-9ca6-16dc39411fac", "comment": "Malware payload", "value": "e90ed5c1579efe4bf20e37ac6aadd391681b3e65", "object_relation": "sha1", "Tag": [ { "name": "implant", "colour": "#3A798A", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "side-loading", "colour": "#36A022", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686048449, "uuid": "8182802c-d56e-47a2-835a-a02caab9d8f1", "comment": "Malware payload", "value": "b88fd112df89a17160480155a4f0fb2df08accb4e5e6baed9b3b1cace9c7272f7152ea71f319a6a19cd70cc132aef10f", "object_relation": "sha3-384", "Tag": [ { "name": "implant", "colour": "#3A798A", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "side-loading", "colour": "#36A022", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686048449, "uuid": "5ea84206-34c2-4772-9643-f2f144dab1a9", "value": "T136E5DF52AA48C3BBC1698330C4531AF49BB4BC85E666434B37BDBD153F32B906DE9B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686048449, "uuid": "43e47e6b-e0bf-4e3b-bf0d-62d73c1d78d9", "value": "12288:VRAlCC0g+k6FA/vMa/TLJEGXtUY31mcNLjxbvGyLVa9hMX+6A7R:VRAlf04dUVELjxiIa/v7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686048449, "uuid": "0d8e8ef7-e7df-4a61-a77d-b58394028205", "value": 3211264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686048449, "uuid": "49107bf7-819e-4520-9ba7-20eeae760733", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686048449, "uuid": "84167a80-f271-4976-a3ca-0269238a5c8f", "value": "Imogenn Clarke Original Images.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ef251a-044e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686044445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044445, "uuid": "5af1bf7f-df12-4695-b09f-b52ead522449", "comment": "Malware payload (RedLineStealer)", "value": "d69145b44933a4cab101664cc1b44157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044445, "uuid": "9c010fd2-323c-468e-a639-b90316878dc6", "comment": "Malware payload (RedLineStealer)", "value": "5fdaddb93b075db8a961ab801fb02decab21ab3c01cd2c5ea041c0d277da02d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044445, "uuid": "4253e37f-bb70-4d77-88ec-f8facb35e04d", "comment": "Malware payload (RedLineStealer)", "value": "032d4582aed85fbc7553d4e5dc329c118b3365e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044445, "uuid": "3766e6dd-30f4-4904-ac56-685d527ade8b", "comment": "Malware payload (RedLineStealer)", "value": "3bec435f7b3c6a1410a7a20f54dcf5fea5f0efd7cd8b717e701b75abe8e827dfdf21ac795e4bf0ad94892cbf72d18459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044445, "uuid": "c5beca04-63a3-415c-accb-0e9b07b71fc1", "value": "T10E152247FBC85473DDB22BB058F642C30F367DA19D744763238A69462CB2984DA3672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044445, "uuid": "5678a09d-ca7e-4620-9e69-566515bae2ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044445, "uuid": "c8685de1-5618-4a71-8104-5540fae1631e", "value": "24576:lyulCw/r0IdxPNEdeYbwvyPaQShs6ru2hkL6e:AulCwzTFE4Yh1Shs6rVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686044445, "uuid": "a46558a7-3745-4a8d-8da0-a537bb9c0416", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686044445, "uuid": "bab46338-ecb0-48bd-b55e-c13990a16d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044445, "uuid": "cce10266-c2e1-429c-9a1c-7bfddb4d5ed4", "value": "d69145b44933a4cab101664cc1b44157.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e5fbad-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017759, "uuid": "df2edea2-20e0-4be8-b71f-73273d46a341", "comment": "Malware payload (RedLineStealer)", "value": "cbfa835d1107166f9d35bfa5a3b42c9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017759, "uuid": "3e8bfef9-f09f-4e93-801d-d277a8437920", "comment": "Malware payload (RedLineStealer)", "value": "6147ef5911d7d921194da2e97432344a1d4c36a0b8070969f187609d6e367e29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017759, "uuid": "a1bc119c-cde5-422f-af72-231bd739274d", "comment": "Malware payload (RedLineStealer)", "value": "a9dcb9a05645b3a68cab2988a546d01a219fae5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017759, "uuid": "9aea240d-31e2-4309-829f-dd39606ca892", "comment": "Malware payload (RedLineStealer)", "value": "e54df194a1e4069df4c947c7305239a46f59acc060c18e4f1363def2a2e04b903b2267eba65a9ccc756298567e581fa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017759, "uuid": "b6077750-5261-44b7-9555-db220cd49083", "value": "T1DCD41213E7E49473DCB1177029F613C30E35BCA49EB8526B3B86995E0D7268A643273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017759, "uuid": "5822d3a9-bd86-4699-9759-2528bdc5de3f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017759, "uuid": "43d07677-5ed8-48f6-a2d6-35063e821d3f", "value": "12288:eMr4y90ssZhfaxmV5gqSBfTAB902Yx499biID3ZKR:SylsZhR5sxmnS4PvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017759, "uuid": "283c9ce3-59b2-4634-9a4b-9f519759de45", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017759, "uuid": "9ce1047f-1dea-4381-9647-6ed7f11a8afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017759, "uuid": "ecbb47b3-72bb-48df-a9a1-8379f496ef1e", "value": "cbfa835d1107166f9d35bfa5a3b42c9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb65ed8-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017750, "uuid": "5901f701-daed-46dc-a030-54e1b4044914", "comment": "Malware payload (RedLineStealer)", "value": "9c18ac82f0be2291427ca35f78125995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017750, "uuid": "5a44401c-b8c5-479b-9a7e-7a94db5e0ff6", "comment": "Malware payload (RedLineStealer)", "value": "6188e5f8b617ea28c133767f61549ee8e8e279348c62b13a59676e5858692a8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017750, "uuid": "e44c54bc-d104-4516-a5fd-20e73ff4591f", "comment": "Malware payload (RedLineStealer)", "value": "60a28ac36ba8a172270aa04d2489bc9473388c86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017750, "uuid": "dce35fd2-0052-4348-a6af-bda36a4db804", "comment": "Malware payload (RedLineStealer)", "value": "2c3029ddbed95b098aa9f98d5b50674c6bcfb14873fc3a7e0a2933e6e93033740e3fd53635be7c7212de03ba6d5f5191", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017750, "uuid": "f4d1e8c0-d7f6-407a-96df-375beed33509", "value": "T1BDF41243A7D45832DDF51BB01CFA06871637BCA24D35432B238A765E2DB26C4A63973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017750, "uuid": "fe0bdef1-37df-4718-ad8a-3fee23dc25bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017750, "uuid": "75b12770-feb8-4984-95eb-31ec7dd967c0", "value": "12288:5MrKy90x1M2I2AfcEvXfwh6RaSxNtXZisBaeoo7Fl2F1tmvHEcMDVMviceir4Mnh:LyeI1XMMN0xo7FI1okcMpM+wFnXIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017750, "uuid": "33536268-63c5-4a69-acea-4ef4729126e1", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017750, "uuid": "8ff04c31-374b-47cf-ad29-a45bf62d2f3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017750, "uuid": "05fc0242-0d5b-4c1d-b5e8-cb7abbf575ce", "value": "9c18ac82f0be2291427ca35f78125995.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50314938-0469-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686056085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056085, "uuid": "198dcff6-b276-48c8-ab7e-edff764da873", "comment": "Malware payload (AgentTesla)", "value": "6fbc2c24135a963b2ebaf420b616547b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056085, "uuid": "0b1a6ff8-2791-44c8-9f90-30b6dfdebfd9", "comment": "Malware payload (AgentTesla)", "value": "634401493205da9f6dfc051c97a8722dda99db6ebb7fe04f28375178c2af66e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056085, "uuid": "b5a35dd8-73a8-4f7f-bb4a-b2bc912f05bf", "comment": "Malware payload (AgentTesla)", "value": "c9e331b31e891c431c63b840bb205865737a387e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056085, "uuid": "bfc9c7c2-5643-4396-a49a-4dffddf688cb", "comment": "Malware payload (AgentTesla)", "value": "40c54a1ea2c0a471c1a1eb41ec66b03094abc33b2d760569de046132bd5416bbc4ad582fa5fe282bc60197e57413f832", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056085, "uuid": "cbb1c7d6-f99c-4f87-a5b8-f76d2beb5f00", "value": "T178B42333A70122518E28A76E6C7E17E16CC5CB495A79F2B0C03E7419DF6484ECCB979B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056085, "uuid": "873d4fe3-41b3-4058-b242-581503d95977", "value": "12288:TvGjPbtyW1R1PFPMywm0Hbu1jzjqhpD0cCdN:2DJ3wm6uPE909N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686056085, "uuid": "82d300f8-b2f9-4cbd-b41f-1553fc0c9172", "value": 515648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686056085, "uuid": "1527fff1-feba-4413-8866-cb4c2820d095", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056085, "uuid": "9a64525b-d53d-4496-a60e-751abb7857c9", "value": "SOA 67092418.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9b86b2-0469-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686056029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056029, "uuid": "8eed236c-7ffb-49df-901c-5faa0743dbae", "comment": "Malware payload (AgentTesla)", "value": "4ff2c75a805508f549e85287625ca017", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056029, "uuid": "c191014e-1c0a-4c60-815b-29e8ad2bfbb9", "comment": "Malware payload (AgentTesla)", "value": "642a1f48d9c5ace4260f08821553444d060d0ad1511220f08cbafca2c6e81ae6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056029, "uuid": "60e88b43-8999-479d-8cc0-047baac5bdbe", "comment": "Malware payload (AgentTesla)", "value": "695bd852f3c4bdebf4577ee5ca54ee97d45dd8b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056029, "uuid": "09bc731f-1ef9-41c6-8db9-e34b5e1ce78e", "comment": "Malware payload (AgentTesla)", "value": "8314eb948f0fc4275d9af9a61c1073e714c432b33b30ac9e7e6ffc0d76e5089f9359802c7336b64fbb1d5a82b40f413b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056029, "uuid": "8aac7593-fc67-4f47-b8ec-29815a23ce5a", "value": "T183B42333A70122518E28A76E6C7E17E16CC5CB495A79F2B0C03E7419DF6484ECCB979B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056029, "uuid": "fca45fdd-767c-42dc-9bc7-9c0cc64a050a", "value": "12288:tvGjPbtyW1R1PFPMywm0Hbu1jzjqhpD0cCdY:8DJ3wm6uPE909Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686056029, "uuid": "04bbc816-bdd3-4725-8164-767310e02759", "value": 515658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686056029, "uuid": "a311b80b-d233-415e-917a-b17bf17d0193", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056029, "uuid": "382d1d8c-c48e-453c-8ee4-b60f1681c374", "value": "Inquire Equipment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead7cd1a-0454-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686047325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047325, "uuid": "18b35deb-ed18-4dfa-95a9-3d7a06b2d2c4", "comment": "Malware payload (Mirai)", "value": "220154e5a3fc4457f426505fa72c6f7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047325, "uuid": "30ed9c76-0efb-4dc3-a13e-242e6e416e90", "comment": "Malware payload (Mirai)", "value": "647c47312cccb0e19dc711615cf1bed7547840d8b11435366e5876b65a5033fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047325, "uuid": "c0c3347c-4e55-4631-b5ff-9a3d99944406", "comment": "Malware payload (Mirai)", "value": "56f60d17d5b3aef2365b5e8b5fe2d4cba1eabe0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047325, "uuid": "70349b12-053f-4a91-a778-22ec70225193", "comment": "Malware payload (Mirai)", "value": "db14401abae744e176bed7678759d31b1d0ac1400ed8ff7f223861e0537a08dfd59311a71186c8fe91661536c4e45f3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047325, "uuid": "de845cb0-baea-433e-a737-829b34cbd5ff", "value": "T1F8E2F2A3D3726051DE7C2BB1F97985CB6BBC4BACC57B70A3160566281E560436E3CC93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047325, "uuid": "4b13b039-f597-4b8f-9f30-b205cbf99390", "value": "768:1oiWiO031vpAPbrVWZK3XVGxm9XE9q3UEL5IR:1orm1vpALgUJtLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686047325, "uuid": "5c20c709-6a23-40ce-968c-60a1f2ede807", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686047325, "uuid": "2b81a9a0-415e-400e-b8c7-861c9bb3bb8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047325, "uuid": "b3351ee3-536f-428e-abeb-81eeb2fb4ff7", "value": "220154e5a3fc4457f426505fa72c6f7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef39a195-0473-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686060647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686060647, "uuid": "4e8a3f57-0c90-4bb8-847c-cb917e8bbb33", "comment": "Malware payload (RedLineStealer)", "value": "302b0f6d712eba3d1a0b8ebf8dc98aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686060647, "uuid": "d74e896c-fe48-4ee2-909f-413b00a6fe2a", "comment": "Malware payload (RedLineStealer)", "value": "65141035941017854ad4ac7a2ad9ff6e553da933a2311843f2144366946a2796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686060647, "uuid": "4ba4f5a2-a8cf-4d5b-ad4b-be66c61d1cf7", "comment": "Malware payload (RedLineStealer)", "value": "6c564fafa65f2ab0b6bd5ea791cac254ab7cf331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686060647, "uuid": "3f848f27-830e-4447-a408-f88964e5fe1b", "comment": "Malware payload (RedLineStealer)", "value": "dd728ef21b8ad54ef479a095bdb4ad1f28c92cb867980102c205732e6ecf11f364cea27a1ddb58177a5a162cc9ae21d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686060647, "uuid": "421b3e60-daa5-4dd9-a23a-f6bdcb023b29", "value": "T1EEF41217EADC5533E87127F058F952C70B31BCA29D70A3671B82685A0D32A54E67273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686060647, "uuid": "65f483f9-f844-46ff-89be-bf6763434043", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686060647, "uuid": "5424da48-4867-48e5-90a4-84d03a9da41f", "value": "12288:IMrWy90kbJ6cC+DS6NYfJBBHjUmHzf7J3NPS/qygFBreKIvBCJW5yoQP:eyNJTDSdPbN3NPGqyyBrkIJIyvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686060647, "uuid": "074c1756-f59d-4c6b-890b-893caf1bc68e", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686060647, "uuid": "e50a2532-9c05-4a93-9341-9439b88692d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686060647, "uuid": "4cd4d99e-900c-43a5-9247-10c3d8772f4b", "value": "302b0f6d712eba3d1a0b8ebf8dc98aec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50655c9e-0435-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686033752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033752, "uuid": "38501833-5c69-421f-b526-debfd0b1b4fb", "comment": "Malware payload", "value": "2cacf6978bf86759896f7cf92802e355", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033752, "uuid": "42d87f1d-6af8-4ec3-8b2e-6eddffb45e99", "comment": "Malware payload", "value": "657aa8705f6fe122e55048380304f8d593504f42556abf1f08aa4ab8be90c0f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033752, "uuid": "4efa3da5-9af4-4439-a5ac-f98722dd2a01", "comment": "Malware payload", "value": "fb14acec191284c52323f23c3ad69dfd3c6a7836", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033752, "uuid": "d3bea091-d43a-40f4-a5b5-e98faf7ac60c", "comment": "Malware payload", "value": "a54327ef5c527785a09445b4c3393abdc91690b5af46469c8984b7f1bfabccea0c5d4b4cdd48e2b27855b15eaa48163d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686033752, "uuid": "0b5d13b0-645c-48ca-be0a-95a91ba43d7e", "value": "T1D0D61263C4B3851CECB6867796A358147D52ED4CB6A4C329257CFC8FA4B32846CCB1AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686033752, "uuid": "3394cca1-2387-44fa-ba19-38fcb3ea02a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686033752, "uuid": "815a9b56-ce13-40c3-8b26-ee69f62dadc6", "value": "393216:oLJ/lV0TkP3jQPjn+rKUEF5lxx2Xtj4SwVBplc:eliTejQL+YFAtj4SwVBplc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686033752, "uuid": "d50a980b-97ec-40ee-9dce-5c298e4bb6d5", "value": 13236224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686033752, "uuid": "b4c80111-a64d-4a73-b0fc-753249135dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686033752, "uuid": "155b76c2-f347-4603-bfb3-1972e80d99e6", "value": "Empire of dicks.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9986b4-046a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686056641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056641, "uuid": "202f1732-e93c-41ea-bdbc-23e8984f6d01", "comment": "Malware payload (AgentTesla)", "value": "8703f9a4c679ff850425350e33cf334f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056641, "uuid": "5cd27313-8e17-47c9-89c1-414db23dd3a0", "comment": "Malware payload (AgentTesla)", "value": "65cea55d24d19444f39704ab0836a07e7e89a99b244abfad347516b14f58af0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056641, "uuid": "09152b36-aa03-4936-8328-15e5740a431b", "comment": "Malware payload (AgentTesla)", "value": "3bee76c8cee10f97a5061d69b8e8f18e670e3c01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056641, "uuid": "ebda8ebd-6fee-4b52-a882-3f56a539097b", "comment": "Malware payload (AgentTesla)", "value": "d4644476978b53eaf7426b4fa8b5cf30242b2b04fd180003be30cd75b79cb6f137fb079a3e222287510d89e2d7d82f69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056641, "uuid": "84eb2dc7-608e-4707-bc87-e93ef0cebae1", "value": "T1EE05011833BADB1AD47E3BFC08D0A07083F0615A7256E74A4ED378DA5EA4F058F4199B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056641, "uuid": "b2a745ca-1f6c-42f7-8401-35c61c1ddabc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056641, "uuid": "1f0ca103-ae8a-47a7-95aa-e1cc2cfa1471", "value": "24576:kMkaSHlWxMiQW/O4ue7llpx/8mArPQUpYPuof+:69lYMiQWmS7zr//ArPnpuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686056641, "uuid": "e7959a94-5d20-47b7-a8de-68ecd6610df8", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686056641, "uuid": "d58b3672-f500-40b4-b8f2-5d2a7623ed1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056641, "uuid": "7d165de6-d765-4c70-b0bd-4d47a46889cc", "value": "Urgent PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4fe4652-045d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686051101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051101, "uuid": "f566f6f6-88e8-4dab-a39a-69863d58811b", "comment": "Malware payload (Mirai)", "value": "93b4d9b68242bedb55d7aacb1b0fccf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051101, "uuid": "eb005345-cd5f-4dd6-8aa0-a12651c34f14", "comment": "Malware payload (Mirai)", "value": "65df44523c379b9cf7f334056642e51305af7a8c8b4af7b084b4432632e85098", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051101, "uuid": "47f8a56f-4256-4284-b328-edd7737ee591", "comment": "Malware payload (Mirai)", "value": "9c6b29f6b1b3108766141f0919eedb339b872637", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051101, "uuid": "06ff5711-5e31-4e5c-a67d-7794cfaa77b3", "comment": "Malware payload (Mirai)", "value": "29131ef08428de0d4042224637d124168504cb284734b72245f472a94ce6e93e446bd005e46fcf348b785e4bcfb674e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051101, "uuid": "77c920bd-ebff-4af9-ae8f-cc510e310a78", "value": "T1B7734AC5ED83D9F9C81606342077FF375E76E5BE6219E98BE3E85663EC42602E40294C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051101, "uuid": "7b0d2188-a1fa-4fc2-ad16-da546f9087ba", "value": "1536:W29RIMUpfjqDkK5pqpIjA8FPFLSQ0s6OkGp1bt6ZeVCbhG:MfjfK5pqpIjA8FPFu1OkGphtuIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686051101, "uuid": "981d9aaf-769b-44d9-9c08-a7cadf07e1ef", "value": 79664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686051101, "uuid": "2f4192e8-a3ab-4bda-890d-86923740bf24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051101, "uuid": "59b73ab4-7045-44c1-966d-9406b4906454", "value": "Astra.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fedc7d5-04b4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686088243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088243, "uuid": "b4acdf79-da88-45ba-bbf1-ffc2ae297eec", "comment": "Malware payload (Mirai)", "value": "6d494d192f30ad512164d68953744be9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088243, "uuid": "bde6f510-bfb9-451e-ad8d-35672dd0b5ee", "comment": "Malware payload (Mirai)", "value": "660f11578adce8ef2406712801241192fac5a9961af7822864199aca0effb7f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088243, "uuid": "1e91efd0-2ba4-451c-af5f-6e51fc1260eb", "comment": "Malware payload (Mirai)", "value": "8e8807f494555b0c243ae2d684aec7527599234a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088243, "uuid": "26c56ee2-cfe4-40cb-ac7a-7c7407ac5922", "comment": "Malware payload (Mirai)", "value": "62a1a620935e0b03a297aea2fd2f3932b0f6672acebb2fd60b4817f5431104be46c1a6413d58c1b0e4f6746cc5ed66f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088243, "uuid": "620b65ca-ac13-4b5c-9e76-9b0d87676469", "value": "T152A2E059BF1C86CBC8323A3545D9E9D22252FC61F2EDDC0D2940C16FB1A33A95470F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088243, "uuid": "08e64da6-97d0-41ae-8982-576f69cc72b9", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTe:k98o08kxofBE+ZkXaITbp2F2TWul0c5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686088243, "uuid": "63c8a990-d9d1-4ae2-8482-3a9cf837b9c2", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686088243, "uuid": "4523b3cf-a658-4d3f-a624-225567d2e0d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088243, "uuid": "77d42967-a2cf-498c-a0c5-ffb959c163f7", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caead13c-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (BlackGuard)", "timestamp": 1686059298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059298, "uuid": "84573614-c997-4675-9afa-ce1c8531e9d7", "comment": "Malware payload (BlackGuard)", "value": "06c4b26e4b35eefdd3ba47c2a6316f0a", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059298, "uuid": "600f4c91-af2d-436c-8093-473d58c24aae", "comment": "Malware payload (BlackGuard)", "value": "663f49a7b12d9ef01a0c3c98892d7c9a204cae1afc7bf134da02510b61195bb5", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059298, "uuid": "b7f0b38f-dae8-4236-98b3-23541fecf83d", "comment": "Malware payload (BlackGuard)", "value": "d3af04c23a9b80252445f713a1071f2cf72e6092", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059298, "uuid": "5de4c9b0-37e4-401a-9b42-c0bc9d5b8f32", "comment": "Malware payload (BlackGuard)", "value": "dd828e0720208a2999038fc1da64141b4ab793db5cbdd18798535aca847ee97c27d8fadce8448a304434d0c200f429ec", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059298, "uuid": "7dc09efe-2eec-482e-b922-c5a37985ca7e", "value": "T10DF533588E5A8DE7F012477CE09D79E266E3FA0AFD3117691300B59E7593E3C24E81AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059298, "uuid": "78b275d1-b48f-467d-a312-169aba48e708", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059298, "uuid": "b0d0585a-74a8-4de8-9d41-ef63e92f856a", "value": "49152:6NSK+2TE7nIYHIdHwA8J4Nc/bffdxBtvg8aqBpbzU2OggC1Bn5vs5:6+2uBodQK6DffbB2PSJzlLg65v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059298, "uuid": "1a6b4c08-b042-409b-bf53-a0b9366a5d80", "value": 3491840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059298, "uuid": "c00df08d-c84b-4585-a4f1-9300c208f580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059298, "uuid": "e471fbc3-b1fd-40a1-bc07-4931a440614f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2cb0df-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686054547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054547, "uuid": "4ac74b48-d809-49d2-868f-85b4772bc15d", "comment": "Malware payload (Mirai)", "value": "215bf91c455a5e85f1ebabebcf96ac42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054547, "uuid": "c92c1e89-ad44-4123-bf23-8c3322b3add8", "comment": "Malware payload (Mirai)", "value": "6679003ae7b1da6d6023b5e7d6b57fe1c30c5e517a3794702cce85a167fb42cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054547, "uuid": "aaef58fe-cf39-4a4d-8698-a3ba5c57ccdd", "comment": "Malware payload (Mirai)", "value": "8e294218b245105e0b3456b31c32cf3582e0f7c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054547, "uuid": "312b3adc-77ab-4f7c-bac8-b1ea3c2c1d3d", "comment": "Malware payload (Mirai)", "value": "f1758eb973648ba758858926aae904dcda908d66f7648114ac40c362b5856060986bd0685bc08edf3122a95cd480fd7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054547, "uuid": "e83f8f3d-00d2-47a2-b851-497fd4d5d993", "value": "T142330887B9828F15C5E813BBFA1D118D73221778E3DFB25399116F2173CA92B0A77906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054547, "uuid": "0499cfae-8bd9-4376-b736-dbd289513211", "value": "1536:pxng9nA3q9Z8k2aGkxatizGVIiij5IgDV2CPu:AAQZJpGkciIgDV2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054547, "uuid": "2ace2e23-5a35-41d6-b7b3-61cc0e33d041", "value": 54588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054547, "uuid": "12f408ff-bbb6-468f-a6cc-cd834646c2d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054547, "uuid": "1e518669-c221-4552-842c-b8d0c840d3c1", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.1.1255.5432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe456add-040f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017723, "uuid": "f15d0747-09a6-47fd-83bd-aa13eac39649", "comment": "Malware payload (RedLineStealer)", "value": "04f7fefd1e1a7fd1c41833205b9fa2e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017723, "uuid": "58998a21-8605-46f3-8b98-b5084c10347b", "comment": "Malware payload (RedLineStealer)", "value": "66b7df7b740edf84d18c3b692293dc19e5a108936f10537ad5e9324906c90e34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017723, "uuid": "35cc0499-7e0f-48a0-8921-5ca2e0b02fd7", "comment": "Malware payload (RedLineStealer)", "value": "fa3c4eb9b429559c6dd4c270b16965e8dae31939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017723, "uuid": "170ede0f-abec-4e5d-a51a-d5f36d00abea", "comment": "Malware payload (RedLineStealer)", "value": "da4a7ea5a28c3bd11c27dd0afdaa0e272a228fb866fb3ae480f998894d0fb60426f3fc60615183d80ff9148aa1522583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017723, "uuid": "f61c5eaf-7970-4f4d-b878-92fd511e3d26", "value": "T1BAF41206F7D80532D9B513B069FB07970A32BDB5A878536B3F82A40B0DB3591A836377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017723, "uuid": "212a344a-03a8-4564-aaba-99c3a8852288", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017723, "uuid": "929d99f5-5093-4b03-a13b-70ac9537a3f6", "value": "12288:4Mruy90CidCE16JejWlEVFpkn+Z0nlFr6YNCLG7flGKd9d5f1Iy3YIDDeD6/qlXx:myAdn142Dqlx6DyUKd9TfW+ZDyTXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017723, "uuid": "2c62c46c-ced4-444c-b5bc-a13cb388c8fc", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017723, "uuid": "98ca78ce-4c9c-448d-9279-29557ae9e425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017723, "uuid": "796cc59d-5ece-4c37-a3af-f0f3b1ba7ea4", "value": "04f7fefd1e1a7fd1c41833205b9fa2e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d715c81-046e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686058282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058282, "uuid": "e0090624-099d-49eb-a145-a54cddb03083", "comment": "Malware payload (AgentTesla)", "value": "963224ebdf54a7d8345a7a5de0076ea6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058282, "uuid": "66913510-96a2-494b-b07c-a2d517fc32f5", "comment": "Malware payload (AgentTesla)", "value": "6740e2c4a70c5c3d1242586f9013e2d12bdadf5b75b3412e18d88c9e46fb6dc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058282, "uuid": "2ba4e9e0-2880-4005-a07d-9d292463a796", "comment": "Malware payload (AgentTesla)", "value": "915cb7a8b40e4f267ed32f49e99de616333fc04a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058282, "uuid": "c7eb651a-13c7-4849-9fc8-14eb77a07adc", "comment": "Malware payload (AgentTesla)", "value": "6664b99207fc5d1351f486f0bb3f2427f87ca22429a0f0cca504a546c819a132b0237932372086feaf72ea17cf0ae3b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058282, "uuid": "d1846d27-088a-44da-9d6a-9e063a2101b1", "value": "T1C2942368C5E5A6C7F2B0E13E42539635826B314AB216C6352FFB56F464214E0BB9F33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058282, "uuid": "56288a14-26f9-4a31-8ded-fbcfe9c8fc36", "value": "12288:QENxNiBxGHcZs8ETFFc8hfJY2Qg31Tw/cDOGzk6:ZxQBxGzFFc8hfaFvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686058282, "uuid": "666a5a72-a10b-4a58-89b1-2cd4e2eb4e7a", "value": 411049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686058282, "uuid": "7670f1d5-3ce1-4c8e-aa74-3040d6174b8e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058282, "uuid": "4e98a7f7-4b18-4d34-adfe-b23017808000", "value": "Quotation.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf7486a-043b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686036617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036617, "uuid": "0894fcff-b03b-49f1-a633-ceebcbf449ac", "comment": "Malware payload (AgentTesla)", "value": "cd0a2dc1d0b2ecfd6537d27cfd3743fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036617, "uuid": "317889bd-3cf3-43eb-84f6-e338c2ed0eed", "comment": "Malware payload (AgentTesla)", "value": "67471fae443ff5de8fca2d684c5a7005824c988cfe45583d0b11fa23375ba25a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036617, "uuid": "32d22483-3866-4d98-be9b-6617052eb19c", "comment": "Malware payload (AgentTesla)", "value": "d75ab65bd0841006e09d6d00666567819ed9f2db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036617, "uuid": "21c88e01-3162-4052-9ed6-412ab9652b19", "comment": "Malware payload (AgentTesla)", "value": "acdbdf5b604ecdaa92eb1bf854dc0d44a8f28072c75283f780e5feb9b57886a2b85e0f0b78e37fff97bd016d94ca0559", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036617, "uuid": "4f599e5f-e3e1-469a-b295-2ab080de13e9", "value": "T1F405B63D5BB4CEA390B4C6584BCCB4E7B1859B1735884F5548EE933B128E90D7AC227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036617, "uuid": "cb578117-999a-46cd-8798-cbb0298c7bc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036617, "uuid": "1366cd6d-e166-4443-b365-6ae090822228", "value": "12288:35oyXiTB2QwL8aA5HWldUvVHRJqdsC4EAyRnPLhgTNutZAx:JoyULa4H2UD7e3RnVyktZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036617, "uuid": "e7dd6608-e0c9-48fd-9187-ccfb318a0bea", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036617, "uuid": "231c3cf2-3d2c-4884-977f-45f82eed51c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036617, "uuid": "9b1adf47-1791-4bdc-940a-f49bc003a034", "value": "provide quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a01856-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089964, "uuid": "d5023e5a-37c2-469f-a85f-a005fe91e993", "comment": "Malware payload (Mirai)", "value": "d137c413820b3a3dfc8df4ab4aef071b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089964, "uuid": "8b98f840-c9b8-4f94-a058-de033618b788", "comment": "Malware payload (Mirai)", "value": "67c18cce76f3a8a79493f83c89f11ad13802f4fc066f7d2bfe94aa14ca5fd3bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089964, "uuid": "2ca240d3-cb57-487d-96ee-b806769cb0f6", "comment": "Malware payload (Mirai)", "value": "08cb14306599a34116db32d072ed3dda02579f5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089964, "uuid": "c2393c8a-3dea-4f65-8ad7-e8c33116d7f9", "comment": "Malware payload (Mirai)", "value": "d503893fae146c59dd656140d52ab487e1cdd91130256c38107e4542b4cc0fbd1b42eac95684208a9813f5da06a4e81b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089964, "uuid": "87d2688b-2a62-4526-a5bc-ed406a4990e1", "value": "T15C433C0272280A47E4664BB4653F17F083BFE9A025F4F688690FDB5A8675E371583F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089964, "uuid": "410929e8-b998-40ea-b7c1-4fecc1db6f7e", "value": "768:VITwDD+beORzMZL+nCKWhBRjuTzGXczB7zCMBWo1vHe71xbSpbJO5Si2:VnDyZwiYBZhcVnXsolEHSpb05Sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089964, "uuid": "7d41a476-5dbe-4b3f-b870-0819908170f2", "value": 59152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089964, "uuid": "c4448747-0e22-409f-a114-19a19e9ee141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089964, "uuid": "cb086bb5-a831-46e6-9089-ee207262453b", "value": "d137c413820b3a3dfc8df4ab4aef071b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2846bca1-0418-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686021229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686021229, "uuid": "26a12814-9c85-4659-84c7-7303156721c9", "comment": "Malware payload", "value": "38b258c567b378058ac5cad63ab59584", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686021229, "uuid": "9aa46455-1dfa-45c3-9244-62e458102bf6", "comment": "Malware payload", "value": "686495bd2f04f2402b3543efd574a707caac0003dd682909db87da286173e771", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686021229, "uuid": "687c4231-eaee-4e00-93c0-76d537834842", "comment": "Malware payload", "value": "4ff45b549c8f26558a23adddb599bf6293926301", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686021229, "uuid": "9576109c-e11f-4c6c-83a2-1522c8555081", "comment": "Malware payload", "value": "3fb3c90f968f6462de5e0b61677d4490ad1042f264a890da8a5b26719eced6a975299d71c4fdcb499749881fcdfec50e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686021229, "uuid": "ae330ca7-3ff1-4689-8378-f1033e9cfda4", "value": "T1C9F5AEF9DF4628DAE249087C061B77DF592648BEA18C3CB96AC85F5532F0DD34226D23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686021229, "uuid": "1ac42dd4-70cf-46e8-8903-625a268bd13f", "value": "6014bca529f51ea59e3dfde00eb5ba7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686021229, "uuid": "823455e8-f608-434c-bdde-6f7f88e993e0", "value": "98304:jgYLkFZCB1bZZ68WY2V0FR0NupgokfAGzeV77+tl:jgYLkFZCB1bZZ68WY2Vz8ppkfhzet+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686021229, "uuid": "bae283f9-9d27-4b29-a381-5a5738cb06e0", "value": 3427904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686021229, "uuid": "6c3ae6b0-d626-44ea-9c22-16bffaa70244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686021229, "uuid": "d9c549be-9d8f-442f-b78e-87b4c8ab7a2b", "value": "38b258c567b378058ac5cad63ab59584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ac4e36-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017733, "uuid": "c8a8b324-7440-4dd6-8605-ad6ca8f4fadc", "comment": "Malware payload (RedLineStealer)", "value": "81129bc3f6d0bf85583cb730fcf44d7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017733, "uuid": "879821cb-73d6-4342-b2eb-0857b232f771", "comment": "Malware payload (RedLineStealer)", "value": "68e0e4ed7e8ba7926250e591b59bd656afee9a1c686e920b1171e95ef5117e49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017733, "uuid": "dc000828-c7cc-4f89-bcd3-dc8bc0e6fb4c", "comment": "Malware payload (RedLineStealer)", "value": "a74888be0cdd868558dab8beacc25f837b5ef5e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017733, "uuid": "022e38b9-31bb-4f55-9f21-7b8806376df1", "comment": "Malware payload (RedLineStealer)", "value": "b7c64d4a5e3e160023daad4fdffb65886a21fa05eda386b6d469795fb98d76849d289a9832430074ec5599ea267b439a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017733, "uuid": "97e5da62-3e10-4c2c-9480-039f75ab5dd8", "value": "T1ACD41247F6E59176D8B51B7468FA07C30A32BC92CA78536B36476C4E0CB2E84667073E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017733, "uuid": "25fd5da8-f380-48f4-9301-d972841564d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017733, "uuid": "78e85fca-4473-4b4c-85bf-66988b67c455", "value": "12288:nMrQTy90kACCn0svHPiLxOU+Un/fRmzH2rkeCC44Y5T8:dTyyHHUxOm/fR6H2r/e4Y5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017733, "uuid": "3341039a-a9cf-4681-9693-061fb174b8ca", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017733, "uuid": "70d04e91-084a-4c42-abe2-b3926509f548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017733, "uuid": "d224004c-1d48-43e0-9344-22fa52a44590", "value": "81129bc3f6d0bf85583cb730fcf44d7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f96b44-045b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686049953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049953, "uuid": "74b8538b-c4a7-432d-9bb0-ef8b35a7b374", "comment": "Malware payload (Mirai)", "value": "4d835336e8e4ca78d1e8b238a6045f93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049953, "uuid": "146ba3b8-a25b-4261-b535-b5fafe7ec25e", "comment": "Malware payload (Mirai)", "value": "68efc71ae531deabdd5a6262730041bc820142f99f400192601c5119e8c38e3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049953, "uuid": "70cff7e7-cc09-487a-9157-19bfc1f24af6", "comment": "Malware payload (Mirai)", "value": "75bcb0cf5f0a019ea79f84247afe4d8b6a64045d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049953, "uuid": "07c3d5eb-b14b-400a-9ad0-464f70056cda", "comment": "Malware payload (Mirai)", "value": "d4acc0258d5abef1a06170ec7056c5866e0a935ef0d201fbcfcaa2dc99a4ea1074952181d7c243f6a00af7923bbaacf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049953, "uuid": "6504c48f-0646-49b8-8b92-183e33397a53", "value": "T1C3A2D01821CDE932D1B0843BE23CC357FADB47B652FE71391E184799E48490AD3BD945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049953, "uuid": "a7dd63a3-94d6-4e84-85cd-6d4d8d6d8c36", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbAP7phymdGUop5hXm:Ypoh/DxCvhdR4IjWVFbSczps3UozJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686049953, "uuid": "9af1f72a-7ce9-4ca9-900c-36c4b283e091", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686049953, "uuid": "837b8566-b6ca-4b46-8152-ddadd4ad666f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049953, "uuid": "e45fbd80-8182-4ab8-86de-b65d0d72862b", "value": "4d835336e8e4ca78d1e8b238a6045f93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32da8d65-044e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686044440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044440, "uuid": "b329b1ea-7981-4ef1-b0af-05199e38d514", "comment": "Malware payload (RedLineStealer)", "value": "596dfb3f151e951718e889586b3cc67d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044440, "uuid": "3ffa4108-e7cf-4b4a-9a54-5bf0e7ccd7fe", "comment": "Malware payload (RedLineStealer)", "value": "68fbbf33dae618dfe50d46532bdefbb0edfbfdeae6c5140d55572b85de0abae6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044440, "uuid": "00a70d84-9e42-4bbf-bd08-8c9c114d2ac1", "comment": "Malware payload (RedLineStealer)", "value": "ecbe984566a1a9f323da6c4211ee1eaa29d98865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044440, "uuid": "4412e43f-cdd0-4b7e-be80-e8c1fcbbd1a4", "comment": "Malware payload (RedLineStealer)", "value": "c722dfe3957dfb9d7316b0b2acfa88275197932846a14c5decbc23baf8841331a3c1ec2dd34fc71cf9f8049af505aba1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044440, "uuid": "7189f78f-0708-430d-b336-26a0ae36822a", "value": "T112D41207EAE84037DEB5677068FA03970B363E814D7893263B41999E1D63A94A93533F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044440, "uuid": "f31ab7be-f3ea-41e7-9055-a88c9803690b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044440, "uuid": "527c8add-36f7-4717-9fc3-e0a83cf79a68", "value": "12288:qMrOy90gDb7Pi6tis29AG8oHfwJ+fmqZuSQ6HXbq+PHnz:4y/b7ihKGnHYJ+uqZVQ6HeUHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686044440, "uuid": "12088896-4ca3-4aa1-9012-d3ddf5038079", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686044440, "uuid": "ed7f24da-a358-45e5-b42c-b23db6a53e3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044440, "uuid": "a6d53330-24b9-4fda-94ae-4dd7b86062d3", "value": "596dfb3f151e951718e889586b3cc67d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa04ceb-04ab-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686084664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084664, "uuid": "54bd671d-8cfa-42f6-837c-af4f44587a2d", "comment": "Malware payload", "value": "66c40e11eb65e96ef7085d49a7b967d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084664, "uuid": "08e87f09-12bd-49ef-922c-5b679f77ebfc", "comment": "Malware payload", "value": "69a9f10ff9da1c7d2502f6b4cc4d0f0a60915cbb19c625f83233e8b80af957a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084664, "uuid": "7e20d626-7385-4b13-b171-122c0a4edf3b", "comment": "Malware payload", "value": "369871b05a988116cc47615f53d0872661e23590", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084664, "uuid": "273efe2c-fbee-4344-8075-e5e61335dcd9", "comment": "Malware payload", "value": "28b10ada468505e760d69809af7739cf4457400c24a0187ab9fdba7469f97cd67ad28ac78e52d09ccc7c8bd6faea62de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084664, "uuid": "207ec714-6a9a-41e4-908a-c4274c5f5ac1", "value": "T10DC4E180DA8448B6DC50077228770C274637BD2A46B89D1FB74CB5276F7B692672F22F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084664, "uuid": "ddcc2266-b4f2-4bd3-a383-cab7e53db7da", "value": "12288:4iq2TDbJgttJTqOEY3+FoPruxPZTHLGOSU6Ox:4iq1NqqSRLGOSCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686084664, "uuid": "039844fc-d1a8-44b1-a7ca-dd12f479bb27", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686084664, "uuid": "aa6eab40-15e0-4a16-a3d7-3e7116a6a25c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084664, "uuid": "c5148021-d12d-4d7f-bb3f-a60606fe7ce7", "value": "Mentavill- 05230345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469ba6c8-03fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686009684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009684, "uuid": "4353b871-ea48-43cc-947e-ca35f57d2922", "comment": "Malware payload (RedLineStealer)", "value": "f7d38ac10c61481915adcd34d988090a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009684, "uuid": "12a4b89a-6cbe-497e-b183-1263605299c4", "comment": "Malware payload (RedLineStealer)", "value": "69ad36688f7185008f3b227eaedac98789a403d0e79b49f236939f2a4a3a90ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009684, "uuid": "38bceae0-d0df-481d-ad5d-0b3591414334", "comment": "Malware payload (RedLineStealer)", "value": "c5e9ce963ada68935eac55a793be39079403bdf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009684, "uuid": "7b739fd8-9da8-4471-afa9-453eedf08e1d", "comment": "Malware payload (RedLineStealer)", "value": "4d404d23267e0347a350e3e71dddc55da2d16b689d1e302ead5e17042943f2d71801dd7bf73a9ca4511d6142835e8d2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009684, "uuid": "85b62226-b6c3-49cc-8a6b-c2e6ae460f5e", "value": "T100D41206AAD84033C8B52B7094F703E32E31BDA14D7892AF27A5AD4F1C722E4957577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009684, "uuid": "8adcd47e-2f8c-47a2-9e61-f9d66114ca99", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009684, "uuid": "18fed438-2a97-4e40-a6b8-597c2fd0570f", "value": "12288:KMryy9086lCYtf5Z2BmqHwOEyQUKpt1W2jgkojRDcu9:Myp6EYYBBwvN0j9Dcu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686009684, "uuid": "bd7b457c-c16b-41ca-a08d-58f9d9a1ed95", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686009684, "uuid": "509aa5d4-ff11-4f4a-a4d8-1e2dda1b16bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009684, "uuid": "720559e9-d638-4935-818f-1a2d8be230da", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe09627e-0450-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686045640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045640, "uuid": "29d93f53-b4a9-49d2-9587-61b394647714", "comment": "Malware payload (RedLineStealer)", "value": "647c1ced324c447f7d396e0861c00516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045640, "uuid": "a2aa9922-020e-4cef-ae23-21866ca9f9d3", "comment": "Malware payload (RedLineStealer)", "value": "69c2f90a492a1ec30b2594140ba68d2af450cd52b16f162ac866b8d585039315", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045640, "uuid": "e8c36a13-ac57-4185-b287-50950086d440", "comment": "Malware payload (RedLineStealer)", "value": "5d86c37e5daa0762ae77cdb32013ad719be54c6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045640, "uuid": "39b00499-53dc-4955-a755-aefe3b3f5cf7", "comment": "Malware payload (RedLineStealer)", "value": "fee33cc687ccf039ed2293d154bb563556e53383de69b8d01faf35040a603f0cabad0b9a78a6511b8de612a1617f74b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045640, "uuid": "2210dc80-0206-42c9-a4da-44b9a5e5ed67", "value": "T1E3D41243ABE84132EDB533B15CFB03D70D31BC921A78526A37459D4A28B25D0B9727BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045640, "uuid": "b56d22f9-b7c7-4aeb-b984-b6cf30b47273", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045640, "uuid": "8e8db98a-72fb-434b-a58a-b4bdba2ff194", "value": "12288:KMrUy90ymdr7aoY9ebxtCDVObYN04dP/OWKxA3sfkwr:qyMrH0DVOsq4dnOH636", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686045640, "uuid": "1c3715cd-3a80-4ab5-9436-c8bf1a08ff0f", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686045640, "uuid": "fdcd31a2-697e-44e9-ad72-2fb9262fc0d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045640, "uuid": "0f633bba-27fc-4b0e-8f70-b6b076f6fbd7", "value": "647c1ced324c447f7d396e0861c00516.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419010bc-04b5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686088703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088703, "uuid": "c40c5897-0a16-4df7-97fc-bc42e95531b7", "comment": "Malware payload", "value": "ffaddeed49c15f20ce2d1ab099c23a5e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088703, "uuid": "17f2a50d-c574-494b-89a7-0fd75ffa55b8", "comment": "Malware payload", "value": "6a7a907c2460899087418be81e1d9983c1066747b202c9adb22d2f3c40381a92", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088703, "uuid": "a8f8f383-3703-40fd-80e5-0272941623f7", "comment": "Malware payload", "value": "76d5f1a5d8af1396778e1bd223b78c5eae39a062", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088703, "uuid": "e0efd3e3-2975-4fe0-96fc-3fcf9b97b20f", "comment": "Malware payload", "value": "f82c7d456c414f51afb5f7175de708c30020be53e1c73c444692a80ae86752cf7832b444ae70be3f35b8dfa333e7baa2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088703, "uuid": "f600eb6e-1a66-4095-a894-abd463e632be", "value": "T1BC7423A013B11B347A9BC8D30CF6ACFE747DA756E18D40638844A6365DDC9C7322EA93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088703, "uuid": "95f2d128-5f7d-4aee-ab77-f6d7b1146c94", "value": "6144:+WsaxzG/t5NeBmgWkkcW7mjaapyusrICKO48t4Hex/pponvZ+66fLmG9Mp:saJG7NeBmjmjryEtO48tmeZppf6yjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686088703, "uuid": "6bf97734-8cef-4073-9c7a-eb21519c5ab0", "value": 337819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686088703, "uuid": "20789b97-1f63-4e28-a62f-6c99066ccf7c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088703, "uuid": "67e542d6-827a-4888-b201-472c869c35db", "value": "printouts of outstanding as of 20230606.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab65ca84-04aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686084156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084156, "uuid": "11681beb-2ffc-47c5-a7fa-65076fcf34ba", "comment": "Malware payload (Mirai)", "value": "12e60d6a660feeb134ab18a36f0646b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084156, "uuid": "9065b3ba-8840-4add-ae34-a88cd4e94fa5", "comment": "Malware payload (Mirai)", "value": "6c0fbad0dc7956fd9b1e2c96077aad81063c55784431875e55fdd759e2e50cca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084156, "uuid": "28daad15-2876-4e5e-a5a2-060c69744c79", "comment": "Malware payload (Mirai)", "value": "46375df1c233036c793139fd580382aecad0b603", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084156, "uuid": "5f49d723-fa7e-4108-bc51-efdfaaa68f8b", "comment": "Malware payload (Mirai)", "value": "e14bf03eaf80d6aba9c8998a7f9f28df16f2c3d545c7a96ac11c834012cdd25557b5c393f542c7caa1de1a83a041d18e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084156, "uuid": "a3015fa0-278f-4f7b-942d-c8a835c8e51b", "value": "T1E9C35C366EB72D27C1D564BB06B30331B1F2138931A8CA1D7EB00E5DFF596A0315766A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084156, "uuid": "6d79ba46-a9d1-466c-8cb3-73349dccb91f", "value": "1536:dHUPmpbGCdPAcu/q47PPeE25JRKzuWJA/B2Mk/7fJlk5xX0e9tUJ1PFj1R4:tUepaLlO5JRV/yfJlUxE11z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686084156, "uuid": "f960dde7-054e-4a67-af07-15bad0fd2eba", "value": 128336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686084156, "uuid": "0d118119-3077-4f32-bcc4-4dce88c49c72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084156, "uuid": "4334ebd2-8690-4e18-ace9-27c62a907d5c", "value": "12e60d6a660feeb134ab18a36f0646b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293ea66f-0447-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686041417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686041417, "uuid": "5cdf054a-4644-4f17-95e2-f7b8e217d6ad", "comment": "Malware payload (Mirai)", "value": "4a73855bba126a77b3f5cec025359c14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686041417, "uuid": "da200a07-ed88-4271-9aca-26001e0ff274", "comment": "Malware payload (Mirai)", "value": "6c5456e69083deb4b11d94ebc3aa7cb008e872731c67d7f393b8948eaabb5934", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686041417, "uuid": "dab6a838-498e-4243-adb3-512a0d3ccaa6", "comment": "Malware payload (Mirai)", "value": "9d7b50f707aa119288165543cdc73fe4b7978337", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686041417, "uuid": "82e06eb5-f955-489b-8430-911956fde63f", "comment": "Malware payload (Mirai)", "value": "7c4dc88d3427ec48fd8c39bd63198378aa07c0c9000e09409720e23c0746c324bc8c1e63f451f501b30adc0c6f073444", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686041417, "uuid": "3580be41-3cc4-431e-8c16-5dbc8b70ba22", "value": "T125C2F1BFB6AA6A6AF61C233DE035C11B03E8F51C539E6B9767404032EA5E41D7531CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686041417, "uuid": "4745ac9f-a300-49ce-b735-34056d1192a9", "value": "384:MB1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZH01BxOx:0MwxdyoEUnDz+Y8tqHWXmU1BvQfC0N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686041417, "uuid": "46b81831-5b59-4783-817a-510cd92bcb39", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686041417, "uuid": "9323d838-e0d7-48f0-aae0-160de8166579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686041417, "uuid": "d24be1f4-d149-4741-9384-10a454e68bed", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a8fe1d-041d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686023431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686023431, "uuid": "03dda59a-d7a7-4b62-8048-f024ff7b9e42", "comment": "Malware payload (RedLineStealer)", "value": "f6d3dc3291c54cda7071ba2b22dcfa16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686023431, "uuid": "b3c9712f-7672-49d4-a5b6-ff5d2d0eff2e", "comment": "Malware payload (RedLineStealer)", "value": "6c78938a8c81634be810f4e7e9cc6db671273bebe1eecf16ed21e9d62be31057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686023431, "uuid": "b9b10bcd-1a71-4d42-b4c8-835a7e4039c4", "comment": "Malware payload (RedLineStealer)", "value": "6d96ce8a3c3d61507ff9331f714960f5d8939cf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686023431, "uuid": "881b4d3d-5464-412c-8d3d-3bdb1776f1f9", "comment": "Malware payload (RedLineStealer)", "value": "2acbb6ed79fca295e821912d944ed78a69cae7cf83a4453a18997d3c00f4f9a0d792c2078f9f1bd07f6e3b49e9ed5040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686023431, "uuid": "a1c2de70-36b2-4eb9-81f9-8cb3258d1003", "value": "T1B81523439AE01835DEE007B019FB13530F397DA58D38C36B2681A9AE1DB1B927476B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686023431, "uuid": "67b6d62f-7950-4dbb-9777-ec5cb32f58f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686023431, "uuid": "de3bfcd1-03aa-4c2f-8b4c-f26cf16e2ee7", "value": "24576:XyUam0UMIm2r9Ii0qYZa0COmK8trw9ZNy:iUaRUVUqgahFZrIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686023431, "uuid": "ac622196-9f12-4403-b363-c3ca89316407", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686023431, "uuid": "492a66ef-82ce-46c7-ab93-8b37decf793b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686023431, "uuid": "c927729a-9275-4c0c-9850-de0f18bcc905", "value": "f6d3dc3291c54cda7071ba2b22dcfa16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141c59a1-045b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686049972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049972, "uuid": "c11810e6-6680-406e-b005-ba2d7cd09040", "comment": "Malware payload (Mirai)", "value": "5c85b770b131794610161ab8f98ec2b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049972, "uuid": "faae1965-bcfd-4103-9849-22c06b2e7d56", "comment": "Malware payload (Mirai)", "value": "6c807e3526efd8e5410f17fac8c6efee8dc3b4e569357767d658bb8a0f4d61ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049972, "uuid": "ef211fcc-7901-48cf-b4dc-b3eb8f8490c5", "comment": "Malware payload (Mirai)", "value": "84455bd48d44060acce67189a8b676a91db920ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049972, "uuid": "2684d95f-0a53-4862-a54e-85e4f46d8487", "comment": "Malware payload (Mirai)", "value": "f002e18a0ccbc4562ebb3a58f64576dc2db7c1520ca835a7c32d6dc10ef94bf07728ab8959a6b148b3eb868ac320c36c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049972, "uuid": "372351a8-9510-4d2b-893d-dd6e5b505347", "value": "T150C2E1882B8929E9C2F9C17943B8076C1DA40FA6F809DC8578F8F7629D8E4753017EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049972, "uuid": "63ede0ed-42cd-47b2-ad02-f1e36f161a56", "value": "768:f2G214DFyosXqgvV9o1ndB08sbJgGlzDpbuR1Jw:f2GdDgosaaO1nd2VJum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686049972, "uuid": "f46123cc-566e-4469-ba10-a5f2202c7097", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686049972, "uuid": "2d84a0e6-d6b2-41cd-8c49-a2255c12413b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049972, "uuid": "fb21fc1d-077e-44a6-b372-15d7063f5646", "value": "5c85b770b131794610161ab8f98ec2b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07146a5a-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017737, "uuid": "c776bd50-e85f-4385-bef7-d9593543d51b", "comment": "Malware payload (RedLineStealer)", "value": "468a11b146618e46cd490852ff898d34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017737, "uuid": "74591619-7be5-4c1e-b77e-602cafeea122", "comment": "Malware payload (RedLineStealer)", "value": "6d1bdf221c71b527cbe1e269e2262ee2d889ccec6896d68fd02bad138f598a2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017737, "uuid": "93871aff-9db4-4b4f-a005-78076b33b7ea", "comment": "Malware payload (RedLineStealer)", "value": "b6b4eafc9434d2cd6092b9f90b8952554d553962", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017737, "uuid": "52598dfb-e7e8-45ef-a310-f4ce14efe1dc", "comment": "Malware payload (RedLineStealer)", "value": "bc2e0a7b79d242d84ed090475f4a95a52a59224c2b944746cb2873e7473b51b1f23b0af6b095940f77e35ac6c125ebc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017737, "uuid": "cbee3cb1-ceab-426c-a2b7-06f5d4999ac3", "value": "T12CD41217F6E84032DDFA577028F603830B327CA66D34469F2A5A995E8DB36C4A835737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017737, "uuid": "84ebdfb0-4c9e-4816-b66c-7c9759a8651c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017737, "uuid": "fbcea624-305d-4b4b-b5e7-c147e710bc16", "value": "12288:MMrqy90MN+uFpUvsRivPrQVN7U5WOl9fuUXVOcp6EmTL:Gyr+kzRgPqNUg6uUXPkEOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017737, "uuid": "88528494-20ab-4076-b1d8-9ffd937b4904", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017737, "uuid": "1f0b99d8-f644-4bff-9056-303e07828c77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017737, "uuid": "2f1284d5-0df0-4eab-803d-38a906272d07", "value": "468a11b146618e46cd490852ff898d34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3863d956-047e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686065065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065065, "uuid": "14899cca-4483-4c2d-81d2-93e50e331cd6", "comment": "Malware payload (AgentTesla)", "value": "cd0418cb3068b6fc3fede1c352753bbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065065, "uuid": "322472a8-073b-4b90-9c89-1c03ad75864f", "comment": "Malware payload (AgentTesla)", "value": "6e8d1dd1574c5285fb19d7576e1384e5673fc2b0eaeff485e4d9cc13ec02007d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065065, "uuid": "59543be3-1dd5-4aca-9f46-2cf45e570f68", "comment": "Malware payload (AgentTesla)", "value": "8bb390b1246c6fee4238dd05a07dfa6bfe963ec7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065065, "uuid": "9ec030f3-338f-42cc-946d-39e80e2ef589", "comment": "Malware payload (AgentTesla)", "value": "cb570530e8addfd14ae1670f5110f307032f6c0525b48a7dc2d687fc3ebaf3c5e2857f6c2ccb23fb18d7d37bfc1d4804", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065065, "uuid": "38507798-3985-4f83-8050-9ad5cec73b17", "value": "T12A022A2567548B3BCAB54732E867D3802635A34D2856DFAFD880812FDFA33414BE22E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065065, "uuid": "aad87ecd-b095-48e2-ba19-e2055771ce83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065065, "uuid": "75567ad5-3155-4dbc-a65b-04a228210183", "value": "192:s8cfULOLVrmlLXdSOpoa6C49Xf5o2btlFcj:slfULOLVrmlLXdSOpoaSrbtly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686065065, "uuid": "e60b165d-b163-4b5f-9dae-fddc25ed9547", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686065065, "uuid": "bdd55ed4-a920-4d7a-9766-a48916f4fd3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065065, "uuid": "056207a2-7a67-407b-b704-94fc44ab1b33", "value": "LPO NO. 1072.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004ecbff-0417-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686020733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686020733, "uuid": "8cfea862-fc9e-474d-b7cc-c247905cd01e", "comment": "Malware payload (RedLineStealer)", "value": "ff5f2b5b9eae651f47830091ee7f7031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686020733, "uuid": "76691d6e-aff6-4822-96f8-7c40582bc37d", "comment": "Malware payload (RedLineStealer)", "value": "6f952be246944d6510a22aa209553e24ffa6f7c093f072a50078d9311710b284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686020733, "uuid": "90547e84-2ed5-4b39-8ec7-4de1959dc5da", "comment": "Malware payload (RedLineStealer)", "value": "4c1dd087257dae462daac52b50b609aefd1e0d70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686020733, "uuid": "7e47d1ea-a9af-4e12-b2df-4f37d5dcf8ce", "comment": "Malware payload (RedLineStealer)", "value": "49e8a501dc4fea2a05d364238fbc0fa8c9ac6db83965579d5440c748a252137cfc5ea6510792e3d82e851f747c0c3c47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686020733, "uuid": "af93bc00-e3b8-4c17-9e16-1d483efff5cf", "value": "T112D41253FAED8132ECB1537048F703930A35BD605D34875F6B4598AE08B3A8969B637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686020733, "uuid": "e9b58bf5-2c6e-4d98-874c-b91e4549cf56", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686020733, "uuid": "bf5be98e-cc42-41f8-b4a6-69c591e6013f", "value": "12288:WMroy90juUfbJk2weWauSlzhGLo1AmYnkg1GqkxF86LzBpF2WSEt5LwW:yyeuU1krauSR15hgMHxFfHBGWSE3wW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686020733, "uuid": "ccde343a-e16d-40a3-a3de-19d8f1f4c799", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686020733, "uuid": "df831e12-4e5e-4e3a-b034-395df8940a16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686020733, "uuid": "4e5196e8-481b-4160-9917-603e98c7695f", "value": "ff5f2b5b9eae651f47830091ee7f7031.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f54c4c1-0487-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686068915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068915, "uuid": "925bfb93-6b62-43a5-864e-c4b2755d0e97", "comment": "Malware payload (Formbook)", "value": "c44087705a82fdd12fd87fa6e69578df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068915, "uuid": "60ed6af4-67b8-4878-820d-c1ef70856a5d", "comment": "Malware payload (Formbook)", "value": "6f95ab99f175c18ddac4b83a164fa7b4caf500c066cd5f486837d39a80f41ac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068915, "uuid": "7d30fb05-05ae-43ce-8432-48a2c01658f8", "comment": "Malware payload (Formbook)", "value": "14288ae3e5d697a000313f033f1a896e078a8a14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068915, "uuid": "6434a8b9-5af7-49c9-af96-c6ef04abb1ee", "comment": "Malware payload (Formbook)", "value": "bfe019b7799cab4184abc4086853e82ebaf2ca041e8fbf7eef73fd7fb31e03ab793c9f8645cbb8d603f0286f7f49be3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686068915, "uuid": "cdce36f9-942f-407c-9326-398b73402e28", "value": "T1C0A22C08ABE8C312E6FF477A65B31180637BB7B77523CB0D19C810E61A53B908655BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686068915, "uuid": "79ab1b15-5e9e-4876-8208-a7f418c4c478", "value": "384:/+AyZSCDI6YDc7DV6qNqx4cPpMeAEiv0Nia212keplnlYVwexsAx+8Efc+sEnHu7:CYDcfV6qNqx4sKslqsAPPiHu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686068915, "uuid": "ab63d757-e3db-4bbd-ba1f-aaaacce52465", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686068915, "uuid": "c05d8a05-74fd-4450-aca5-5bb6ae7d330a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686068915, "uuid": "5c60c127-a42f-4f53-9ded-955f13fe8011", "value": "06062023_648.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e755cf-0463-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686053516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053516, "uuid": "07690865-4c6b-4524-834f-8cf5aa9d8b3b", "comment": "Malware payload (GuLoader)", "value": "d6c003ebeddbbbeeb937ce8128450cb0", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053516, "uuid": "fbaa6e3b-c82b-43e7-870d-59a87c82d6d4", "comment": "Malware payload (GuLoader)", "value": "71a1fa2341915b59789fef3abd610dbbe2f3aba123df1cca2984a8a63034555d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053516, "uuid": "a85b5b6a-d15f-4db2-8064-d17482d6c663", "comment": "Malware payload (GuLoader)", "value": "5425c08a538379d54c18976c6600cfb96b5361d5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053516, "uuid": "3e1aa823-8f30-4d81-9aaa-b7211c3166d7", "comment": "Malware payload (GuLoader)", "value": "56f8620b4f84048aa81f10ed591af9ad72180a4a99e230b6f61b8b26cae9fab3c6ee0d11b3cdbd9defc252622b71d975", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053516, "uuid": "09304a6f-689f-45e3-be96-06d297b92c7e", "value": "T15D842336BDA9DD4AF26117D7CA431B28113B4B779B2374D7459348EBACFE3004CA846A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053516, "uuid": "4d22adc6-da11-4f4b-a3e2-404f8f4a7a31", "value": "6144:CW/P2qYnZN91hTi3o7iQhysxWsfAIohP1zXDY6QjJ1A+WurubhNdFOYnB/:/BEZNbkqysxWWAxP3b0iuYnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686053516, "uuid": "d622409f-e2c2-481f-addd-fa2b9c662515", "value": 378022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686053516, "uuid": "753c101f-f168-4240-8f25-0d898de2aedd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053516, "uuid": "e29a4d9f-a8df-4217-b401-9b1b9672b7bb", "value": "A08000143_ESP_B64891013_ESP_823041009945_20230405.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db99afbc-0454-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686047300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047300, "uuid": "a562bd71-b3b2-4324-a20d-240d036253fe", "comment": "Malware payload (Mirai)", "value": "527b20b53fd19954b1d65b3d061e052c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047300, "uuid": "f9350a1c-da6f-4d43-b2ec-14e98f72d8a3", "comment": "Malware payload (Mirai)", "value": "71f55952e595f304c8d1d7bda569af634bdfcb6e42066de9432543381f66499c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047300, "uuid": "0991cf86-8b92-4a45-9542-86d714e00850", "comment": "Malware payload (Mirai)", "value": "daae45bb1c9f631fc9a682cb8e8363658670e50a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047300, "uuid": "7381e2b1-3b79-46d5-83f0-250ef7a7c154", "comment": "Malware payload (Mirai)", "value": "3993bd44814742a8f07a2358dddf622ff7a61227fc7b4d470a294d7ef91c835bcf27c39e2bea4e0eae228865de78bac9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047300, "uuid": "a7c18076-f6b1-445a-8f24-9f0cac80c43a", "value": "T112535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047300, "uuid": "56860b36-793a-4461-9eb2-59129b34ed70", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E83:N1GjR8EVGO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686047300, "uuid": "86da70a2-bc0c-43b8-b4c6-e23a0a38a5e4", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686047300, "uuid": "27400a00-cfeb-4bf8-a8e7-95f6ecd50bb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047300, "uuid": "a2792418-64ee-477f-91a7-e7db8ea52648", "value": "527b20b53fd19954b1d65b3d061e052c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0df98e-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089960, "uuid": "5af6b2c1-703a-442e-8b4f-405580a12e9c", "comment": "Malware payload (Mirai)", "value": "895729f59538f58ac302d92faf0da79a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089960, "uuid": "eb1fc8cc-a5b9-4b53-bc11-dd03cfd9bf40", "comment": "Malware payload (Mirai)", "value": "72246cf50998be4bfe084ae65a6f0632428670c2640904baefa02ab315da44e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089960, "uuid": "c97b018c-e643-4f4b-9745-cf2be80d34e1", "comment": "Malware payload (Mirai)", "value": "4b85f68145ba9fa4bcaf5c43badabcda0520451e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089960, "uuid": "40a350bc-1aef-4f52-b4b2-b61ab0055b1b", "comment": "Malware payload (Mirai)", "value": "ab27ebd3839516139ee46401a4c757944b4b1e3e2f86c8bb91d56406970dbeae8db8baf8b7106c147c9789f168c6722a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089960, "uuid": "63ac75b2-dd8b-4551-9da4-e61e780c5051", "value": "T1EB230271840F9EF124703C76EA85D793B6F129B1C66730139A280A3C2FB9B131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089960, "uuid": "c775dece-84ca-44a3-b435-71111428d016", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3Wz2U9q3UELbUXfi6nVMQHI4vcGpvH:gECFd+A6YHAxusLRQZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089960, "uuid": "ba141619-61ba-4e0c-86be-91c7d3a22100", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089960, "uuid": "173e05ba-e46a-4a4d-9e5c-937a2935dec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089960, "uuid": "c8626918-7d3d-416f-ab7f-60750b977645", "value": "895729f59538f58ac302d92faf0da79a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8f9163-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036054, "uuid": "ee78028a-7e7f-4b02-8868-f46b9e993d84", "comment": "Malware payload (Mirai)", "value": "e1e1e0f4f6f85bc159a8e10b095f1361", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036054, "uuid": "abd8c63c-98f4-4878-86e3-55074f4882f9", "comment": "Malware payload (Mirai)", "value": "72ffa8c999d9ae82a68afc8fb781bc4d19adfb2a996d9e2b6b65d4f654fed9d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036054, "uuid": "b464874e-e29b-496e-b308-cafb59316229", "comment": "Malware payload (Mirai)", "value": "b2b4b70514c4e92dd49ec46d54eddbb1e1197ed1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036054, "uuid": "42a1d6c4-6386-4a29-9295-f0ab9090bebb", "comment": "Malware payload (Mirai)", "value": "2a0d586b46f3f3769d2db1ab89a124df421884fe370307bffe96b3a7ae7922a10ea4b66c655ccb05da2156c3c88b40c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036054, "uuid": "f9f2e1da-13f3-48c0-995e-a93227183911", "value": "T15CC2D0B82405A970E370013CFB9DCA875BE7D2F082E4311519505AFE9A0B586B9B778F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036054, "uuid": "4bff5ba6-24b5-40fb-8349-4baad45fc44f", "value": "768:4RSa8ZS/L6rze3OXrFKg9KZrqoDuWps3UozYa:eSjFJXZBCJDuW0zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036054, "uuid": "d90c5a6b-8e22-4c0e-8120-cf68c1a6ba7e", "value": 26292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036054, "uuid": "b90b588e-8f0f-43c7-a52d-82643c614a3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036054, "uuid": "5e11ad87-f532-43fa-90ce-d17f4d4874b1", "value": "e1e1e0f4f6f85bc159a8e10b095f1361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de7551c-0442-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686039358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039358, "uuid": "dd6c7ca6-cdd6-427b-a41a-a426877d893b", "comment": "Malware payload", "value": "a5ce45801e46960f6e7e0f76da9a6911", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039358, "uuid": "af204796-0cd7-4494-af40-20a70bf331dd", "comment": "Malware payload", "value": "73133d85eddbea96f9281bf37d91fe0dc40bf9202df3133d74b0bcccde48a2aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039358, "uuid": "b86d3e40-1ffd-4736-a691-bef38578b980", "comment": "Malware payload", "value": "44d90f01098d734c3e5549a0522bb752e686fdd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039358, "uuid": "89d965f3-060b-4d87-9ced-55f6d71c5500", "comment": "Malware payload", "value": "5c095d94c349979e2e21663d35e713711010026ce3c9841669ad567cebb3e10b355956cbc2df362f513442db83b9f1f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039358, "uuid": "18c2505e-9cfb-4f1e-bd2a-ed2996a07977", "value": "T1CA05122D62FA061EC9A73FFD1C2056B5C7FC1989B523D5131FA7AC98CE21B050AD48A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039358, "uuid": "0d6514b4-f737-4792-ad39-742b1903e439", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039358, "uuid": "d8cf450a-e208-490a-a32a-b6c03848abe8", "value": "12288:42iNUewx/NscEQ+vgXK1HsaSj4qfS1t/YxwSWpqQu250Qvj7K1hDZ6Ku+MZfJhdt:41iewlqB6pbj4qf4MVzQo6SqJhUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686039358, "uuid": "c2d2c7f3-8f9a-463a-9f01-bf00c9818138", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686039358, "uuid": "6f295f02-bf32-466a-8aeb-14e1077b3ffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039358, "uuid": "c83385b7-4d66-4978-93d8-b1ead964d7ae", "value": "SKM_C3350191107102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5315307-0439-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686035693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035693, "uuid": "64f0e8b3-3a05-4836-99b4-ab96b876b73c", "comment": "Malware payload (Mirai)", "value": "3b15a95bc3f1cab7066864d14d95ec10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035693, "uuid": "e0b98d18-a481-4b7d-acfc-f17494ef063b", "comment": "Malware payload (Mirai)", "value": "73f7375064f5e78312f6ab73aee8bf582087b2554047d16723fdd9062f297db9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035693, "uuid": "1d780315-d23c-4c2e-bdb3-3e7ba669dfe4", "comment": "Malware payload (Mirai)", "value": "0a8c64dac7da6697c7ba75f5fda8dec9caf8951d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035693, "uuid": "c9f41680-ad58-4f0c-81ba-c401ed8a50e8", "comment": "Malware payload (Mirai)", "value": "3b6a6260e93e70694740f25e723a354960aa96a0fdb22e23910a4f27ebd159ad9e1244b5a990958acf7f4498311472fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035693, "uuid": "5b944e22-9684-4109-b47f-ab2f3ecd10a4", "value": "T13B73CB1A2E259FBCFF9C423447B7DE219A4833A626E1C645D15CEA012E7034E741FBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035693, "uuid": "8d559016-0019-430b-85d2-7e14d6d8ea31", "value": "1536:2Ao2zmbsTaL30vC0vKh53ba/BsNkTRjLzcS4WMV/xIl1dS:2ARmb53IxC3ba/yNEjLzcS4WMVpII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686035693, "uuid": "194c4090-e90c-4980-821b-74e926a2d0ac", "value": 80080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686035693, "uuid": "cec207f7-ce64-4774-9a11-946f2b9b7a95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035693, "uuid": "16576a90-f861-49d7-9fee-c68529f8ff39", "value": "3b15a95bc3f1cab7066864d14d95ec10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b99a87b-0449-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686042441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042441, "uuid": "de55db24-a083-474b-b71e-178027203722", "comment": "Malware payload (Formbook)", "value": "3da71a39a2eb05d6161871c028b7f1c4", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042441, "uuid": "beaedf55-32aa-4dbc-bb23-7fc42eb6f9fa", "comment": "Malware payload (Formbook)", "value": "74e71b53367d521ccd3275eb75e29495f7c9e9b6fb453dc569d2460af1ced8ef", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042441, "uuid": "f9f027c3-9f57-4872-bc09-5eb2f1eddd86", "comment": "Malware payload (Formbook)", "value": "a8da088aee97b892ddd38691f7eced024533fa61", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042441, "uuid": "dcaf5298-edfd-4e82-b74d-0a4d4ab675b7", "comment": "Malware payload (Formbook)", "value": "e869b3970fa106d528fa8853ab4d4ee7230b75e6cf8e7ceaed00289b2325f6ec6f51e01f6eed9dda91efda122410753d", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042441, "uuid": "fe4b771c-8156-42d6-a7a9-8ee79c5879f1", "value": "T1C03423F508CE6625B5D34908732C952D2C8CAC0552F8F8FA28F7A2709FB3B4E9D45676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042441, "uuid": "fbf443fa-bbd8-4a36-b5c6-4cbe9b3ddce5", "value": "6144:0YTrBdml9ROLi/YTZA0/Opm+cTYs1gjFCC1W:0YHbml9n2XOpm31gcCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686042441, "uuid": "dd66b705-4cd7-4b11-a1d9-00741c9fe5d2", "value": 233847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686042441, "uuid": "0c5bbb17-6406-4eaf-a133-642bb9f8efae", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042441, "uuid": "b7e0a48c-dca7-4e7c-b0ac-ad84a46be108", "value": "RFQ-21-QAI-OPS-0067XX7000000061XPDF.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65795aee-04a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686083179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686083179, "uuid": "2ebf64f1-0d4e-460f-bf08-1f5d62fe73e8", "comment": "Malware payload (Mirai)", "value": "4a880e01120a1018f622a2cab3b7fa9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686083179, "uuid": "59957913-9af9-4b52-a58d-f87357ff4ace", "comment": "Malware payload (Mirai)", "value": "7501cd25c3c13b2badd5aa1ca42dfd71052635ecbb01b59417a9e6f59c5dd7bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686083179, "uuid": "913049f0-4597-49d7-b27b-ff49f748776f", "comment": "Malware payload (Mirai)", "value": "36a36f857f862587ad59a9751136a637bef525ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686083179, "uuid": "da5b1f36-41ac-45f8-806e-213a9e591afd", "comment": "Malware payload (Mirai)", "value": "61752c3909014027740519cb338e1e627cdc8167fe6f94719b62f06a0341af6c76c72538ffc718dd5d28e1060fd42d56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686083179, "uuid": "c6ead188-b8ca-49bd-b642-3042521b877a", "value": "T14813E00297CAAB85D4E205750D5DFD61CC50721ED7E886FB0B98232ADCDAF5D2F0B60A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686083179, "uuid": "2156852d-65eb-4d26-b2b4-1549696b876e", "value": "768:tNBDCpEhBooFZcc5l8x6bbgMjBITR+MpJyfQcNvc+GE2As2WxFyNL8hnbcuyD7Uw:tHmpEhBoo/5acgMNMvyflk+obFlnouy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686083179, "uuid": "441d0193-f4a5-4b4c-8acd-a0b0cedadd5c", "value": 43432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686083179, "uuid": "fbbebbba-93d5-4587-bdfe-655275072ac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686083179, "uuid": "5cc2e165-dbec-4094-ac97-42b256044764", "value": "Shinji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9833fa9e-04c5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686095720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686095720, "uuid": "d759d7e2-311a-43a2-a06b-7b3c5ba6468b", "comment": "Malware payload (njrat)", "value": "baa39b6dd7f993583c3c877f33972906", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686095720, "uuid": "d38e43f2-fcb6-477f-8e25-346771ebb8be", "comment": "Malware payload (njrat)", "value": "7527323a12bb2682047a438f8eb0b1ea4049e0733202fe0597e48dc00c1f23a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686095720, "uuid": "700ac940-f09b-4747-bc1a-ce8f12f7ff52", "comment": "Malware payload (njrat)", "value": "39608e3f124aaf0ae73b94ed1b79bfb4959c5370", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686095720, "uuid": "8cdc0ad3-8a77-4af5-b0c5-eebab1abe2cb", "comment": "Malware payload (njrat)", "value": "bda77239811dcfedc02b24d0e7fb864ff91adafd72594a638cc7da23171c68f11f2d5722f714f6fd9430e22198e05af6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686095720, "uuid": "e8a97ef1-467a-4567-beca-9d12fb010234", "value": "T1EE033B4D7FE18168C4FD1A7706B2D0120BBAE14B6D23D90ECEE2649A37736C58B54AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686095720, "uuid": "1ffd7bf3-2995-4810-8330-2854d461ecd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686095720, "uuid": "81531ed8-a81b-49f3-9385-52e277cdb419", "value": "384:4KwCT0i9rdTe/kCOyU7jcnZ8DfmTdrAF+rMRTyN/0L+EcoinblneHQM3epzXKNrY:R1J1CFU7jcC7m5rM+rMRa8NuYWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686095720, "uuid": "3a8a1bdf-4a5d-4fcc-8a16-5d416063fa38", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686095720, "uuid": "a2235f6c-9114-46ab-ace6-0391df53a684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686095720, "uuid": "4648d0ad-b1a8-4835-ab1e-92ec86337796", "value": "baa39b6dd7f993583c3c877f33972906.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdec7f6-046c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686057313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057313, "uuid": "81c5dc44-33c1-4470-a768-d0b2e72e1abf", "comment": "Malware payload (Loki)", "value": "a8daec5a05981e2d8a416ffae08f6e35", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057313, "uuid": "ee121a69-b693-4752-8b4b-80b91a7364e8", "comment": "Malware payload (Loki)", "value": "75a78f2758626fc1ef5e1bda1f20a007e576ab83ecd515e29d9203e8b283c725", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057313, "uuid": "8c63437e-777b-4163-b656-dd90ae47c3f2", "comment": "Malware payload (Loki)", "value": "4b6128d189f76dfa97ca17b34ec993565be6fe10", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057313, "uuid": "157a2c92-3e51-4aa8-9de2-0f1355c8c20f", "comment": "Malware payload (Loki)", "value": "f40e1a398f0b14562d724a3a6db46097f88566cf378da95e39af63889b5be31567acf4421adf9745fc61c296898a6ff5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057313, "uuid": "3d99d252-d2a8-460d-aa3a-c0246d25063c", "value": "T169C4233B294E473F8D33D6531AE4160BE6FD899991E04CE71AEFC5AC48DEE80931119B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057313, "uuid": "52641d4e-f499-4f1c-a082-d0171e7b37c9", "value": "12288:G3B2iSnpd6lw/9qGU5hi2eM8IO9Wc6E52a9CfqdoiYpkElskMINcJwlNS:uB1SnpN9qnh+ToKaS6N/NcGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686057313, "uuid": "933cc27e-bc7d-4c37-bfd4-53417d2484f8", "value": 555584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686057313, "uuid": "540c2182-3f91-45f9-935c-9b45ce3bee05", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057313, "uuid": "e7e5a69d-0917-4db1-875f-ad4262de9c92", "value": "-Certificate of analysis.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8dd215-0473-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686060347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686060347, "uuid": "a885cff3-18fe-477e-ab94-7121d5d98384", "comment": "Malware payload (RedLineStealer)", "value": "148a8363dcdd6b0e56eb564eff8004f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686060347, "uuid": "4406bd6d-604c-450e-8233-446254c54c22", "comment": "Malware payload (RedLineStealer)", "value": "75ac447cee842417c9a06011184e3dc5a2a768ac9a1eeab4d798e200ee9b9fd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686060347, "uuid": "ae8686c0-a16e-4b7a-bcd6-5b93b7865d13", "comment": "Malware payload (RedLineStealer)", "value": "46880e430ed3046fbd4504faa8e92f2559a8d19f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686060347, "uuid": "6cb258c1-be93-4af4-b7c9-17d87fc0d269", "comment": "Malware payload (RedLineStealer)", "value": "a280b3667ad2007bbf0a3c5e8a2953b10f0650b353e23d66ff5e66f14a2e15715ebc0a4494abcb925e57948c01d83fd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686060347, "uuid": "580fa343-ed35-4fb9-9945-4839256f3ece", "value": "T13ED40242ABD99032E9741FB088F607C30F37BC625DB497A61745AD5E0CB3B85A53272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686060347, "uuid": "4eddcb40-3493-4394-b148-cec7594ca376", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686060347, "uuid": "f0801ae8-2cd0-4204-8a13-3dca3bd0de6d", "value": "12288:UMrsy90zU/N1HvSz7rKePoAQypAZfA0YJhwZp+sdAVue:YySU/rSz77PoAQypAZfAjJhke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686060347, "uuid": "ce36b684-9516-40f0-a95b-be2827f95635", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686060347, "uuid": "3fc3fb6c-7ac6-47b5-9b4c-04039ba65361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686060347, "uuid": "3ef3734e-3484-4bbd-844a-a65b55a4c52a", "value": "148a8363dcdd6b0e56eb564eff8004f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d8182c-04b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686089114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089114, "uuid": "22d75f67-209b-4a29-9d5d-200c8932504d", "comment": "Malware payload (njrat)", "value": "b7a78039c28b0651b98e724e467b7ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089114, "uuid": "8f0f95ea-623f-4556-977d-2d7c69d3cdae", "comment": "Malware payload (njrat)", "value": "76a792f785b44066a7b802ef54cb979562357151be7e4eb5624dc929799603ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089114, "uuid": "ecdd5e3a-dcff-43cc-a0d7-f2133ddd663f", "comment": "Malware payload (njrat)", "value": "ec86bf60519e232be075af5f3adc11464e5ac35d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089114, "uuid": "2a0c16d2-d03d-4f1e-87ef-a120de49e35d", "comment": "Malware payload (njrat)", "value": "745603419e6b3f7939d1f7bed5e6af80a5788d314acef111fd6b768dae31a89a99cf53ae42c71b575898a28b512c30ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089114, "uuid": "46dca748-0cb0-4f9f-8ac7-0de4e476788c", "value": "T1E593E94977E52524E0BF56F75471F2014E34B48B1612E39D58F219AA0B33AC48F8AFEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089114, "uuid": "e6261bf0-153d-4757-a7f2-5848520d1a0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089114, "uuid": "7265c295-d929-41c5-a27e-71c155c1f0c8", "value": "1536:nUNJD/HBZbszKu9AZp77r1jEwzGi1dDswDxgS:nUUzK4AZtHCi1dDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089114, "uuid": "0eec9e46-30f9-4216-8585-5c32e0915681", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089114, "uuid": "a79fa6c9-77f2-47bc-9287-e40e243a305e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089114, "uuid": "ce914f89-cf71-4d47-a22d-ebbf7258d9ba", "value": "b7a78039c28b0651b98e724e467b7ae2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ed6510-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686018029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018029, "uuid": "1127e65c-4256-4b0c-a023-2bc5de381e38", "comment": "Malware payload (RedLineStealer)", "value": "e5de9648dab34a9e31c77be8ca728418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018029, "uuid": "83f700cb-3625-4aec-9d28-6f8ab7df1de0", "comment": "Malware payload (RedLineStealer)", "value": "7708921fd4e02474a5e5a2f74d1c7f6108adea125fb049c45f60ae83c67d8bc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018029, "uuid": "7bef0c2c-344a-4230-9773-2fb09cb61642", "comment": "Malware payload (RedLineStealer)", "value": "0ab432876ba9c347ee5c95d6f777a5d6baf82b85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018029, "uuid": "e7eb8952-2676-4781-868a-a395e24927d5", "comment": "Malware payload (RedLineStealer)", "value": "c5d93efeb2a54bf733d9daebfcca097624ab1c0c3a50e064cf097144609772ab6087eda478f61ba81d89656c17ef0a76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018029, "uuid": "7984213c-a3aa-4005-8ff1-30607811294c", "value": "T1D4151265E7D95066CCF117B09CF303CB073ABD7659B883663796699A0C72680B8313BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018029, "uuid": "52824107-e0e9-4e4c-802a-8a1b2a498d91", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018029, "uuid": "ca904d0c-f066-4d8a-b09c-f601b39fedfc", "value": "24576:by5Ha4AyNqsckDc/YMocNevHnwOBwslcFyj:O5FAIqEDWYhYeBwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686018029, "uuid": "6943f269-5376-4a5f-bf8a-869d06252231", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686018029, "uuid": "76bbd259-5b91-402d-ae98-1b6ae48be863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018029, "uuid": "d3565cfb-f85c-45cf-b304-7be8ba27b902", "value": "e5de9648dab34a9e31c77be8ca728418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20af8c4d-046a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686056435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056435, "uuid": "027ff17f-b9a0-452c-babe-3733037ba8a6", "comment": "Malware payload (AgentTesla)", "value": "2d843bf940124944952caa0fbedd0251", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056435, "uuid": "9ee5094b-9b01-4c0d-ad40-2043abb737e3", "comment": "Malware payload (AgentTesla)", "value": "77644c9d032645a91eb6b269e9fe3abd3c5821a7911d5214dd295f2c49e448d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056435, "uuid": "2a140e16-62a6-4646-81a8-99a08c72fd55", "comment": "Malware payload (AgentTesla)", "value": "ec389cbe70ffa5453c333af8b2f1fe820c0c337d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056435, "uuid": "2b5e3c70-dc53-4e7c-a6ae-6e3d20376798", "comment": "Malware payload (AgentTesla)", "value": "9d94fd4e206ac94a309e8b5b1c2eccf7b13c1a678c91f4a9f6fef0a9ecb1a67f4df310576586e60ea8f47fc16cc0b622", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056435, "uuid": "7469af27-f6ec-4aa7-ac87-3db494347def", "value": "T11B64120416C0E8A3DEEB66723D371EE736A1F51770A9679F2715A1483933A82D10FB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056435, "uuid": "ebe461a1-5b6a-42c2-afd4-3ff71a3423cd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056435, "uuid": "b8a4a7d4-c3d7-4a70-b58d-782aa19fb554", "value": "3072:5fY/TU9fE9PEtu13b3eGFx9jQsYJCWnhw0YDdV2dlCQCTTlOyZA9nThCmvsA8KLz:lYa6DrtjkCyhcq8lONTAjmknu9O1OuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686056435, "uuid": "1c7f899e-6641-4318-bd4c-dfc141b28ee6", "value": 316782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686056435, "uuid": "4961396f-8995-48bd-807e-d6ffa676fb0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056435, "uuid": "d3ae6610-471b-4227-8a5e-4c5b2bafe361", "value": "Bank Slip.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73938ea2-0440-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1686038535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038535, "uuid": "5458f192-2e99-499e-89bd-95d7b86dafff", "comment": "Malware payload (Rhadamanthys)", "value": "712c7d854a2c0ae2f4483e766b925775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038535, "uuid": "2d02ec01-1027-476b-829d-f28d6c1d2057", "comment": "Malware payload (Rhadamanthys)", "value": "784e57f9f685cf96c9320c00dd4d4b1df13033318e457e248b90945936896583", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038535, "uuid": "d26c04d6-44d3-4a09-8a7d-b1d8d67b9c90", "comment": "Malware payload (Rhadamanthys)", "value": "a13737b2ff58190721df47c5880f10e1e8150ff0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038535, "uuid": "eab2b190-6ca8-41b7-a7fd-5265cd67f2e8", "comment": "Malware payload (Rhadamanthys)", "value": "e111397544dcb3edcff8b0465a58de673009af1fc923ed7461937efafb9e8b0ad7c29c2fd02a2c41fbc39ddd4ab10145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038535, "uuid": "342f0acd-2d32-4b18-8efe-805adf0fc5d4", "value": "T184A4BE03A2E07C51E9268F729E2EC6F5761DF6908F59B76922189EEF08B00B1D773711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038535, "uuid": "bfa31cd8-a01c-47ef-b766-d92b30e91391", "value": "73f55c9a8ec43dc84ad4d9211db141b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038535, "uuid": "813a1280-a9b3-4d5c-8311-7025eec9f80c", "value": "12288:U5M2c17uohEFUbMAqRscwLcgOrWXdn1vfFY:U5M3hmAOsNLWaXdnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686038535, "uuid": "81093c03-53d1-4b48-857a-68623eb71812", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686038535, "uuid": "178df9d9-61b0-4129-98e7-bd87ea53e60d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038535, "uuid": "293a0cc2-f181-4e70-977a-055b910a7c86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9946b05c-046f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1686058785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058785, "uuid": "bd155032-10c2-41f2-80ec-1fbf4b271cb5", "comment": "Malware payload (STRRAT)", "value": "b102d13f794c0adc6d34168a4cd379da", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058785, "uuid": "3ad60524-57e2-4c20-838b-a4308bf1a9cf", "comment": "Malware payload (STRRAT)", "value": "78c13c7c14ba3068053b7749c2671ba76cce489e3dbd310bc58641adf2e2fbe8", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058785, "uuid": "db6bf61d-3bc9-48b2-9f3e-d73802afa536", "comment": "Malware payload (STRRAT)", "value": "d75a7bd0e7156ff97d05f6df952a616913cab6f0", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058785, "uuid": "44d6e5d7-2f93-4681-a6b8-ab451eeccb9d", "comment": "Malware payload (STRRAT)", "value": "a81edcb9d4acf9bafaec0c5072cbeff30b7fe76cc23be1775d733b766a290fcf07055ea2626382c38e9221fc2f9fe5f8", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058785, "uuid": "89ca81db-8bba-4416-921b-92cad621be80", "value": "T1FC24230427ECBC11ACF6744FB289F7E3F4F331360A2811690738E6684A2699E5D57B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058785, "uuid": "a58b1aa3-714c-4dff-8ddf-07c0a1a97e59", "value": "6144:jaHshetHfuUVjZp1En4t4BAiYc9JImFt9QqUG5QXeB:thet/VVmn4iai59/9L5QOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686058785, "uuid": "5a8bbf90-8bbe-4176-9321-ea174b74a8f7", "value": 225506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686058785, "uuid": "6e973916-dc23-4f7f-86cf-c2d38af76ff7", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058785, "uuid": "8870b1c4-b818-49d0-8b48-198f61aa4a9f", "value": "Doc-PO.161015-AGS_510160523.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652d077b-04b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686087044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087044, "uuid": "c2ae50e3-7f0d-453c-a168-c22e8cfff2c4", "comment": "Malware payload (Mirai)", "value": "0140e7e864d4731a797f442563e91135", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087044, "uuid": "2abcc29f-9125-4ad0-b0eb-8f68cbab2164", "comment": "Malware payload (Mirai)", "value": "792aaf62baf3af4997437acad6ae7e995f34d5ed1d182ce702da3eb1f238d905", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087044, "uuid": "6876466c-c9a0-4a13-9375-29f173f21eef", "comment": "Malware payload (Mirai)", "value": "8e621ef1288effad87a73017f91844261f48fb75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087044, "uuid": "55f485d1-d755-4772-94ff-d8d339781a73", "comment": "Malware payload (Mirai)", "value": "21cca95a07097d918c886cd15efddce396bcfe53d78f1d4983c370c3b7b2f856672b31f5fbe1a3cfc91263dca72977ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087044, "uuid": "d1c2bbd2-79c1-4d7e-9e63-4c474f3ef64f", "value": "T16FC2F99ABC92966BC2D15376B76F474C339277E8D2CF7713D80427103A8AA4F8D22B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087044, "uuid": "bc00c1e5-743b-4d74-aa89-8ac76a22755d", "value": "384:e9v8fuQKpEs1FpQCK48tG5B4glb6j2ATxCcnVuN1YacD5aLASbp3jOoa96fy6it+:e1vHpb1FrcG5B7lbcuYacQNjOoamN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686087044, "uuid": "24959214-b1da-42fb-b30c-0419d93c953d", "value": 26592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686087044, "uuid": "a4bf1ae3-fc1c-41c0-be34-d8ff9f306564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087044, "uuid": "5e24520a-ce70-4046-8152-5182bb3c9633", "value": "0140e7e864d4731a797f442563e91135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e65d34-0411-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686018435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018435, "uuid": "cc68029c-8fa0-4127-85dc-e0b541fad063", "comment": "Malware payload (AveMariaRAT)", "value": "c696e9569d3f38fb8884192d96cf773d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018435, "uuid": "26d978cf-f554-44fb-8f20-369479912e7b", "comment": "Malware payload (AveMariaRAT)", "value": "7a2eaca2ff024e822839d6c62842ccbd541e948dfbc476a8013c947d8a2385f5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018435, "uuid": "e3411de5-4a5d-4b33-8b05-b40c16a8130a", "comment": "Malware payload (AveMariaRAT)", "value": "7c7cc1ee1cf72f9bcff18278c280ff7ac4c6d984", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018435, "uuid": "3be0a629-6b3b-43c4-a3ea-8cfd5f6234cf", "comment": "Malware payload (AveMariaRAT)", "value": "38a31f3bc44863eb68ebc1269796fe44099e7419ab561d43f5af91dfa745f06cb2ee7455a432f5fcb10f299ef63ad4c3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018435, "uuid": "2f97181c-e911-44b4-b10d-189229be42dd", "value": "T16F64F02C32F9C70ACA6B1C3D52B13020923A896A5517FF5E3FF651EB6EC37D21981562", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018435, "uuid": "f365c475-9564-40e5-8759-a76048be8890", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018435, "uuid": "cc7f68a2-03f4-4fb8-9c99-d854248a7a2a", "value": "6144:jle4HgL8qrG+zJSWbR8/JncrlIV51/1LkO4k:xe4AL1rG+dbbR2Jnm81qO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686018435, "uuid": "61d3fa15-7e86-40f7-9d58-a5ba4e7ed404", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686018435, "uuid": "69bc34e5-e16c-47c4-bb24-94cedcd40896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018435, "uuid": "a9360809-9c00-4d05-8bf5-3fb8a35cf4c4", "value": "SecuriteInfo.com.Win32.RATX-gen.32440.15778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1712a275-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017764, "uuid": "6deb813e-9c78-4351-a539-0eaed70c4b85", "comment": "Malware payload (RedLineStealer)", "value": "c056d1b4d381adeea3d7951c9613f379", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017764, "uuid": "2b286256-aafc-4739-a371-468a8864d54f", "comment": "Malware payload (RedLineStealer)", "value": "7b518e46edf16cc66e79a68a6f069ba884de95b3bb8c3b1035368dd49ef5ad58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017764, "uuid": "ab7c0f01-006e-4999-b551-a250478f4542", "comment": "Malware payload (RedLineStealer)", "value": "71a667a23db45e3b9b9592d6af8e0c370b28000c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017764, "uuid": "7c7e2a54-29f6-4517-bb6f-aa1246e50dd3", "comment": "Malware payload (RedLineStealer)", "value": "2dbf8ab983fefdfbb392ef8b794f6a90426d2b22a4a56e88afa41e46d1f6d68e8b1ab746d4f23c9518f8be340dfff86a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017764, "uuid": "155891ca-23f1-457f-89e9-c9ba040892c3", "value": "T11FD41207ABD48072ECB16B7058F706C30B35BC629578C72B375A65A85C339D4A4717BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017764, "uuid": "24b8016d-37a9-4f10-a357-90d9ac65fd84", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017764, "uuid": "33bcd759-ecfc-40ec-9f52-058921f6035e", "value": "12288:fMrWy907Q8udciysU4EOy7T+ixVM1rDsEKYRQ0S0lUzy8qdApk4AC:dyld5U4ERSBrRQlqdApkBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017764, "uuid": "cf0d1a24-0a28-43a4-8731-9a72a2d93bd4", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017764, "uuid": "d88e0bde-8a2a-434c-b13c-91025db7d2b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017764, "uuid": "93a503b8-ef1d-4b90-884e-ac65f275f18f", "value": "c056d1b4d381adeea3d7951c9613f379.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1189270-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686054610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054610, "uuid": "6daf0078-d539-4dea-9329-b369dbcc5780", "comment": "Malware payload (AgentTesla)", "value": "075e9c5ae66175136673af3321c5d22d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054610, "uuid": "2a232a14-4d7f-4c02-8e8b-c54d9a6f340a", "comment": "Malware payload (AgentTesla)", "value": "7b547930689b7739b070dd2afcc55a695b7277b593459091ada6b7550c355ea0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054610, "uuid": "f936ce68-7756-4812-8301-eba2c0bb6572", "comment": "Malware payload (AgentTesla)", "value": "ee65edd760eb6d359b654665d90887a661187923", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054610, "uuid": "7c3c6a3b-4652-4ac6-9cd6-2796932330cc", "comment": "Malware payload (AgentTesla)", "value": "33853a5a74080909a22dd1493e3641d3273252e591a2a9209e8f969735700b370984b702aada35f46e0d241139f18260", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054610, "uuid": "a1a53d20-a699-45a7-93d4-311c83a919a4", "value": "T19ED4238F8918FF257E09AA048DC244DC5BFA5EB568600F798E744E03DFD89171393B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054610, "uuid": "e6bbe24f-7189-422d-a809-475c92681e40", "value": "12288:30At6V5thyN00lw4ihU3KnP2vaaRQARJ3XMv9lK8ZEO3/j6uuhF5i5y:30At6V5tg0t4D4k1+zKm/j6fU5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054610, "uuid": "06778719-d6a1-47ba-99b7-9f5ab97a7761", "value": 629932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054610, "uuid": "da8b08be-7fc3-47a6-bbc0-45381f68702a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054610, "uuid": "0a387a50-535f-4789-a7f3-71c7890ff16e", "value": "Statement of Account.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b239b741-0466-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686054961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054961, "uuid": "ae2c2da1-4236-4f7f-a782-b1ed36a40139", "comment": "Malware payload (SnakeKeylogger)", "value": "0270273d97afd2141c870983d63963e7", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054961, "uuid": "7c800447-bec3-4ca6-bd23-a61a860976d3", "comment": "Malware payload (SnakeKeylogger)", "value": "7b8bef5fe3d6f119bd21643cbb8bb5c96a3c0b98dcfc8858bf9ac7edfb4eb421", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054961, "uuid": "0b12da4d-a243-4c7e-b552-cbf64c8dd967", "comment": "Malware payload (SnakeKeylogger)", "value": "952139963ebb0bc74b5f0e7a5b9d40be49d37b3f", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054961, "uuid": "f5571ab7-5c62-465e-9a34-636eddd421a2", "comment": "Malware payload (SnakeKeylogger)", "value": "c8a8aad87deb23034bd97c8082ec04f7740ec13d0b6c57b129c51ad34c2d7147bb8b16770c116044875346979dffcd68", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054961, "uuid": "aeb52cc5-a971-46d2-8428-fd77395589ae", "value": "T1141533AF2E1E6AF81F38A18A3B4356F208CB480967DDF7DF1D4EA9484A483579358D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054961, "uuid": "2b0a736f-6a02-4757-90f7-64d9f20967f0", "value": "24576:G5Fo0gx3ZdNKkFpU68GDmFFmQytIAaXNWHxb2P:EozxJdLpDYPQImMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054961, "uuid": "c9c6bcef-7772-433f-9960-f05e27366f9a", "value": 959592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054961, "uuid": "8131114a-689f-44ba-9606-5cb615b4ed02", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054961, "uuid": "5926dbc5-9686-40a8-a634-569dc49a77e8", "value": "doc0294852331.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5e9070-0467-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686055243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055243, "uuid": "8c3f5324-cd5a-4c5e-8b9c-e61990af121b", "comment": "Malware payload (RedLineStealer)", "value": "b1c7a9d74dc98fbbf44a6adcc0add334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055243, "uuid": "4fc55f36-ef9d-41a3-ab22-88329d6904e2", "comment": "Malware payload (RedLineStealer)", "value": "7cdf557ac0b26ac8e5dbb41e16d6d6ea7e23d76ca8662aaf808e60e2c45f07c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055243, "uuid": "a88ba3c8-15cb-482e-a4a1-8a0d3a24dfaf", "comment": "Malware payload (RedLineStealer)", "value": "ed1b2232e8dc7fdd62d2abcc50889d8822c0e4e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055243, "uuid": "3cdc0fbd-f135-4399-baca-772044351e4a", "comment": "Malware payload (RedLineStealer)", "value": "326b0042f7b998ebb1a80a679ea57a313c18bf06f79b7425e24f018a0bf1340cd5633778850e5b4adc0915b111664ab1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055243, "uuid": "0459eaa1-ee7f-4ffc-b775-40c9ac62a7f8", "value": "T18BD41203B1F89072E5B52B705CFA02931A36BCA28C74456F2752AD9A5CF3ED0E671327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055243, "uuid": "06bbfe57-e55b-49a5-8f78-32a1c4b9817f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055243, "uuid": "e3d9defc-ba35-4b68-9d3a-44de38c194c1", "value": "12288:fMr8y90tAsU3nol5LbwNhHhO54EirAI1dhKontSgt:ryoTn4HhO54rAaLKISgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686055243, "uuid": "c3fccd5d-8ff4-46b8-b873-e7e71df71e4d", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686055243, "uuid": "72668e98-6f52-4ae9-98fb-953f9eba30c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055243, "uuid": "63237104-fce6-4a4e-bc42-16f521c59282", "value": "b1c7a9d74dc98fbbf44a6adcc0add334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76b737c-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686054541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054541, "uuid": "bfaaaa83-9160-43b8-82c8-7701a62c1ed7", "comment": "Malware payload (AgentTesla)", "value": "97b0dae5d26e8d595381ac1f50f3faf3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054541, "uuid": "1bc0718d-fc4b-4bcc-8f7d-1c94cb52c035", "comment": "Malware payload (AgentTesla)", "value": "7d461dc7c402eb6ebe362ee0441226a5ed971e18ef45d215e1e1ad4df21fc4fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054541, "uuid": "56872d06-c0ed-4d2e-9c3f-42cd9c93ca99", "comment": "Malware payload (AgentTesla)", "value": "4972af94e893b41456857e701f82a1251df81a96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054541, "uuid": "5e3463ea-76cf-49ef-9f9f-c03ccd1fe7c6", "comment": "Malware payload (AgentTesla)", "value": "b32af15f7daf236fb53133a2bf44038dcae71e14176152b9c08f8df64819bddbf11c0db0f5a9611bf26ab35dd2a3408c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054541, "uuid": "95900427-159c-4aac-9831-ccb9d2045d06", "value": "T16ED423B26E7FD47AF81548424513D8E1AAD7884B276133A53324ACADBF7FF09C9D0642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054541, "uuid": "c8e9f985-602b-4ff4-9cf8-ba3657596ddc", "value": "12288:b2ifnfg+MikPJmQ4tLBKpkWaLyxa55HqxEWyuuYUV3HLD4oEnB8bNy:b1fnxoxmZcaLS/jpuYtnB6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054541, "uuid": "0694d7f9-9431-4003-bcb3-2ea0c92a8271", "value": 633489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054541, "uuid": "20b1b625-d94b-476f-8206-3b8514bcdd42", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054541, "uuid": "019c8f44-decf-4ff5-866d-5248c7c19e73", "value": "proforma invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92d17c9-040f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017714, "uuid": "fd178cb8-0acd-4ad3-a00f-ba315c03fd50", "comment": "Malware payload (RedLineStealer)", "value": "18c00e6994de76cf0aab723aaa086ef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017714, "uuid": "fed5564b-dd80-4d11-84bc-043cce335f31", "comment": "Malware payload (RedLineStealer)", "value": "7e8cfca14d8660954e6ca3f3d946f0ccac4907222bce4a71e326a05852873966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017714, "uuid": "46872264-e921-4862-a259-091910986e19", "comment": "Malware payload (RedLineStealer)", "value": "bae5af161cc12e4fc7cf9d270986f2258b1dd0f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017714, "uuid": "0caee3bd-35b8-4458-8ab3-4ce01b56888c", "comment": "Malware payload (RedLineStealer)", "value": "f7e13685d597aaeecd7b3cdfd4f54617f9aa0fb3c99cfa35747871be83de154da1294b9d112688fb78edb04ac09e4026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017714, "uuid": "6855f55b-2a57-4bd7-bd22-9601a6749d20", "value": "T14BD41222BAE48531D8F50B715EF203931A3A7C5268B8436F27527D5B5CB2A85F83173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017714, "uuid": "6324fa01-8088-41d6-8983-2fe9f1bdb4c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017714, "uuid": "205957c0-3d5c-47fc-b62c-c4bfd197539d", "value": "12288:0MrRy90/BoYCftQe2zWQQyqJzsIzEbgR2RBj1kal:ty0BtCf12zgJzOgRKTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017714, "uuid": "ced11f55-0ab4-4549-9b71-adc038afaf53", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017714, "uuid": "459745b2-031a-4404-b646-a244008f741e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017714, "uuid": "c8209225-aefa-419a-bac7-a9d9fe9d0b1d", "value": "18c00e6994de76cf0aab723aaa086ef6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e379c8-046c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686057271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057271, "uuid": "cdadb894-17bb-4291-a7f4-dfe14d4ee5a5", "comment": "Malware payload (Loki)", "value": "50af122af635225e9c237cf0d2cf01c8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057271, "uuid": "5a6ad95b-5fe1-4e4b-9e97-5879168841a1", "comment": "Malware payload (Loki)", "value": "7eb686a51cbb8fd5f9acb2e8d614eda9a504845b402b1d2665d5edc1d6686829", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057271, "uuid": "ec189212-1321-4840-9e9b-7d65d05eb1b4", "comment": "Malware payload (Loki)", "value": "e353148bd5fa9b4c6a13f6fee0638bd5b01d204d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057271, "uuid": "a82157e3-b90d-42e0-8bec-4b77629d929e", "comment": "Malware payload (Loki)", "value": "9fbe52663dc1042d7f6d6e7f7458e9bde0f1e23b29be6312bb1f2a8ef3e43f8985cb6917eb7c18d603ba1d7e8c5f04c9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057271, "uuid": "6d4c25ee-ac71-45e3-9b27-3e7277fa628f", "value": "T1DBC4233B294E473F8D33D6531AE4160BE6FD899991E04CD71AEFC5AC48EEE80931119B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057271, "uuid": "4a200d11-d25e-4eeb-aa4d-d6f4c3328a31", "value": "12288:B3B2iSnpd6lw/9qGU5hi2eM8IO9Wc6E52a9CfqdoiYpkElskMINcJwlN5:dB1SnpN9qnh+ToKaS6N/NcGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686057271, "uuid": "d9bae70a-da54-4141-8a43-11f8a870ec46", "value": 555544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686057271, "uuid": "cfa9819a-4a86-416a-86cd-a3dfc42d2659", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057271, "uuid": "1a79a5d2-6d4c-419e-9fb5-08522b41977c", "value": "-INV.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6edbb54-043b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686036608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036608, "uuid": "3a5957f7-3e83-4599-bff5-329e28a9d97a", "comment": "Malware payload (AgentTesla)", "value": "2f6bc7a256b114e023bb27318108547c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036608, "uuid": "7c7be25e-fa04-4d4c-8211-4c604cedb705", "comment": "Malware payload (AgentTesla)", "value": "7eee32fe187213721e385b8702363319fc2d7b4d34951fb5302bb414e79fca07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036608, "uuid": "9fa8a975-d2f7-4b29-b9c8-c5eda48b1ba4", "comment": "Malware payload (AgentTesla)", "value": "3fc6bd4e718602d937715bd6ac83e03d409db9f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036608, "uuid": "9446826a-8c67-449a-bc92-46ba19271e9b", "comment": "Malware payload (AgentTesla)", "value": "d5651987556f72f12cd721adcfe25b80e7f59c0d821c92e39155d23a91afed264a7acd5455cacd24fd42e95ef919cbf6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036608, "uuid": "aca7ebd7-2296-44a8-8666-678a66091d89", "value": "T136C4230B446C366135F2304D646FF4892CEAEBB9AA1841D1817A375C216EF6D313EEB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036608, "uuid": "bf84af2f-9335-4866-b665-1b21e9d8abc0", "value": "12288:AVVQyVyiWyCB7+fXb3Ozp49S2aS0PprVCgLq/hKkiX9A8qQ:AVVQVihfXaN4E2ahP5k/hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036608, "uuid": "42c166ff-9a6d-46ca-8319-e06e0c88c886", "value": 562531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036608, "uuid": "7d8d6806-7359-405e-bb6b-e8076295f644", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036608, "uuid": "4c0e0874-7d5f-44c3-b593-0a5dd05fbe0c", "value": "provide quotation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4675989-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (BlackGuard)", "timestamp": 1686059287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059287, "uuid": "b1576bf7-bfc4-4660-8f29-a521ec513f67", "comment": "Malware payload (BlackGuard)", "value": "296fd972f13fe3f371d16ff2430a3e81", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059287, "uuid": "a2a0a229-49a0-48c0-8977-7009b33c2c2e", "comment": "Malware payload (BlackGuard)", "value": "7f6453437b84cd7518a1e628565a13f76bf09aa376eab94224fc269e3ef804a5", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059287, "uuid": "b8af8bf4-1ff0-453a-903c-39502af91520", "comment": "Malware payload (BlackGuard)", "value": "056a3fbe0a88a39348e8b99f0cffb3c6e63b5655", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059287, "uuid": "f8597a23-1d26-43b4-9fa3-204fb4b833bb", "comment": "Malware payload (BlackGuard)", "value": "aa9d30534910c83bab1bdbedf629fe8bc2615b59c544c779f92a85bfd465ed3389c0f725331dd0942464496cecd34eb2", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059287, "uuid": "09657570-2bc1-4725-91ab-47d14440f771", "value": "T177063355A98690D4C4FE96394B778BF51B5E4E0374E6C24E33D4BB26C8BC084F9293A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059287, "uuid": "0d18000f-84df-4fe5-a1d1-61653bb93bac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059287, "uuid": "7ef7d52a-576a-4329-838e-a6b3d01feb77", "value": "98304:46UJZSh7kjoRtHOrpMsgD+TPzxpCQcYOi:pwQh7kjoihFTZOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059287, "uuid": "be5449ae-1bd8-4548-9ccd-5764e591696e", "value": 3661312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059287, "uuid": "8c028d81-2b8b-4279-a908-c79a9bb3ec64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059287, "uuid": "4e4dc17a-1839-45ca-8a76-4641cd95a2c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef27dd7-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686059278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059278, "uuid": "1ab7f21a-97e9-4bf6-91a1-8ec1bf2f930c", "comment": "Malware payload (RemcosRAT)", "value": "5a1d6b58b782aeeb8f22eedbea613aef", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059278, "uuid": "91bc2a60-b389-49b5-acc3-fc5d1eb6aec5", "comment": "Malware payload (RemcosRAT)", "value": "80ea9f71426b05efb585d8d8807321a5aa8f652be7cf79e91c518cbda0b424fc", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059278, "uuid": "e975a0c6-fb95-4dc0-9aa6-0a631dcf694b", "comment": "Malware payload (RemcosRAT)", "value": "8d67d82555b2b9bcf1b31c3831831190da46711e", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059278, "uuid": "640c1859-dede-40f7-9422-b30041e7de0f", "comment": "Malware payload (RemcosRAT)", "value": "be0cba44c971baa7c545fb3c88a9dd85f9c126e4b037d6d713a2983d80befa7a7cba6efc3408e631f8d6dea8775f936c", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059278, "uuid": "a3366081-4ab5-4ff9-a0aa-8f41f86bffe4", "value": "T117B4129C326031EFC853E5328DE91C94FAA4707B931B5157E42B229AAD4D89BDF250F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059278, "uuid": "53754014-df71-4406-9986-3037c3b284e5", "value": "12288:E6O1ShV5nKV6kfHRmyoCh+qmwmkD9am8nJ3FM6:/qxZoCh53kPrM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059278, "uuid": "f14f15dc-736f-4f9d-9d0f-19c817020eac", "value": 502272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059278, "uuid": "5aa34ab7-5ed3-4b24-af2f-161279b10660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059278, "uuid": "3cc6137b-993b-4a9f-a0dd-cbd462a81df2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da15a02-03fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686009722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009722, "uuid": "72bfe2a5-1a8e-46e3-92db-752b30d0360d", "comment": "Malware payload (Smoke Loader)", "value": "feca764388b918fd197e32901dd75978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009722, "uuid": "900ed9a8-edd4-4cd0-9269-ff8208efb5e4", "comment": "Malware payload (Smoke Loader)", "value": "82352822b6d4cefe12283804e809b31f04538dd422d39ab3a41397c231e80032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009722, "uuid": "d5c73a66-46e9-4a09-8bf4-85f11002c5f7", "comment": "Malware payload (Smoke Loader)", "value": "3861d7dd2c6816175bf1ce4f2b8591ba512f8e60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009722, "uuid": "0a9494e7-6fb0-49ba-8acb-641790309424", "comment": "Malware payload (Smoke Loader)", "value": "4b18407f42b0fa520b5c4f6728663548cbc02e34d6be7bec856535ec1f430afd4d69860eca4395cdac30b7b0bf91df10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009722, "uuid": "6202d65f-c146-4864-ac9a-1eb5f1b6cd7f", "value": "T14A548E13A2E1A8F2E52746718E1AC2F476EFB4617F2567DB23285E2F05711E2C67E301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009722, "uuid": "00aff226-cd37-4386-a518-9ce53333fc76", "value": "03b474336f7777602be2676c530abdad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009722, "uuid": "6c51b55f-d138-4ae1-9272-70220dac467b", "value": "3072:CvRQLJbuYAzwxbJw9GC0XKVl+ebbdP4XozFvtoIeM9tBqzC7N4n:oQlbuwxbJw9GC+Cbt4XoZvvp9qW7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686009722, "uuid": "00786742-c8d9-4be5-b2a8-81b8e1d19de7", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686009722, "uuid": "420c2b7e-d05e-4f3b-a6ae-f6c6d1d4844b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009722, "uuid": "bf3266fb-bca1-4936-9421-4c4099105811", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5475ef4-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036042, "uuid": "24bc10d4-b871-4cd7-936b-f9c3398e5237", "comment": "Malware payload (Mirai)", "value": "017174214910ead9496b1d7b65e6f2f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036042, "uuid": "eb193314-f094-472d-90b3-0f3d39684323", "comment": "Malware payload (Mirai)", "value": "82afde31c41e3718c2b889e0d8646a16574808ad8ef13ca0bef081efda2ac146", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036042, "uuid": "4569d59e-0b44-4b7e-a01e-2b20e954485e", "comment": "Malware payload (Mirai)", "value": "4a5beb8c1bc8604338ddbe854ec06481946f48e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036042, "uuid": "c7cdf24a-e41f-4638-a080-4507ba62a372", "comment": "Malware payload (Mirai)", "value": "f1721e39a2388df6784f420529e045b4da1aa8b2203f61cbb8dca2ad061c19450fc99866d961340be0d1f53a5af1a9b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036042, "uuid": "ee8e8d11-cb04-4cf9-938e-23c4f64ec7b3", "value": "T169931B01F9418B27C2D327B6F7DF47593B316A9497D733066A357EB02BC27891E2A620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036042, "uuid": "2a1bb512-0e6b-4c46-9a35-86a3ef0e1e88", "value": "1536:LBnRYwXeHXiuNLOd437liTEOvAdXQHPnxyZC9sYhm2OrQA8WsHXbie:2iud3MzAdX4yZ2sMm2OrQA8THXbie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036042, "uuid": "015b5ca6-a681-4d49-b6e5-7663c79f1c2c", "value": 91175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036042, "uuid": "75ced1f3-4b5b-4163-8fd5-43b0c430afba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036042, "uuid": "c360d9ad-20ff-45bc-8758-e68ef15bda40", "value": "017174214910ead9496b1d7b65e6f2f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d087196-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089930, "uuid": "c56e279b-239b-4f3d-b6db-49a5706916dc", "comment": "Malware payload (Mirai)", "value": "8b24707629e55256ff20ee3cf959fb3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089930, "uuid": "79e82782-167b-41d8-b9a1-61da8d2adb3d", "comment": "Malware payload (Mirai)", "value": "83a612b5324a71f1ec121a27eb9cdb33400a35b37c0f588bb38fb240d3d80e8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089930, "uuid": "7dc2cfc2-cfdc-440a-9aa8-295db2cde3d3", "comment": "Malware payload (Mirai)", "value": "5ba035bb023eb8edf49e21e94f402ec4b3eab3fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089930, "uuid": "a7454800-4e4e-4816-a293-9f9dd70ab747", "comment": "Malware payload (Mirai)", "value": "252db2df34cbd579eddbb9d7c97a307937f7ec6ee69f64c90949fe767c3447e16d9afcd48e158ee849100a19ee2e90e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089930, "uuid": "da163178-bf5e-44f0-b583-2df0ad72b30a", "value": "T109C2F1685228D472F0749536FDAF01036B36CEF8D6EF322662148734E097D229AB5B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089930, "uuid": "74967875-67fb-4ba9-8d66-460178820761", "value": "384:KBH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plNdrhymdGUw:byNUQUfhQllxlaH0MFjlOnGsvs3Uozz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089930, "uuid": "7b9da284-78a2-4709-a856-1695b95475c0", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089930, "uuid": "d042788a-32ca-422d-84e5-8e85f081331b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089930, "uuid": "843ca690-64c8-4562-8034-c9e7f9b754a5", "value": "8b24707629e55256ff20ee3cf959fb3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d423f83-04b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686087004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087004, "uuid": "b7051478-3b29-4697-a9ad-f772a4126092", "comment": "Malware payload (Mirai)", "value": "38b2d32210dbbd3d519422d52ef0db02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087004, "uuid": "907db8e9-958c-4bb1-bc3b-12e378f56dfc", "comment": "Malware payload (Mirai)", "value": "83d55d652bf7713721e02bdd88334a399d890161c887843ca071d7c1ca63ca19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087004, "uuid": "d4269a2a-820b-40da-8cc0-6b873c910a8f", "comment": "Malware payload (Mirai)", "value": "316dad2b75a0baa623917964b3f4a0822e521b58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087004, "uuid": "98d7479d-1a72-4952-95ab-1e3fd62fdd7f", "comment": "Malware payload (Mirai)", "value": "cb1ebba16bb6ba950df5002a31fd6bfa560c24a7548767a32ee546d53faa248f84b232aee43fa65c29343113f1533a43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087004, "uuid": "0db98569-4506-4d18-b330-57145339938d", "value": "T11EB3BE61E0A1ACE1C260023420F19A395773F848E71B1FF76984C7AEA447DECB15B3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087004, "uuid": "3c829e59-058c-4935-8f31-a9bf7374ce7a", "value": "3072:ZV4UT/qdkuCBLODzmVjzPXzHRO1KhRy/idh:/4UeWfQzmpP4ssiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686087004, "uuid": "3ebdcf44-9073-4c98-a5f3-f76a65eb5ac0", "value": 116308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686087004, "uuid": "7020f6e4-25f0-4708-8146-55216ed35407", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087004, "uuid": "7d853b93-e757-44a8-8c22-8409986c9288", "value": "38b2d32210dbbd3d519422d52ef0db02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8895eb-0475-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686061339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061339, "uuid": "95e1f723-34c7-4a54-9905-87815bb6ff0d", "comment": "Malware payload", "value": "bbe426a74b22b3df49d9dcc76c93ab72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061339, "uuid": "d108b5c7-63f4-4e7f-9447-40cac38d2eb8", "comment": "Malware payload", "value": "85286559057867ef0886a4248f41fcb520f093bc862b97aa6ecc559f05ff7a61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061339, "uuid": "dfde9a09-36f7-481a-ab62-d93deb605798", "comment": "Malware payload", "value": "5b882eb091166371367ba62c9ecefa2c4ddc4f43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061339, "uuid": "dbe4f5ee-6a42-4518-b10c-f85e77a2ab1d", "comment": "Malware payload", "value": "3996ec56b5c90a82adfc9ebecc98ae40fa2d4cb7fd0ba79a3f5bc46b246283750a79130449a898f729feb16d64ede290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061339, "uuid": "44b240fd-ff37-4127-9a01-7cbe861ff6e7", "value": "T16A53A427F658506DF189CAB929669756A8263C301914ED0BF7867F6C3AB02C3F4F430B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061339, "uuid": "eb6e5ead-7991-4476-9f9d-62760fb856eb", "value": "680f0fb7bfe3c7fead8a97c1e6b22370", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061339, "uuid": "6e625960-e456-41f9-bc78-7c10f2740c77", "value": "768:/FhrxrstmcQ3UKDeiLHvmNzld0g/Qr+pvISWa6M8Q8iBDiOV2shOaJuYnRZM:/DxHcQ3nuNzv0+pvbRiOgMOakY/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686061339, "uuid": "967a9a51-4bc2-46ff-b2ee-c0b495df1cb5", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686061339, "uuid": "f3176df4-6f17-4ada-ba38-95887ce593d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061339, "uuid": "291bfdf7-99d5-46cf-9df2-1895a9b53b85", "value": "ornot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e75b68-0454-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686047042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047042, "uuid": "042b7947-d34f-488f-afde-8b9af0b06b41", "comment": "Malware payload (Mirai)", "value": "aa7b6720a230f206e9bc3b72e2d1d99f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047042, "uuid": "d1322aaa-c228-42c1-b971-0d4d9240527c", "comment": "Malware payload (Mirai)", "value": "8561c566c87d962f397d69f77deb5b90b9cb1545d6a80ba3ba77d731067d74c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047042, "uuid": "c11dab8c-ba13-4440-bf90-1cf9dce63abe", "comment": "Malware payload (Mirai)", "value": "4ac4cd20ce01806eefa6dad94120886a129f37e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047042, "uuid": "8e11adf1-1c7a-4425-95d9-3e9ef6f859c6", "comment": "Malware payload (Mirai)", "value": "9ce4a561388ef49ad84fe55a93f5e5c4a88db0630c241cb17ea6b91860ec36ce5e46a07381aa460f305a0469c349032d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047042, "uuid": "1b5e7c8f-f65a-4c58-8bac-6682c90b7d29", "value": "T110B2E1D5D6FB27D3C2A1C336D0BC5A4DE2721AC00346451A110A768E96AB64E8BFB3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047042, "uuid": "3614edb6-e5a9-42a3-8eba-1860709c3113", "value": "384:M8DKKQOcRpmYLdn6RBOFRFt5rUFW10iSelCo3AnupPFNqnrrd1NEZgO8UXWozPLy:R/QOC0Yhn6ROHWFGrcwNVFCnNBxcFc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686047042, "uuid": "2ee16ff8-a8d0-46b8-b510-7fbe412793b1", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686047042, "uuid": "6f218aa4-64eb-4a17-a20d-2d192944a884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047042, "uuid": "dcaf5c00-1987-486e-aa0c-70fb55395a69", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf394e5-0467-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686055379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055379, "uuid": "df47eb67-89dd-4435-bd1f-f6059c32e73d", "comment": "Malware payload (AgentTesla)", "value": "f56d90b9692044d9194055fe050a1a94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055379, "uuid": "bb31aff4-c289-44ae-a8ed-2ffcd652511e", "comment": "Malware payload (AgentTesla)", "value": "862dc09dfa8c33482ea3b10e6abf1c189cf54bfc7c4180a6fe474ef69e529d7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055379, "uuid": "5f24c862-9245-4587-b880-8b88f9a63782", "comment": "Malware payload (AgentTesla)", "value": "38230e16bd4406af4fbac9eb8dcf301fc4582c2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055379, "uuid": "9ec8d6ff-33c5-4827-93f3-50b68237f9ec", "comment": "Malware payload (AgentTesla)", "value": "c9032462928deef0910023d6a68ecb38ff497a37361e98e8b1dd0a9bc6a0c4099fcbfe12f1083ac30b96435e3d902569", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055379, "uuid": "16d65cc9-4d19-43dd-bac3-19a184a4e92a", "value": "T1EFD423B6A769A09C2E6154BF9349E32778DDDCC610A1B67E07B51FD085E0CD283D98F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055379, "uuid": "eab4bc6a-8a1c-4d40-bcfe-48459df783a3", "value": "12288:uM2iWJUPxfb9HzMJ5G1AFwnVnUiH973xXMvWsFRtyJdWb:z1zZfb9T82hf7h8vWUPyXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686055379, "uuid": "2712b3ed-017f-4462-888d-4a4aadf55d26", "value": 630052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686055379, "uuid": "635f3726-e403-45b1-abc2-0022e3c8a018", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055379, "uuid": "5b0ee759-39dd-4169-ae09-97ef802d7eeb", "value": "PAYMENT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345ed7a5-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089969, "uuid": "00babfcc-3bac-4e9c-82a8-fb47d739f6c3", "comment": "Malware payload (Mirai)", "value": "3f32dc1ec32db4e0384afbc804df022c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089969, "uuid": "d410d3b5-50f0-4696-b409-e529000b0913", "comment": "Malware payload (Mirai)", "value": "8630955c1b76a1cbeda52b69c669bf5637e43bd18672cb3f857e4d06b5247cad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089969, "uuid": "7d2b7433-fb3a-486d-b272-a6777082769f", "comment": "Malware payload (Mirai)", "value": "882f0c96024bd64a396d8aa3dddd201dae91e031", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089969, "uuid": "cbda912a-2be8-430a-80f7-ef465671f868", "comment": "Malware payload (Mirai)", "value": "6ea269addca277ab87536514359707f8db7a2aa37c1d00f5db89045ce49cf3839c63da615d09c06e8382d6b54c7afd20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089969, "uuid": "76a33cbf-3424-41b7-b5b3-9257a32489ac", "value": "T1AA53F791B8C19A27C6E423BBFA2E40CD332563A8D2DF7217DD226F11778681F0E67651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089969, "uuid": "404a1a0c-a62f-4a4a-8aa1-d26cbdb8ab3d", "value": "1536:/j6s8Hej9NCLoCr1VzxxRU/2jycIJNt51WBNaU:/j6snC9xRQ29ub1WBNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089969, "uuid": "c01d422a-1487-43e5-a120-b3d23194a412", "value": 62564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089969, "uuid": "8c852a49-75cd-4393-b316-5e31be983e25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089969, "uuid": "50f29484-b15b-46a2-bc4b-be35de11ff9d", "value": "3f32dc1ec32db4e0384afbc804df022c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9043bc-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686054546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054546, "uuid": "77e50fd2-25eb-4182-ab9a-f99466f8483b", "comment": "Malware payload (Mirai)", "value": "9733604a4627e12f692fd618593ca1b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054546, "uuid": "03250436-2e40-4012-853a-6d4864f6d496", "comment": "Malware payload (Mirai)", "value": "86c0e80cc9afbd7cd81a1216de2f149c049a9a8bbce22a1d63335502fa6e87ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054546, "uuid": "44259e78-1add-4f2e-9b45-fd4c0c5f1ad7", "comment": "Malware payload (Mirai)", "value": "bb9bcb4e8b16e5878e5224b3893b35b6dd268ebf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054546, "uuid": "66cf3554-b85f-4cb8-a6e2-540368347c53", "comment": "Malware payload (Mirai)", "value": "3cec07f4ce34365f20f2795378e90bb0320b84fd7998b22e459dd90c7cbb3f2e581b9a3057cca887f782329f72b34b46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054546, "uuid": "085376c4-f117-47ef-b150-c56e132684ae", "value": "T1CC130982B8815A27C6D4533BF56E419D372527E8E1DF32138E122F217786A1B0EEBF51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054546, "uuid": "896ec13f-f4d7-4932-a71c-28b94326209f", "value": "768:Q/2nsM/dSOhKZqoxviKf3TWJ+zPKy/9UYQxRm7:agsM/d4q63T9Ky/2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054546, "uuid": "7ec3d2e5-0c73-4f91-97bf-9f2ef5cd6abb", "value": 42556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054546, "uuid": "4ea9150b-5c1e-4866-b3f0-9842181494d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054546, "uuid": "d949b496-72fd-4d93-a672-525b87ca25ed", "value": "SecuriteInfo.com.Linux.Mirai.1232.15154.22065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c1b6b5-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686089923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089923, "uuid": "9e691201-c3e8-4ef4-9245-966a5a6f93d0", "comment": "Malware payload", "value": "394aa301e12487e91921cad13fa529e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089923, "uuid": "e9cc9642-89c7-47a1-b0ea-0ff074300a77", "comment": "Malware payload", "value": "86c70374e90ea8970f14433ac5ed628f217fa3b8e43aa4089ddf26a968c21f99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089923, "uuid": "7567c4e5-3617-4c9c-a2ea-0c0d3a746f76", "comment": "Malware payload", "value": "4b0ee798db08d29bd2d6b1aee31a6979c7acb85c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089923, "uuid": "222095a1-1290-4b17-8a9e-3fc931a6537f", "comment": "Malware payload", "value": "f17042bd45a52bc1bcf2c51af7490805484fb37f432064dce4d7e46624aa443d696f2de51ba81935c33645e41314b113", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089923, "uuid": "b9291050-3131-4d13-81e5-35eb1ae13ebb", "value": "T11373B61E2E25CFBCFB5C863587F78E219658339626E1C145E19CEA051EA034E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089923, "uuid": "79b36aa4-82b5-4045-877c-de37a8c9cd53", "value": "1536:eoa94XLaTNiTJavHdIXJJnNBjgCzHhJEORY0Vkyva:mSXLuNiT0vHdIXJVgk8ORYS7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089923, "uuid": "8f79d5cd-6188-4ba3-8073-e2990d18e660", "value": 80136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089923, "uuid": "fa1652ec-bfff-45b0-8431-8c3eb518f909", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089923, "uuid": "e65e7169-eb1d-49ad-8966-baa4d1e7b5b3", "value": "394aa301e12487e91921cad13fa529e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c25425-0439-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686035697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035697, "uuid": "064dc328-b6c7-42c2-8ffb-3074e171e7f2", "comment": "Malware payload (Mirai)", "value": "e2dc64e99da33f15d163389135c52c35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035697, "uuid": "d718e0af-23fe-4b88-bec5-85d0c6f4e78a", "comment": "Malware payload (Mirai)", "value": "86f025085f91cc42eae13373974299b2e592830fe4343f8a68085389c6da57b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035697, "uuid": "0ab1d3ec-d600-4d1f-9f9d-fc937f9b8551", "comment": "Malware payload (Mirai)", "value": "3563d56b096fc53b08df6d1c89cdbd217a70fe7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035697, "uuid": "96fcaa60-bad8-4144-b6e7-28940b182e49", "comment": "Malware payload (Mirai)", "value": "f70af8ad2ec51fdd4fd3250dcba0f8dccc9876e4ea99f959a23551316af5a387632898874a6254e8134cb4e589db16f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035697, "uuid": "457f742c-0860-4816-8478-178d760e1947", "value": "T19ED2E174929638F2C1B00135FA9883DA064B2EB4D1FF7267762024657EF71CA3FA15E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035697, "uuid": "635a7f42-5c91-4127-9bc5-02b5188e1a66", "value": "768:BA4uBc0T/nVvqV072G+IFYoXHZCx3G7gKcs3UozX:BPuB7/nVMYn+Kf5VgKZzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686035697, "uuid": "d228d861-5e4f-491d-9c92-7d33bea2b413", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686035697, "uuid": "218b8599-80f6-4db3-a024-68329b1f0b0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035697, "uuid": "90845801-f2e3-46d2-b02b-7dc90082bfd4", "value": "e2dc64e99da33f15d163389135c52c35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e7cb0f-045e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686051642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051642, "uuid": "baa5bcb1-4408-4e90-b87a-06f8e678a3c2", "comment": "Malware payload (RedLineStealer)", "value": "6a308c6f82fc5c673bcee4145c700169", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051642, "uuid": "2c72d6f8-2c60-4654-bad1-fc328f14c4ee", "comment": "Malware payload (RedLineStealer)", "value": "86f75885e2bfc28b558637f9522cb718c2f51d2af808c0c78b94f1afbf7fa8fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051642, "uuid": "5deabb00-e2ff-477b-b2a6-2c30b2b9ee98", "comment": "Malware payload (RedLineStealer)", "value": "35ebce8dbc2505f6c05ff003bcd4a0ff4ba29131", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051642, "uuid": "96274d71-0481-4aba-b9f7-8290bff96082", "comment": "Malware payload (RedLineStealer)", "value": "a96ba3b2d1579297dd3100733d2ddc04ed3ea3a2b485539b0b64a781479d51076bc22971ce8312ac1cc13bc025f90ec9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051642, "uuid": "a9cf1a65-8ef3-436c-9ad5-24e7aed882f8", "value": "T1AFD41257E6E84032ED7217B058F603830A317E729D38C7AB339599560DB7AE4B93077A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051642, "uuid": "34dd6d87-471d-40fd-a9a4-d69833f9d665", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051642, "uuid": "b7717a9f-242b-455f-b3e1-e3336518d680", "value": "12288:hMr6y90NhP3oRfMJZ/0Ja56UvUkrUSUarARX1uKC6aCE:zyooEJZ/0JXzgrm8GE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686051642, "uuid": "c267e178-05ae-49ea-8ef6-9708974bce9b", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686051642, "uuid": "be384851-17a3-4ea9-86ea-95c00373f35f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051642, "uuid": "26cf8cd0-37ea-4ecc-b643-ef2e158b5099", "value": "6a308c6f82fc5c673bcee4145c700169.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119aefb1-045b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686049967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049967, "uuid": "1d24d936-c11f-4931-9aa0-ba39c98eaf6a", "comment": "Malware payload (Mirai)", "value": "295ff2bc0e7d145a8641cac4d39639a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049967, "uuid": "b98de473-cad1-4090-9415-78dcfabcdfba", "comment": "Malware payload (Mirai)", "value": "876b2e33a11b8a2f16d89079344527217b5dc46d36067ca83d275576b4445681", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049967, "uuid": "e453401e-2345-4d61-a235-fd0cdd161e34", "comment": "Malware payload (Mirai)", "value": "b9aae7dec2f424dd738cdc37e25e1b7c5d7758db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049967, "uuid": "2becb31d-4ae6-4a3b-9431-c07d20f6e9d5", "comment": "Malware payload (Mirai)", "value": "4dd111869311a05390dc8bb494cc8f5c35fae53d091e8ef6239626d8dd1c8355dabd313526b47ce3d1aeebab16f49d6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049967, "uuid": "f667a013-aa82-4ae6-b63c-b3fa168fd005", "value": "T1B4C2D0DFB48679C5CC1C5CBC219D66E116A962C2234B9F0837602DCCAA7655FF89C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049967, "uuid": "6a9fcc10-e4ba-4fd5-bb30-89e17ede2f89", "value": "768:w9CUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBWWz:GCrJgHiOJrfwmQrctn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686049967, "uuid": "ae3b2833-b57a-4edc-991a-9a374216f727", "value": 27236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686049967, "uuid": "42a4733c-1190-4bef-bdbe-1087b3b20a00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049967, "uuid": "42b8ca0a-20d6-4f55-abb3-d7f0671f4938", "value": "295ff2bc0e7d145a8641cac4d39639a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb3db9d-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036079, "uuid": "f342c243-17a2-4ba6-9532-4feff0e10339", "comment": "Malware payload (Mirai)", "value": "769816b9156cffcd605c8e0ec18d498b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036079, "uuid": "446285fe-fc21-4c46-b768-df488d4b34bb", "comment": "Malware payload (Mirai)", "value": "883018d822c8cb6df0e4d108166a3cef5bd543a590d0f75dec97099ccb2578d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036079, "uuid": "83b0d781-4822-4422-a8fb-22380b3e863d", "comment": "Malware payload (Mirai)", "value": "37c730005ab581f3cb4e26597b635b4108edbf16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036079, "uuid": "421a206c-9f85-42d1-9433-27b141559692", "comment": "Malware payload (Mirai)", "value": "dbe74a2e91ee6628ff7804d921b4fbc293412578c2d87b58b674453b5735251d9103f5923d16b557961d12c4c40fb421", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036079, "uuid": "2c351e34-aa1f-42d1-b84a-2407af31aa46", "value": "T18883B509BF641FF7ECAFCC370AA92B05248D651A21A97B367D34D418F64B31E19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036079, "uuid": "ab568c35-22a3-4520-b049-f62d4a0849b6", "value": "1536:/Ou3TUx4JzrKch57ev1a/vZQLJzQl1dj:/Ou3A8nKM/v3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036079, "uuid": "6a7b32d8-0c4c-4a17-ad35-16fe78991c33", "value": 81328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036079, "uuid": "9d63a373-c41f-4c08-8153-ae911737d2bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036079, "uuid": "97921349-e827-41ac-97f0-500d0fcfbd56", "value": "769816b9156cffcd605c8e0ec18d498b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271c0fd2-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1686059023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059023, "uuid": "77eaac74-a006-488d-aa87-33cbb847348e", "comment": "Malware payload (STRRAT)", "value": "856dbd09409da8b58b98d75bb8b6c7c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059023, "uuid": "ec9ddc94-ab0c-4006-90bf-c32f422e4477", "comment": "Malware payload (STRRAT)", "value": "8873e65ad529e832113ee75d5bc8e3a18d150ed475c09e0c6f5ce1458f0bf9a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059023, "uuid": "acf9c5c1-312c-485e-ac10-d67cfaf6ebdc", "comment": "Malware payload (STRRAT)", "value": "04ac238a5349afe2f3f0a2dffad9cf615130b674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059023, "uuid": "c3d6bb05-ebb0-4564-b27b-8a89e621aae4", "comment": "Malware payload (STRRAT)", "value": "569bb455ddb98b70ec7e3ae23f690be69598df71d2bbf6fcaa4f47795949f586c78f51fb82d64f518d892ad1fa7979f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059023, "uuid": "9a6846de-614d-4f3f-9aed-64776a185b17", "value": "T190747D6A49AC1225DF74620DD89717BFE0B4962EF1B7C04F7BE91BDEAE2150D180B20D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059023, "uuid": "9f507816-d383-46be-9a4a-f574bfd32a6f", "value": "6144:1piSQi4W9Bmmdk2DT0uYdIHIBIbmSmSBJB6fmpXAhtagxMI2b+ORpNqE3KqT:1fHX/mKaSvoGX4tagutDo8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059023, "uuid": "ff52370e-244c-4eb7-aa99-5e9cab5d90b0", "value": 368827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059023, "uuid": "f4489041-5fd0-43fc-a555-ee4cd364efe8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059023, "uuid": "acfabcbb-57ca-43dc-bd32-feac5f995ee9", "value": "Order.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48d9538-046d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686058079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058079, "uuid": "0e8204ae-fbb6-40ec-aaf3-6b85a0018251", "comment": "Malware payload (AgentTesla)", "value": "7312da73f806c0dbe1c290e2b394ecc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058079, "uuid": "d3ba5e93-25f1-474a-ae72-0c993060f439", "comment": "Malware payload (AgentTesla)", "value": "890814822b6ab30fa85b84534375b96898fd26c282e5059dc8c6b314453a3d8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058079, "uuid": "4070f3b5-066c-4556-8ca2-a08811baf3e9", "comment": "Malware payload (AgentTesla)", "value": "cdf899e7d4b9bfc7876cc1fda67f6dc42f2f28fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058079, "uuid": "d374132e-6932-4f76-b040-737f235959ce", "comment": "Malware payload (AgentTesla)", "value": "448413682cf7307a67e11d56ade0dfcbbf69d83b3fcbbcaed0a65d2b40c3afccd2e5b04daea5b6479bc15cc6e01cc810", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058079, "uuid": "63b930e0-835f-47c1-9b70-a9e8fd8ff360", "value": "T1B9E433AB19AA7F381E03377AF013391E4ED5F7E4A255538D71AE38308C6DD70EA66019", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058079, "uuid": "1f96d272-ea2c-444c-bdc9-f5ea3abc7e4c", "value": "12288:2tXo20NOFKfSROT9Mi7BkVCshGGmKskWkuIP2iQwaxE9/jC1bbxfyOMl/KsU94iH:2tf0UFzEhRuhGGmKAkuvrxEObbxaOasj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686058079, "uuid": "94e794cc-0487-48d1-b1b8-4b3ae2c9e67e", "value": 676579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686058079, "uuid": "4e40350e-f8d6-4c55-8d3f-639cf04ce6f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058079, "uuid": "b4841981-18b5-45bc-873b-6b65667f139c", "value": "shipping documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501ab5e8-0464-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686053938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053938, "uuid": "1a304778-b3b9-4828-9656-91b185d7b0e6", "comment": "Malware payload (AgentTesla)", "value": "5804368ce3fa2ea8cecbbed0c04d1030", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053938, "uuid": "8f8d2046-9592-4c50-8f24-695c1c2adb74", "comment": "Malware payload (AgentTesla)", "value": "892887bf977985a7b3c64ac19d31facf3af7e783b25173665c8cc48d804cca45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053938, "uuid": "f1c3d4b6-9fda-400c-b636-983be702873a", "comment": "Malware payload (AgentTesla)", "value": "d1af6b0077210346ecb2f86eef408b7b39af225e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053938, "uuid": "94ae0d79-488d-4d7e-9d96-b0e86b4460e9", "comment": "Malware payload (AgentTesla)", "value": "b02bc92768a11e38b87a7d5be32e00a04d3a5bb782c41809675a831961c3c1d81cb1c44826437c7d532d2e056a81bef0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053938, "uuid": "2183e69c-ec3c-4ff5-87c7-e2d6a1272f3c", "value": "T129F4125873B6CB27C42E4BBE61A16D3013FA978A3672D7594DD3B0DD9B67B000D42A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053938, "uuid": "502a338d-c5ab-48b0-b93a-aa5a14103ae0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053938, "uuid": "815712e6-8fac-42f7-b7eb-3ad2247151ba", "value": "12288:z3HkmFx2iqNhujGjURPfHR1SzeH4qptALK1byxxR7x3C0KZe5fdMW:rEmFxUsPmeH4stHJMPlC0KZQfdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686053938, "uuid": "86a987f8-3f22-46b6-8841-0c368b016851", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686053938, "uuid": "95b74b07-81ce-458e-9d65-02c57b525267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053938, "uuid": "c55a923f-e2bd-400e-be5b-f89a39b751cb", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18bb1d2-047d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686064839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686064839, "uuid": "30b81a49-7a9a-44ea-90ae-bfedc62586cf", "comment": "Malware payload (AgentTesla)", "value": "c2410682e7efc9a89f4c88ac2bd51fd1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686064839, "uuid": "86f6dd6e-f3bf-48b0-8139-115dc4dbabed", "comment": "Malware payload (AgentTesla)", "value": "8977050efc90ae103360367456fd07a930525c1b6cb5ff0f69b90ed21d13ab19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686064839, "uuid": "75375e69-5e1b-4781-8f38-3489bf527939", "comment": "Malware payload (AgentTesla)", "value": "ebca329924db6f5326250edf8b304b01f26062c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686064839, "uuid": "21fb771d-ce01-4128-af34-a26fc834b24e", "comment": "Malware payload (AgentTesla)", "value": "eb761b1c7d34733be2b0145a1e10e10d0e63cb24b6a7c24ef9b0100c6e8a27d9da8c4767f0c75b6ac7f2e09f2aace285", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686064839, "uuid": "0273dab6-fc80-44fc-949e-1fa1e220982c", "value": "T190B25B157BE88722E6FF4F36A4B211805337FAB77122CB1E0AD450A62E537D84A517A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686064839, "uuid": "bce01360-004a-444e-a0b1-58979403dad9", "value": "384:3AMZSCDIjm4ODXJtVfb5xfi6nsbqrmBJu4uViNJPa2mmgY1kwyR2vRM5kwFDh+BW:+m4ODXJtVCeLCfRzRvcFDQa5XhXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686064839, "uuid": "6b963241-c6ac-4e13-b64d-072dd22dae11", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686064839, "uuid": "bc5819b1-4a84-418b-990a-497cf519d0b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686064839, "uuid": "2ea38e43-3c03-45b5-8e2d-f2f1add3224a", "value": "D\u00e9tails des transactions envoy\u00e9es_141927_20230606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21118987-046b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686056865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056865, "uuid": "cf58fd52-2819-4f0d-990d-b82ced7a4c53", "comment": "Malware payload (AgentTesla)", "value": "ca42ecac10b22ddf9dabf3baded58614", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056865, "uuid": "b469f44c-0eb3-48e2-8889-a83065256e5e", "comment": "Malware payload (AgentTesla)", "value": "8dd7c62102a24ddff6447492b5981e7284ab841454e3f906bb0303eb4ec99c93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056865, "uuid": "06e82fea-a188-49c1-953e-6e53a6efcc74", "comment": "Malware payload (AgentTesla)", "value": "2fceebab0140a72a6d5e2379c2b0549a4dfdb88c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056865, "uuid": "30ff62c0-eff5-4e4b-bd03-cc2414b03cb3", "comment": "Malware payload (AgentTesla)", "value": "14edd986fdac030c814c33bcd83476e4cce2db1b70f809321a38eda08c277237ec375a176fd8c2a5ab0467074a99ff96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056865, "uuid": "9e1a5d61-fb35-43b4-a71d-efc7d29edd4d", "value": "T14A3572791D8761DAD2BFD33E40EC5D1BFF65B842FE96A90E6081038B719220DB6C152E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056865, "uuid": "fa2c83e1-424f-46c4-ab8b-961418b45949", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056865, "uuid": "db0ae139-595f-46a5-abf0-7c0957f8fe50", "value": "12288:glFyaYfxGBUVASL+1pbBynZ/34B6AP2HhQHWDsNihguwr+U:gHLsWb1BUxck2Xsun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686056865, "uuid": "a016c5ae-a829-4ef1-819e-fb398dd3b9b7", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686056865, "uuid": "0fe094e7-9e76-4134-a07c-b00f98bae82b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056865, "uuid": "92b42793-4861-44bf-91a7-30a35f92bcda", "value": "may.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6336385-03fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1686009925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009925, "uuid": "54e07ba6-8035-46d8-95c2-0cde212ac2bc", "comment": "Malware payload (Stop)", "value": "137e707783879de538ad9625a94eecd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009925, "uuid": "0b5001ef-dc8f-4a82-a9d3-48ae0f89d3b4", "comment": "Malware payload (Stop)", "value": "8e50809f79d9ae944f80e9c4ce75e1dde928ddf4e34663607bccc7463d922f27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009925, "uuid": "72ae7e62-d548-457a-8053-5b5e2ac361eb", "comment": "Malware payload (Stop)", "value": "e383991eb5b62d36ff447e231fd48abfa6cedc56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009925, "uuid": "3da621fd-bea0-4dd3-aaf7-b8762615e709", "comment": "Malware payload (Stop)", "value": "92e471ebe5a4767d022f4a3f71dbc295b2a8dd996e0a6f719f76432620c8bce917667cf444a81f82c8de56881e044097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009925, "uuid": "0803c186-b871-41f0-8297-77acde53cc65", "value": "T13E05021292E1A872F6274A758E1AFBB4661EF810BF147BCB27055B5F05312E2CA77307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009925, "uuid": "9764a7ef-c1c4-43ba-a145-7072e935c675", "value": "90bc432e458c5437800c715bf0d2b09e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009925, "uuid": "567574cd-3294-420e-ac5a-6127a71d3973", "value": "12288:+Nc29/j7tgikbNd6wE0hFvdPHZpXXYVAetqH5IHjbQ6eSwowyyCyDxtdHbgEInhA:iRXt0bXbhFvBX6Aqt9eBz8yDtMfnhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686009925, "uuid": "c4156c06-37ce-43f6-bd30-9b3dc923e174", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686009925, "uuid": "ab635b93-8005-4947-824e-09f0efd68a19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009925, "uuid": "b7c17e92-67c4-4f37-996f-05304ac65d87", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747644ea-0469-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686056146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056146, "uuid": "4ffd9fe6-9ecd-45cc-9432-0298c3076514", "comment": "Malware payload (RedLineStealer)", "value": "2dd485f0ae98a4d8ec204ab733d4284b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056146, "uuid": "3ba6c84b-7ed2-4c9f-aad2-26dd01fb13c8", "comment": "Malware payload (RedLineStealer)", "value": "8ed07e940ee32e2309c5940fad63a7e7b4f3e9f391b825553c87720f3bb5c273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056146, "uuid": "7ac32416-bab5-4ad1-a019-1f3ebe29b711", "comment": "Malware payload (RedLineStealer)", "value": "04b7b4b63dbe46b48010f73b1527b56082828b7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056146, "uuid": "a998a232-785b-442a-8f15-5090b4fee6f4", "comment": "Malware payload (RedLineStealer)", "value": "260c3e3719d687059ad83a3469efaa1b4bc8f26d543ba630ba1f7436f1020499419dd9026cc82fdd76b3e2c5d2261b0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056146, "uuid": "5b43e4f2-aad5-497c-abc0-af093c568b2e", "value": "T18BD41242F7D88163D8FA1F701DF903930A3AFCE16875576B2695AD9E0CF2194A43272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056146, "uuid": "791ec0a2-4d5b-40bb-9ef1-4f2bac4e3751", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056146, "uuid": "d3ee6953-cfbc-4be0-953b-c55e2946f888", "value": "12288:XMrUy907hL/158Ljmwr/IZ975+kLEukaxhaE28ksmZ4pgrhBE:jyekjjrgzfTkax/2f3ZEgr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686056146, "uuid": "53d6b06f-5607-48c4-a8b1-bf45ae99989c", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686056146, "uuid": "fbe3546c-2b42-453b-ae25-3eb9f843385d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056146, "uuid": "9e3c346d-6acc-47f9-8137-6e27d9eea04b", "value": "2dd485f0ae98a4d8ec204ab733d4284b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ef0100-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686090292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090292, "uuid": "95c035a9-7430-42dd-99d4-46257e3d5dfd", "comment": "Malware payload (Mirai)", "value": "4bb7864a9ccd290773b8cad1c0c0cb17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090292, "uuid": "b3f13124-5738-4d26-8d88-a95fff683461", "comment": "Malware payload (Mirai)", "value": "8ef7627e9daad35086f5c9ec58860b962de008bc6a692d7bd05a3448c2267ceb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090292, "uuid": "b8a732eb-4121-4594-8126-7933aefec57f", "comment": "Malware payload (Mirai)", "value": "492b059b9d5bdf21b2eda5e1d16bf9575cb5befb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090292, "uuid": "536e445b-6ce3-42b6-a7c8-0cd3124d82a5", "comment": "Malware payload (Mirai)", "value": "3d8393896e5177b08b579670d97748224e6a0db5e78093e3c90ec8de8ecd35e5b5b2e08c20b31d124e2ee2898152eed5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090292, "uuid": "711b7d24-736c-4ef3-b8bd-246ea2f19439", "value": "T1E0432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090292, "uuid": "21d6f86d-6433-455d-bb70-061edec0e454", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwu:RqtmZPuutfbltZFBSJsBcfDSTFI+BEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686090292, "uuid": "67a53c30-ae81-48e5-b606-e255c334d249", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686090292, "uuid": "2af563ee-9256-418a-b16d-8aa3cb862167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090292, "uuid": "e400184f-f1cf-4a62-b0c1-00e7e1983eb4", "value": "4bb7864a9ccd290773b8cad1c0c0cb17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4192b9d-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036067, "uuid": "5f1daa64-9259-4633-89cc-b3e047e562e1", "comment": "Malware payload (Mirai)", "value": "52ee219d5d1a1186d1f037c46bf71064", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036067, "uuid": "a126a59c-cb1b-4787-82f2-7759d981ca96", "comment": "Malware payload (Mirai)", "value": "8efb1804e2838780a8d7d3e53f46bab4e4837ad47de574cdda4374913d23202b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036067, "uuid": "05ef04ed-ac97-4e68-be4f-1b4c5b7fa2d7", "comment": "Malware payload (Mirai)", "value": "4120c53777507d83b00007c7bc63c76d26c81eb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036067, "uuid": "efe6b1db-81c9-44e6-b49d-0ddf8d7ba8c5", "comment": "Malware payload (Mirai)", "value": "2a620d65883127baf660ca29cbdc324b7ab9c421ad6a56e2e1f58cda8f7da526e0562e6f657aa05de794440467a71e71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036067, "uuid": "cfd77226-29aa-4c74-ad22-5d3d73d50856", "value": "T16A735B24A93A2E26C1D4A17E62FBC321F1F6230E25B4961C7CB60F8EFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036067, "uuid": "d79498dc-b7bf-4db6-b87b-bae9128d7a06", "value": "1536:ubHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNicKzfDFx8:kmcjaq+Dcc5J+vN4Fzfz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036067, "uuid": "4adcbd1a-22fd-4169-a8c9-d5d2d1beea82", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036067, "uuid": "4851609e-53ad-47ce-a3fe-b8d318db7c08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036067, "uuid": "b2513340-cc7e-41d5-beae-bb34d77d6d74", "value": "52ee219d5d1a1186d1f037c46bf71064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80111ea9-04ab-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686084512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084512, "uuid": "db1a7c3c-0a41-47c2-8679-b8b2e6684e2f", "comment": "Malware payload", "value": "855ab6741e558c9803af63bcbe4e0ebf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084512, "uuid": "28e58fe0-6902-4797-a867-5dce3fe4925e", "comment": "Malware payload", "value": "8f565ed1231d94a878cb0ab156aa7782e95efe58f2c81699b3dad28ac96d8a24", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084512, "uuid": "1b2be11f-9acb-472e-8682-fad2622f920c", "comment": "Malware payload", "value": "026e371872c3ca5b386476cee016605b03b4f465", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084512, "uuid": "09f85679-dd69-44af-a6ef-fed7091b8f52", "comment": "Malware payload", "value": "de8089f39aba3eac45f88632b0e01bb816e73dee2e1f449e99a89182607302882b1e79d57abc80e49fb3f7f96d0aed4c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084512, "uuid": "895b5a43-d37a-438a-a1e5-39b1211210c6", "value": "T16714D716388465364237DBFD9BC29C08FFAB416B820156487CDE92DA1FF0954C4BBFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084512, "uuid": "fd896499-7081-4629-b414-4ead48e2314c", "value": "6144:WJ6GJtPH+WoB+d5fpGPQZh4dzPa/vIPiuF:WJ6GJtv+WoB+dnGPQWzPzKuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686084512, "uuid": "6b81b839-c1f7-4f05-84a9-c97ce8670065", "value": 200635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686084512, "uuid": "d261e6b3-a957-49c4-b192-92d342ca1122", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084512, "uuid": "aca63ce7-f4c7-4ad7-941a-d7a836d135e5", "value": "Tiny File Manager.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5dbefc-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036059, "uuid": "a85f54d5-f083-43f7-a8d4-5cd553b96e9b", "comment": "Malware payload (Mirai)", "value": "603c53cfb089f1f8fef5dcfb6cf1e486", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036059, "uuid": "cbcee158-d80e-43f2-883b-6c8b5a837c08", "comment": "Malware payload (Mirai)", "value": "8fe4a5be71e4f7e96bcb8205eac6b669a3d199a0e157ef56895631d2465bdaae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036059, "uuid": "3b7f4fbd-1f48-483d-91eb-e0d493036aee", "comment": "Malware payload (Mirai)", "value": "2fd327ad05f6acb63c145110d9b6bd0927e352cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036059, "uuid": "1e7e46f4-09c7-4f32-946b-792ea6554c6d", "comment": "Malware payload (Mirai)", "value": "69aef9490cc38011f3331ecdeb7d8d246a86c7690d38dd61088b93b391b69c063266c39a8201c761e9400f64bc9832de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036059, "uuid": "8249f624-cd4f-4b64-9dae-528ab2c2b433", "value": "T1AB539EB5C5A8BD99CF698278B61488389723900565E33DFAE741C7A6D00BEECF00D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036059, "uuid": "2fea7e45-47d1-4441-8680-52f92c027404", "value": "1536:B/bivQhunGauwt4IduhosjT1RYeycfs3QtLok1cY3CJ7a:BjiBGFOdOT1Rhf+Kn1cY3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036059, "uuid": "437bed68-f3bf-43cf-b4d5-41180f3ea5c2", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036059, "uuid": "b1afd616-cff4-4e38-8470-0e9f3108909f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036059, "uuid": "51a0f4d9-4aaf-48e9-99d2-bfe502c47549", "value": "603c53cfb089f1f8fef5dcfb6cf1e486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d046941b-047f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686065749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065749, "uuid": "47598465-5f73-43f3-9e06-ff83973ed0c5", "comment": "Malware payload (RedLineStealer)", "value": "185679c1298c3016bb3fa5969d6094be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065749, "uuid": "b2cac0ae-da31-4970-a8d6-91eb8ddcf434", "comment": "Malware payload (RedLineStealer)", "value": "903dc8ab5fda74961759ac38659486b390d8ed0a093519d2ff7b7bd5f45b01ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065749, "uuid": "741443be-9800-42af-94ef-3cf0cdd2c514", "comment": "Malware payload (RedLineStealer)", "value": "223fa5aa925d9a30f03d62110945f00110fa32b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065749, "uuid": "7352daaf-4b4f-4c86-979c-43205c9d31a3", "comment": "Malware payload (RedLineStealer)", "value": "40962497df6065840fa3fda9728e8b9affcb60ececd4162799b465048459a459d1f232ae2d7423d216ca9eabdd52bb32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065749, "uuid": "786bfebc-acf5-4ac6-90bf-2299d8c0ba4b", "value": "T10E152223E7E44423C9A027B048F703C71B36BC62697A979B374B598A6CB1784F631767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065749, "uuid": "0835e0fd-4b16-4256-ba32-c55aaf348d75", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065749, "uuid": "ce84441f-32b9-444b-b43d-ddcb7e25fb6a", "value": "24576:EyncUtO7A6LbI7xy926PDRTlOog29qmzFHP:TcU8PY7xy9DVlO72MSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686065749, "uuid": "e0a825c5-7b22-45a7-88b4-45ac422116c0", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686065749, "uuid": "ce62dc66-f933-463c-8b1b-a1fdc5d771c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065749, "uuid": "9c7b9e00-3a04-4fd8-ad31-c5477bd23070", "value": "185679c1298c3016bb3fa5969d6094be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3c5cdd-040f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017719, "uuid": "f7a7d444-6b54-4a6f-bb2e-2f0d7811a907", "comment": "Malware payload (RedLineStealer)", "value": "2bbb9ba410f05735632862f0229fce05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017719, "uuid": "158feb0e-66bf-4ad9-9ddf-ece04f653c61", "comment": "Malware payload (RedLineStealer)", "value": "904d0f83b3ae514e56f3789b4176837a122e0187c5d4155ed43898033103d0e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017719, "uuid": "5d7cadac-b01a-47e9-a1fd-6eb92a711f92", "comment": "Malware payload (RedLineStealer)", "value": "3731197b21b49eb8383211aeea79885cbcdb9d1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017719, "uuid": "ac4996db-d8ae-4f25-91c0-3d18f59521d5", "comment": "Malware payload (RedLineStealer)", "value": "87600d377e996fdf7e04b797c945cc4793e9fba2d8a76df563c2309f4842a5d1d24b60e32ca2411ae3202dc0699cb988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017719, "uuid": "2ebd754e-b7bc-4be3-a5f3-d19af1cf5fc5", "value": "T1FCF41212ABE89972EDB26B3018FB05C31B36BCA19E7C466B2341995D1E325D0653337F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017719, "uuid": "a52eac5a-f0d1-4006-bb4a-200e5240f603", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017719, "uuid": "6aec2b92-adff-45e0-86c0-b428c382067f", "value": "12288:HMrWy90r9xTLL7riqYQnLtfpmzI2VVIocK01srlzvmClOzL3kg79kSlmBFVG:hyu9xXriq3Wc2Vux1shzlO33nJqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017719, "uuid": "8dce4b08-614b-49c4-8173-48e8eab0f3de", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017719, "uuid": "d0d13d36-cc51-4c77-bac1-772169b78629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017719, "uuid": "56676edb-6ffa-467b-8748-a7523adb1a4a", "value": "2bbb9ba410f05735632862f0229fce05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32684f2-0489-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686070103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686070103, "uuid": "4dd3ad58-11a9-4727-b687-c6fd23d22037", "comment": "Malware payload", "value": "55c890436be060d5f660269c397ad056", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686070103, "uuid": "3faa0e90-7cf8-4ac1-97ba-a0860c02bd4b", "comment": "Malware payload", "value": "908a9cf82625cce540d18ae96a6f39acb5613b664e9f6e76856032d24b8db3e6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686070103, "uuid": "2c5810c5-6627-4fdf-9151-c81f728ed8d6", "comment": "Malware payload", "value": "50b51439c7dc4bd9cf1b8b12b5a435fee37c8270", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686070103, "uuid": "d5dc9728-5b50-4551-a44e-9b3b1b0bcc87", "comment": "Malware payload", "value": "b1564b9fe181caf395d9a6eff63c5f87c3caf2a4bfe20f873100ccc536f8d5bf93a105e9b65f56e5eff828c75fc36d67", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686070103, "uuid": "260966c8-c752-4cac-9490-e57fd58fc142", "value": "T11AE2C75EE78F02688F511776131B4E899ABDB22EB35140B178AC533433EDC3A46765BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686070103, "uuid": "91539148-d011-4c1c-90b8-94fc265effb2", "value": "768:UFx0XaIsnPRIa4fwJMeK+pabGfn2ReX7HWI3Ppte8A:Uf0Xvx3EMwpzf2Rcj/JA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686070103, "uuid": "dce2bea2-5dc7-47ff-b00e-5abbf1b2e25b", "value": 33844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686070103, "uuid": "acc3606f-1e85-4324-98a5-6975e6256758", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686070103, "uuid": "a057417e-cfa8-40c2-8862-37931c69657f", "value": "MT103.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243afe96-03fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686009626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009626, "uuid": "87da3aca-f3a2-488f-96aa-34ef38da5508", "comment": "Malware payload (RedLineStealer)", "value": "2b3915868feab230e5cafe4be69d8f95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009626, "uuid": "c610924d-617b-41a1-ab24-13d0aa9c728e", "comment": "Malware payload (RedLineStealer)", "value": "90d3dcaf413c56e26a311ac721faadcf10d2f6c7ec20c28769b912868d4641cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009626, "uuid": "7b38a119-7d3a-4deb-bb54-59d79b8b25b8", "comment": "Malware payload (RedLineStealer)", "value": "9793337f51c8ff22594272512c4d1eb3fd316e54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009626, "uuid": "31ff49ee-925c-4ef5-a3c9-ded74e8189b4", "comment": "Malware payload (RedLineStealer)", "value": "d50884a9d0ac7ebc514a628e033b8c44897005f96cb8c89d8deacf1bd97cd97a6cb5a8e8df139201bf1154c5366051c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009626, "uuid": "5ac1f5a4-9a23-4c4c-a660-446f4966fe0c", "value": "T1B0D41202B7EC8073DDB427B158F30293073A7C925D78876F2782A95E5EB3694A572327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009626, "uuid": "89427f10-a9ca-41da-9956-9ea7b821704f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009626, "uuid": "8e0bae0e-3c06-4881-b1ef-16067bb2c4aa", "value": "12288:6MrhGy90zbOFJpYAborDc1+zK6DTvS/w04BJlgd9zUBvO6C6maX3P2VF:HGy2OrVorNrDTkw0hdNUBvvC4XfYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686009626, "uuid": "4071200b-8a8f-475b-9684-abdda067d54e", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686009626, "uuid": "442c75fa-8250-4f4a-8c13-13fe8f9e5ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009626, "uuid": "26017e5f-6207-42f0-8385-993576e7f189", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd257ead-0439-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686035706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035706, "uuid": "9dcf5e3a-3529-4b7b-8d78-b2e61926a2f5", "comment": "Malware payload (Mirai)", "value": "34c38f74da1b133b08718ab58ef310f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035706, "uuid": "f1c58523-81f2-4994-8056-9e22afa1c728", "comment": "Malware payload (Mirai)", "value": "90e9b532de21832a268b43830ccccaa79f7a2066c7ac190caff26c6df804bb44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035706, "uuid": "83879fef-22b1-4762-a430-35b092d33447", "comment": "Malware payload (Mirai)", "value": "29fd009ae94ae852e45e0aa7dfd55b4c699fe297", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035706, "uuid": "d019db3a-778d-4fc0-aec6-fa0065a88967", "comment": "Malware payload (Mirai)", "value": "cda11e6c2364f93f3d594e140c5e2098daa16417ddd899eb14bedb2ac6b131fe4e15baa021c2777ec88fe2747cf11cdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035706, "uuid": "081a3914-d57b-4e75-b340-6eea10e19166", "value": "T1D5735B24A93A2E26C1D4A17E62FBC321F1F6230E25B4961C3CB60F8EFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035706, "uuid": "31555a16-1240-4e00-b78a-57cf8d20d898", "value": "1536:ubHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNicKzfPFx8:kmcjaq+Dcc5J+vN4Fzf/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686035706, "uuid": "703ad570-39db-4868-bfe5-0cd70674f1fc", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686035706, "uuid": "79a8bffe-c68b-4001-8f40-ebcc23f83b32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035706, "uuid": "6a356258-f34d-4ae9-afe9-6421908fa5d6", "value": "34c38f74da1b133b08718ab58ef310f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93e1b87-0453-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686046840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686046840, "uuid": "79182972-02f5-4276-a9bf-76e21caf825a", "comment": "Malware payload (RedLineStealer)", "value": "4a861ea1f60ee60a65b521d89f68807e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686046840, "uuid": "781a1065-dd4f-4451-a118-2c683217630e", "comment": "Malware payload (RedLineStealer)", "value": "913352281549ad00d96efb5a7c06cec30761554c6db66ac712c61795a30762a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686046840, "uuid": "a64c824f-d3e9-4ffd-8d6c-be2daba34957", "comment": "Malware payload (RedLineStealer)", "value": "bbb83a92051cfc055812e5f43aba8a1d2f909f2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686046840, "uuid": "b35a228f-6003-4da4-839f-e7719ed39211", "comment": "Malware payload (RedLineStealer)", "value": "498b711868fb2de875732c0cbc1fc5ca6e41b68e76b5abac888ce3a6d8a78f61f540b4a590e21b735fd40d0743f19ff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686046840, "uuid": "f9071e17-7185-46ec-ba52-c6c591543e02", "value": "T107152326ABED403AE97463F069F613831F36BD61AC744B6B23216D190C725C1E87277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686046840, "uuid": "4ce03d0e-69be-4940-8b9e-f6d8b53178db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686046840, "uuid": "a939450d-af45-4104-ab96-12feff0aa353", "value": "24576:6yclzaO1+dtWBgtIWJI1HTYL1Kkv70WwPk0:BIa5WBgGWeKLkkT4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686046840, "uuid": "aff82271-a7b3-4db9-9226-7ba8cd99ef50", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686046840, "uuid": "61341d65-fbeb-4ffc-a17b-00f20da9f2a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686046840, "uuid": "38b5ca1c-655f-4c12-b138-5dd17fcc60ef", "value": "4a861ea1f60ee60a65b521d89f68807e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc458ef-04b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089881, "uuid": "9aa8ffa1-6b51-46c2-b4c9-f802e679475a", "comment": "Malware payload (Mirai)", "value": "b00d4d07773812ed0a4dc4eca07be450", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089881, "uuid": "c84e6a1e-2e7a-47a6-920b-8cee70496492", "comment": "Malware payload (Mirai)", "value": "923c5e016ab42f57b8ffa77ae75c6408b124be6d61b46c942cfafa0d3eea23b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089881, "uuid": "9e4785ab-9148-4d03-9203-87dcc80e0941", "comment": "Malware payload (Mirai)", "value": "a5c3565d306b54810233c58090a27a17c9623749", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089881, "uuid": "5f888548-4d55-4fb3-9a67-efef3c4de4d0", "comment": "Malware payload (Mirai)", "value": "b58f89a74488c14d7eadf25549d1871628631a6c53c42f295dc1bbb214732346cc3ce7246d1ee4a23f686006c3a6abbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089881, "uuid": "32bb2425-df66-4e4a-81ff-f44e57f12939", "value": "T10ED2D06EE5B442C5FD8E5C3E808C3FA10E19E581231BEB9267128C4D5B36C57F66A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089881, "uuid": "052c093c-28e0-4581-abfc-8d3e516d1cb8", "value": "384:e8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjSt9RWGVCz0Nvz:jMYHb62x4ahQ3CfdwLjrdW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089881, "uuid": "a915c09d-fe2c-4f9b-b50a-68fff57e011a", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089881, "uuid": "593a4152-4444-4efa-84ab-e631eba67879", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089881, "uuid": "57e30ec0-7039-4c50-b21d-7e5b5bfb68ad", "value": "b00d4d07773812ed0a4dc4eca07be450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1b339f-0468-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686055545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055545, "uuid": "081c55a3-43f4-466d-9ddd-d61b93927eda", "comment": "Malware payload (RedLineStealer)", "value": "4bef477b8b24b843ea1d609ca23e2d4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055545, "uuid": "29271269-424a-485d-8226-1aac6cc3eadb", "comment": "Malware payload (RedLineStealer)", "value": "926aa0310c53110ceccb9125a1bfdeb6fc1e913dc357f1c5160be091c2a72db3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055545, "uuid": "33a6a7eb-1faf-4523-9833-f59665f848ea", "comment": "Malware payload (RedLineStealer)", "value": "8c75026123b8b68fbe1cf7c38c90dbe104f629c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055545, "uuid": "e2351a4f-390e-43a8-964b-76ccf8526321", "comment": "Malware payload (RedLineStealer)", "value": "63411978600034ef35dd7fbf776d66ed05df7be5a21220c792a4c2bb2c6bdf8136f5982f9dba9341a391e1d927c13c11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055545, "uuid": "1a4dd144-f15c-4361-a7f4-e273851a1587", "value": "T141F41213BAD98572FCB51B7064FB12C30B3BBC926D3847572744A95A0CB69C0EA32767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055545, "uuid": "03bffb03-53ee-4c77-8326-70af20abf238", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055545, "uuid": "3a86fd3e-5ef7-4628-ad1d-15c83b13a88f", "value": "12288:aMrGy90JtPGsjKsdMs1dvT/fJ9rHMvApRiwW6NNlT0eOfscTYggZc0qS:oyujKAjvT/fJ5mkRiwWyT0eOfscTYggT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686055545, "uuid": "e671ddb0-8854-4cba-ac00-d87b9b694ac2", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686055545, "uuid": "37e181af-ab3b-4b73-aff1-fa75c9e7583f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055545, "uuid": "8b994b66-f9a9-4fc3-885f-b1d4ed9185ef", "value": "4bef477b8b24b843ea1d609ca23e2d4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955de4a3-0449-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686042458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042458, "uuid": "304360bf-7947-4f01-affd-7d4bafd6134a", "comment": "Malware payload (Formbook)", "value": "b1a5d1aa940ebec3b78e3a9e27cc588c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042458, "uuid": "94595f88-1945-4c83-9319-8060774033d6", "comment": "Malware payload (Formbook)", "value": "9337bf26f7c97890b2d01df17d8c05158f37600b503d91fcc24b609643b03ce9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042458, "uuid": "166f1b07-0a66-44b4-b5a1-4bf350f72e23", "comment": "Malware payload (Formbook)", "value": "1c426c9560900135090fd448f4b36fc9e98c4d98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042458, "uuid": "ac168386-1122-4ee7-9635-4c6570dd47f2", "comment": "Malware payload (Formbook)", "value": "3956384676fe86248b8ffdbc876912e53cc3d150d3b309678470d4ed768705f2bdaed8b3ffcd82603deba08eec63fb7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042458, "uuid": "5e4a56bc-b159-4180-a12a-7b85cd0fdc01", "value": "T19534122077D1C8A7EB7182B10FFD83066EE8FC0558A8474F17606E7D3A564929F1A772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042458, "uuid": "967ef020-82e7-4bf7-ba4b-560ee2e1b2c7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042458, "uuid": "bd0abac1-c8e1-4a9c-b727-0fd87360b603", "value": "6144:PYa6Z9/BDgCSibO9ECcH8u2T6UHjKnoXx/dAMI29N:PYT3ti68u2xHuotyMfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686042458, "uuid": "4b76cdf1-9fca-4c5d-b8d5-903895f12443", "value": 249825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686042458, "uuid": "89ebad02-1ef3-44ac-8352-420bbb569dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042458, "uuid": "171dda50-fa15-4d60-aed3-e6e337205e99", "value": "RFQ-21-QAI-OPS-0067 (7000000061)PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7845e46e-03fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686009767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009767, "uuid": "6b8cd665-ff06-4efa-9934-d7c047f2b1e1", "comment": "Malware payload (RedLineStealer)", "value": "f354bf0ab92619bbdf0c1e3f1f86f5cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009767, "uuid": "33ff2bec-2c60-41c9-ba19-ad1e4c33476f", "comment": "Malware payload (RedLineStealer)", "value": "936a17f93077d831c6d70f2755bb2ad8a87380d0ccb43de51f5ed8081454c161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009767, "uuid": "19f758d2-220e-4c5c-95d8-249a6dcecf6d", "comment": "Malware payload (RedLineStealer)", "value": "76482226fa03037f11e69d3847bbc07f615d9e1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009767, "uuid": "c4179486-16b5-45e0-a9ea-157a07ccea2a", "comment": "Malware payload (RedLineStealer)", "value": "9a23554e9dc0ce399a9701d895f6c35fe3dac7f56cdbfe0bee434ff4eb62097b9462c26c111080582d3d807cb7d4ad3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009767, "uuid": "51c44801-5bfd-45e6-b437-e719911aed2a", "value": "T15A152313A5ECC076EAB527B089F903830B327EE2DDB4536E238159A91D736A4F871717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009767, "uuid": "00bf9f78-093a-40d0-a4d6-be9e63b6fc39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009767, "uuid": "d155e715-a48d-4042-aec2-12ef82484340", "value": "24576:UyZ79yeMj0iFvZiIV9Nmwi+/VNHosnqz200YKg:jZ79vMj0iJsC9Nmw/VNIsnroK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686009767, "uuid": "7b4810cf-f7c4-4522-87c0-fa78633696ce", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686009767, "uuid": "a9843ac4-85e3-48ae-b5c8-d398be513f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009767, "uuid": "79a67fa8-60b3-4f94-934c-da66f28b484f", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b662cd-044e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686044436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044436, "uuid": "631c6210-0303-47bd-a0d5-1903b150f461", "comment": "Malware payload (RedLineStealer)", "value": "ba720ab99e98fc62f4f329d4310b9e57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044436, "uuid": "c4452e62-53dd-415e-a896-bd2c632ad138", "comment": "Malware payload (RedLineStealer)", "value": "93f3b4fdd013afa1fcf9c8c742a6508b95513668ef81b1e54ab7ab346179d9be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044436, "uuid": "0b5f6e13-602e-4266-92fb-07b9fbf9c74b", "comment": "Malware payload (RedLineStealer)", "value": "b0d7631b462c45d1609a84ec144ad62f4ea5fe93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044436, "uuid": "fe66d87e-8a8a-4831-9eb7-f47114af3131", "comment": "Malware payload (RedLineStealer)", "value": "b72465903a125fa8ead3e09d63167a0be655d57c41d99303793c11cf64e5f2c5299e3f8349405433a2a39d334a0d6c63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044436, "uuid": "39b38e18-d16e-4aae-8e6e-e4af9a22caa4", "value": "T19BD41213A6E88072DDB537708CFA1393033ABD728CB497A72755994A0D732D8B172B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044436, "uuid": "7f684c66-916e-4566-aab4-a3dbde8e1412", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044436, "uuid": "8261d905-0046-4063-98aa-ef2fe05fb5f3", "value": "12288:iMrUy90hChfU3giXVgULhc0gumEd13y0qSeh:yylfSVgUL+2d1JXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686044436, "uuid": "a5c47c54-1451-4ec0-86eb-575e7c769704", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686044436, "uuid": "0605b807-67b8-4b18-b607-8bfe610695ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044436, "uuid": "4a5a4bb0-6e08-4c50-82ac-927c29653271", "value": "ba720ab99e98fc62f4f329d4310b9e57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09153ee1-0483-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686067133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067133, "uuid": "5be4d5f1-7c5a-4b3f-98cd-c8647c8405c3", "comment": "Malware payload", "value": "c4811bbdd1eaa6d9fc1ee42dd8419f0b", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067133, "uuid": "a29206eb-f15e-43fc-a1ba-5566ab584d0a", "comment": "Malware payload", "value": "944522e1214ad7084460cdd164e5058cd211870b60be411969a23c5cbc94c1ce", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067133, "uuid": "935d63c8-7963-4229-b175-94b2c072d298", "comment": "Malware payload", "value": "e9c5117fc98ecf666b3259ddedb42144dad430ff", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067133, "uuid": "33238473-197f-4e7b-917e-bef1b6c69a6e", "comment": "Malware payload", "value": "37a3b81f720dbb83983520bbfd3aa3f9663978456fffadf107c9b86fa1f158d00146b105ff19a144d3e6152d1fdc5320", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067133, "uuid": "4f425dab-bd47-4f4b-be32-77e145067bdb", "value": "T16855126843BB4A1DD8667FFD0E101270DAE855AA7993C2277FEF98DCCF21B200C85496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067133, "uuid": "0de5eef5-6750-4290-ae55-434e8b882ccb", "value": "24576:C1iewlqB6p1XceAM1iZDTC5c/DrQAxmHgnP:CQe2q8plceb4ZDR/DDEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686067133, "uuid": "a91f0da1-0f83-4686-880b-0acb9273869d", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686067133, "uuid": "d9d2ada4-3b5e-46ae-b650-5117e08a8f0b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067133, "uuid": "b81252ed-0ea6-4970-8320-c1d5276ae959", "value": "Offer inquiry_1.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc5309b-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686059326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059326, "uuid": "4380e8ee-f1c6-40f3-bb51-e6a95dee7787", "comment": "Malware payload (RedLineStealer)", "value": "718bfc791370de0adf014c0327a9eaa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059326, "uuid": "d5400d55-9d76-4d14-b288-a6642a335be0", "comment": "Malware payload (RedLineStealer)", "value": "94697578ac7adb140d5144617210f26f71ccb12a99002c7221bd1bda822c5370", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059326, "uuid": "954b338f-ce49-4a34-8634-918fee2b55ac", "comment": "Malware payload (RedLineStealer)", "value": "1f2612a3d78e65de634613ddfda30bfae0b9718f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059326, "uuid": "912343d6-d62c-43e0-b137-42d4c4376c06", "comment": "Malware payload (RedLineStealer)", "value": "1c52540bc26e5604ea6e1e479671105865a52062d36700472bf5bcb6040c13abbde7c6864c7c87c4d3dd6f648f1abd00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059326, "uuid": "8f47f0ea-1c22-4240-b828-41c9c904ad3f", "value": "T1FCD41213E6E94032DDB6273058FB87E71E377C218D3986673785A95B0CB26C1A97132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059326, "uuid": "a40f708b-6e21-4845-bd2e-ff6841dd08e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059326, "uuid": "bfb97867-5ba2-4b8e-a931-7436bcb3690c", "value": "12288:1Mrey902X5jxl48hJKKLsZHMl1RDKzsD8am6mropt+SC:/yhxl3YKLSMlHKzS8a2ron+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059326, "uuid": "c276d33b-bc39-4839-878d-e9974aab5e34", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059326, "uuid": "c786f2a5-d305-4de0-af56-eb07b36e9814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059326, "uuid": "4c4e3603-ec0e-4a5b-9f25-00738e1afc8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2e0059-047e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686065095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065095, "uuid": "df6fcd57-bdfa-4726-ad66-5de31c37dc1d", "comment": "Malware payload", "value": "e2ddceea4210afc202c15eee626486f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065095, "uuid": "1391b763-3fc7-4e6e-aaf0-f864f5c528f5", "comment": "Malware payload", "value": "949d3c18faaa73a91632b8dea5970b228a0667f2dcaf90ca273ddeb8aa7c4fb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065095, "uuid": "a6bc1a68-7b38-4433-b1e5-3e5445b219e8", "comment": "Malware payload", "value": "3436f440a1f3d03bdcf3fdacb726d9e2c1c93a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065095, "uuid": "fb224778-378a-492b-a71a-19c792d5f4ba", "comment": "Malware payload", "value": "279ba24655104f75a05d8038f44d323c6e34706b095b9face6660665fcd5e80478613e830692a4a388d0587f74523782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065095, "uuid": "6a3467f3-eafe-4657-af0c-347b04926755", "value": "T1ED05121D62BB430EC5673FBD0C2116B1CBF85A1AB463E1478FA7AC9DDE2171A4D88487", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065095, "uuid": "28a06c96-244f-4c65-8a43-5c8dc09f020e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065095, "uuid": "17dc126d-1b78-46bb-b026-6b712a8d660d", "value": "24576:91iewlqB6p65PuHI/qE23+OKDmE3fcY4xAfIbE:9Qe2q8p6ooyEgKDbvl4oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686065095, "uuid": "5dc2a5aa-6d68-456e-9976-8bd570becfd7", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686065095, "uuid": "c3a3f006-87b0-44ae-939d-1e6e1b66cebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065095, "uuid": "54c187b6-78a8-4de8-af47-6d5c51946fdc", "value": "uMKPyQq2Jmwv23R.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8d8fbe-041a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686022126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686022126, "uuid": "2bb6f615-825b-4a4f-8c16-f6d7a56bd1bb", "comment": "Malware payload (Loki)", "value": "bc9e1583a7eeaa2d6ca381a58fd52324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686022126, "uuid": "8555e026-d556-487f-b68c-8844df03f531", "comment": "Malware payload (Loki)", "value": "94a92d06d9fac7101cb5c15f1afe2bce92b2186085cadc1ea2c72b2f6e154912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686022126, "uuid": "23091490-c0b7-4b18-b291-beaa7da249ca", "comment": "Malware payload (Loki)", "value": "f92665cfde2b367f6185850aad7cafed4b247281", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686022126, "uuid": "23028c1f-2cf5-49cb-b1e7-4c971ecbc7a7", "comment": "Malware payload (Loki)", "value": "4624b4d3e24726b9ce8a9b0cb379b1888542489af2ae1b3b15e43f6040a0c2c23897f3e0149a257175e9809234cf70df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686022126, "uuid": "fa8eb9bb-3d04-4024-b8ed-803277fe8cad", "value": "T1F2E4126C62F3861ED45B3FBC0E108535C3E96A487423D25B6FB3A9CDDD22B144EC4966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686022126, "uuid": "37a96464-dc37-4088-bf1e-71873a8a7adf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686022126, "uuid": "98c88afc-44c3-4ac8-b88e-46c1a7dc06d3", "value": "12288:7+J/M+Jhewx/NscEQ+vgXK1HsaPIyq6dUe4XL6fzvStNUrNYJm2myM609M+J:Y/thewlqB6pheQIStVJ0yM6At", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686022126, "uuid": "573fa87e-784f-4c87-9bc1-e7e6eb4c40cb", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686022126, "uuid": "e136fe5e-54b6-4d4b-a416-9a9a9c5df8dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686022126, "uuid": "f4024837-6d94-4120-80a4-acc60e2f0cfd", "value": "SecuriteInfo.com.Win32.PWSX-gen.30700.766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdd4a29-0469-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686056375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056375, "uuid": "257cbca0-b743-405e-af47-83fc75123eab", "comment": "Malware payload", "value": "2746ec23aaf4022f03437eb31fb6983b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056375, "uuid": "464f360f-213d-46e4-bb54-9124580ffce6", "comment": "Malware payload", "value": "94e094ca49f2c062fbb93ed6d45bf0bad1ff75974bc4a6aaae9e89773ab65498", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056375, "uuid": "0dc77e12-b9c6-4dc6-884a-6ac940d90294", "comment": "Malware payload", "value": "94ab9eca434deac246b19f415f9f85bda3458a0c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056375, "uuid": "a371e3be-5f24-40a8-b4b4-93cad0d26827", "comment": "Malware payload", "value": "4976b0183108c82286efb46cb175778e14987d04cda56b653ce01beb97f40d83d93ff9b576c9620ef29b6301612aa40d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056375, "uuid": "b1d89996-bdbe-4a99-ac72-d91d179393cc", "value": "T10FB42379D1C9B61A324784399C494ECD2BC6AE404D492B79D2CB78BD8707F2C8DD07B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056375, "uuid": "de1fcb92-0a1e-421d-86c4-77aeeb6190d6", "value": "12288:8cDfyAU5eD8YP3RGwsMINlyH2EmAdnw4+5J395XQ9tGxH:8Sf3Wqww482Funw4YX8tGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686056375, "uuid": "651eff15-ada0-4641-b3a2-47bb8a2d8d1c", "value": 502829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686056375, "uuid": "5706c98c-bedd-43cb-9c41-2ea1273253f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056375, "uuid": "853fa234-ccab-47c1-91b9-9b42bbfd9c58", "value": "Attached insurance.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53948d6-044e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686044739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044739, "uuid": "9f53b8fa-2717-4ce9-833a-6829a52b146e", "comment": "Malware payload (RedLineStealer)", "value": "2e1ca0bd90280d91624e5ec9748acc83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044739, "uuid": "5b0c87c3-0abe-4caa-a0b8-476040fbe683", "comment": "Malware payload (RedLineStealer)", "value": "95f8e33e3521a344acb4b2adcd51f9aad0bb29d2b34ea3687110716634ee82ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044739, "uuid": "aac6dbdd-171a-44c7-85af-966d7d46c9e4", "comment": "Malware payload (RedLineStealer)", "value": "86c7940b79b29339f70f34527496457219d9a5c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044739, "uuid": "7a6a7cb9-2224-4004-889c-bc32f5a69b71", "comment": "Malware payload (RedLineStealer)", "value": "227a3a205127a10ada55aa6ff13f059cb7e8a79d440a5a3246811004d85ea469104a7cc3a9fd1c9adaba732ad2ecb0ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044739, "uuid": "47fbe37f-688e-45ab-8116-d2d2e7051b68", "value": "T10AD41202E7E49133D8B067B098F617930F377D929C7882272756A86E0D73691A8317BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044739, "uuid": "9fb15e76-0668-46f6-ba4c-990d3df422fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044739, "uuid": "47716e99-4605-4244-b2b3-aa507335b79f", "value": "6144:K7y+bnr+Qp0yN90QEES2fwtQlnmWSAtzYRYmvppM0AO5O7wLyh/4bXylYJJ0qImr:VMr4y90ChfUWBti9I/F76qmBeElOhFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686044739, "uuid": "bc418cb6-72db-46b8-8f49-75a3afaa8a54", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686044739, "uuid": "4c462e9c-29e4-433b-8e18-597c9410daae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044739, "uuid": "79cb1452-1abe-483b-a956-ef87cb9a8546", "value": "2e1ca0bd90280d91624e5ec9748acc83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc390f5f-043e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LummaStealer)", "timestamp": 1686037906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037906, "uuid": "b8cc7f61-e5d1-4cc5-be3d-fbcabb6f44ed", "comment": "Malware payload (LummaStealer)", "value": "aaa0677a747bc0f6d6e2192209a52ebd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037906, "uuid": "777a9d9a-0aeb-4401-a19b-011eba7e93ea", "comment": "Malware payload (LummaStealer)", "value": "9656559ba6495dad4638722343efd32e08235bbf3989954d5bc40a57445a28e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037906, "uuid": "e9e05c3b-e85c-43d8-bcbb-45c4f3963f95", "comment": "Malware payload (LummaStealer)", "value": "5e5d96ad64d417194eef4f755f11ad288abde2cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037906, "uuid": "6d76e626-6a51-4daf-a29d-01c2aae2a570", "comment": "Malware payload (LummaStealer)", "value": "81b8dff49602c06fbcb4a43c5f865742c4fb88c96854cc10b95aea10adda93e6a7ccdd035f51d2e1f5f93e899a1b0f98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037906, "uuid": "108a42b4-fc7d-4f38-898d-e4e2f361ad88", "value": "T196343B0393E1BC50EA254F329E2EC6E9761DF5918F59BBA622189EEF04B00B1C773715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037906, "uuid": "e198eb0c-e245-4de2-a76a-6b97cfaa1ba6", "value": "73f55c9a8ec43dc84ad4d9211db141b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037906, "uuid": "e9ce4b5f-2a4e-422c-8f81-61eeeca20ce5", "value": "3072:Eb5xvEnqClQZSAhudZOeC6PvkvlkFcmfnzzPwma71AC+9hO+d:c5xvgQZSAhu+wCl4fP4ma71Gr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686037906, "uuid": "1b499544-137b-4e23-839e-a78a80f465ef", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686037906, "uuid": "031ca8f9-d17a-48a2-be63-014e15f590dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037906, "uuid": "3af6fcdc-2c1b-481d-a0cd-e5466fc7bd76", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946fb5de-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036014, "uuid": "707bef0a-dbf7-485c-859c-d6b58e4bf79a", "comment": "Malware payload (Mirai)", "value": "2338006ca03caae6d66bd55701d6d894", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036014, "uuid": "be48ed5f-f954-4d91-86d3-2bda0be18ec8", "comment": "Malware payload (Mirai)", "value": "96982d4135cead6915f2f07cdb820559e1bf5048b6b22655fae00b479377c0ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036014, "uuid": "fe78822a-6f97-414c-840e-a9eabf33baf0", "comment": "Malware payload (Mirai)", "value": "f0d2a7076eb7db2c97a3fa146fe11dad7b78c4d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036014, "uuid": "319eaf1e-86dc-4557-beb7-80f743724a8f", "comment": "Malware payload (Mirai)", "value": "9a7a1acf322c27991a8d6b3e33182e2e3c2c532dba739327d1b98cf6af6f0777f779ffb3da5bd64b54c0ad7373da82f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036014, "uuid": "0d2a59e4-7dee-4450-82d5-cf501e94d71a", "value": "T18B33F155B405B461C6703637F8361197FF491BFAC2E63437056943E8E8EA4A33AF6CA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036014, "uuid": "fe0e139c-14dc-40c4-ad06-e59571685e70", "value": "768:wMte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLrHV9q3UELbOs8qMI:wM84ISRX63dZQbS5rzZHoLIVmWjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036014, "uuid": "7f4f11ab-f326-43d1-995c-65cb55aa9139", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036014, "uuid": "88f8e833-e310-44c8-a99c-235fbb077971", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036014, "uuid": "a686a5c5-13d4-46d0-bf12-cf8d212e6b0d", "value": "2338006ca03caae6d66bd55701d6d894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4442470-0454-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686047288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047288, "uuid": "186a987e-8727-4fd5-87f9-3730987f5f05", "comment": "Malware payload (Mirai)", "value": "11f55e8eaa9699d3c64b022fd4872695", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047288, "uuid": "df9067e6-4f3b-4ef3-9226-4c01cb00645d", "comment": "Malware payload (Mirai)", "value": "970d9f15ec2e1d7ada3f547da00b5b76e2e12c6c6268d795b0bf7a76a38e19ec", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047288, "uuid": "55d194b1-0175-4e9e-8a17-d51d28352519", "comment": "Malware payload (Mirai)", "value": "cdbedb20e77dd624167031743ce9b044971b9d78", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047288, "uuid": "f5ce0a2a-7436-4c5c-8645-f901837fbc2d", "comment": "Malware payload (Mirai)", "value": "c0fb7a8ed2a2a38b475613c38a0532d06f5c8390f2d850e8cd91109c7b09c69171136d8790837940e3a8595a43bfddf4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047288, "uuid": "8d3b046f-3330-4103-bae0-c39280d40dfe", "value": "T13FD2C0E585E7F5B8D0E6A6F5003E07C5ED76B21AC2165AB708ED71A6DE130D80D30EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047288, "uuid": "3be2fb14-5911-4317-8e22-9d4cec7a4c37", "value": "768:SYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBrSx0s1:SYJdJZiy1aBnQfTqBWt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686047288, "uuid": "1866fa51-6da2-4339-a310-3372c5dbb779", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686047288, "uuid": "bff79037-96e6-41a2-98be-6dc20a2395f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047288, "uuid": "baa6ee6c-f720-42ba-b6fe-6f0d461376e6", "value": "11f55e8eaa9699d3c64b022fd4872695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71b98dc-0447-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686041709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686041709, "uuid": "78277bd0-08ef-4a7c-b4a2-15ab85e90280", "comment": "Malware payload", "value": "905e6c6c3cba1084f405a65171e3ca4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686041709, "uuid": "08d24c35-77d1-4d41-9665-4c48cb563998", "comment": "Malware payload", "value": "97a932ac3ca1c05c2076306c82235b8fe1c170e9f80f1ab55e8f590c77c7a44b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686041709, "uuid": "5ccffd9f-54c2-4222-a72d-d6038ea811db", "comment": "Malware payload", "value": "517acf6d12a074f457296660d74a5826261a6fb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686041709, "uuid": "17c9ef18-028b-4114-9abb-f127b1259671", "comment": "Malware payload", "value": "a9f86c9173c1b580fe2401671ed90bcd5ed2c698862edde1903addd40a7038f1c40c41861260d7d97c795d859a13747e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686041709, "uuid": "177d3805-c94f-4ae4-a2ee-958ae6a6119e", "value": "T1F8F41229A2EB870CC86A7FBC0C050679C7E9599934A7D6175FDB2E9DDE10B260CC0987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686041709, "uuid": "a2642beb-209f-4299-8bbe-3011f58c9ffa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686041709, "uuid": "b3912e32-a856-470a-a549-f0a66cbeae6b", "value": "12288:f2iNUewx/NscEQ+vgXK1Hsamlk/EbvqTpA0d5sGbnd3ZISYp2x:f1iewlqB6p5lEX5sGbd3ZISY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686041709, "uuid": "81829edd-96b8-4f96-8862-e76edd04093c", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686041709, "uuid": "ac6f8033-bac4-49b7-bce2-2c7295ca4231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686041709, "uuid": "62ab304e-c9d1-4e6e-bdb4-17d19e0f38f3", "value": "General Attachment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a237799-0483-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686067135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067135, "uuid": "97b33a73-0867-4467-97b1-8ee61da786d2", "comment": "Malware payload", "value": "56a210802be387be2c9f35ef214fd0f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067135, "uuid": "5611a9fe-0d4c-4d68-8b49-b1ae4ae3103a", "comment": "Malware payload", "value": "9832edcf3486a99510895b5a11f51556ad22bc3808e627ddccaf42acfb2dd3b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067135, "uuid": "195c8e8b-0510-44cd-977b-a164fd5f4347", "comment": "Malware payload", "value": "b5ee9ab32370b618891dd2a96fad4a10c2be9f30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067135, "uuid": "b5265506-239a-4b38-b872-e12c168f4688", "comment": "Malware payload", "value": "7e42c81fab37745b3d297f92334e2c83991c7a15137b195796012359bae0c9dec778b6827425f777675b88f50dbad306", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067135, "uuid": "8d077e60-44d4-427d-b156-2193c5503395", "value": "T1C705126C56BB4A1DD8667FFD0E101270DAE855AA7993C2274FE3A8DCCE22B204CC54D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067135, "uuid": "6b304af3-0d74-4fde-b73e-ded210221f1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067135, "uuid": "bc610c98-6982-4901-b2c8-4a5bf2c312c3", "value": "24576:Q1iewlqB6p1XceAM1iZDTC5c/DrQAxmHgnP:QQe2q8plceb4ZDR/DDEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686067135, "uuid": "c44b0435-03fb-4443-accf-183e1fc71576", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686067135, "uuid": "8c3dbdb8-4b3c-4ef7-bf88-f52d10075f7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067135, "uuid": "8cbb2771-8a5b-4eec-bbe1-38235e0b9e6a", "value": "Offer inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc493c2-0442-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1686039304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039304, "uuid": "980035d2-2f5e-42a6-817b-2dc9351ec627", "comment": "Malware payload (STRRAT)", "value": "790a4b486179b608203fcff880981e93", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039304, "uuid": "3988e0f7-8f37-45ef-8f82-33239bb4264b", "comment": "Malware payload (STRRAT)", "value": "98da431e0121e98f68a2352e42dd1f0e7163682ed352488c33628566d5f08172", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039304, "uuid": "66a0a587-b15c-4448-b819-728d1f97c37f", "comment": "Malware payload (STRRAT)", "value": "bd71c41442a0e9ca79b8b2883b7da5b273dc7bf2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039304, "uuid": "3cdb41da-45c4-4bdd-8af2-4138a6405781", "comment": "Malware payload (STRRAT)", "value": "724bb399a849d57f8444b2a64bc92e9ffb6881f4dd629df6c386f7416a17425f4ff31681bc4e3d7d49e401635aaa296d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039304, "uuid": "2e5df57e-3267-494e-ab48-e9df1fa407cd", "value": "T1E024F12FBD9E94FCD10B81B6614A8535B52C6198C805A53F6AFC22EB1D30C5D4F82E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039304, "uuid": "d0ff8287-6a1e-46e9-ac48-5f285537161e", "value": "6144:FbjvW2B9un24dz0p9m27fV4TxsEKj1hXXYqg:5e2H0Gr7t4Tx4PnHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686039304, "uuid": "2d6e49f9-cd0b-4bb1-860e-cd1c2651b46b", "value": 224560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686039304, "uuid": "691cb0e8-ebd1-4fcc-9e7e-f1b853a9f913", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039304, "uuid": "53e5562d-d459-4173-8db1-9ec219623d74", "value": "Richiesta di offerta #PO 00037110230606_pdf(65KB).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164797f3-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089918, "uuid": "b4772012-2a9e-4c39-82d7-6d60b5f786b8", "comment": "Malware payload (Mirai)", "value": "3e7f5f30551763ef241a0115d3b22fcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089918, "uuid": "1df96f1c-75f8-4449-a3c3-82f522c26d64", "comment": "Malware payload (Mirai)", "value": "99dc42f85ff53f43bdbe132fe3fe5d847e1a6190fe6bf502bebf830954479075", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089918, "uuid": "2a2177f9-4712-4207-af8b-6b2eeefb474a", "comment": "Malware payload (Mirai)", "value": "02cbff65789d25241f341fe3db258cfdfc612bd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089918, "uuid": "2badb60c-5a61-4428-b1df-478fd329bed2", "comment": "Malware payload (Mirai)", "value": "bd9d9e41312b651c63e0c34dcb2cdbecfb54848fc403d0041216a204fc38b323d5f55c9adf1e8be31a09d1f65a6c1883", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089918, "uuid": "11153903-92a7-406e-870f-c5028642ebf1", "value": "T14A53F755B8C19A26C6E423BBFA2E408D332563E8D2DF7207DD226F11778A81F0E67651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089918, "uuid": "71fe397a-9ae5-478d-86c2-d1b87d94eeca", "value": "1536:Rb3IxOmenb9z7BhL8KFVUlCmycIJAt56UBJLUa:Rb3Iibx9XU0eTb6UBJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089918, "uuid": "f4e8389a-cea3-44bc-80d0-47a6fe4f69a8", "value": 62660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089918, "uuid": "2cdc7ae3-0d42-4cfd-81ba-005871668dbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089918, "uuid": "c23e5efb-d086-42a3-b2bc-a542ce138b81", "value": "3e7f5f30551763ef241a0115d3b22fcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506791a8-0457-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686048355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686048355, "uuid": "d046fc52-3248-4613-8aea-8d905107a4db", "comment": "Malware payload (GuLoader)", "value": "83feada9a3286828aa97e58014dd0750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686048355, "uuid": "8ddac85e-be0d-47d6-9cb7-37e84ee84670", "comment": "Malware payload (GuLoader)", "value": "9a128d7ba3cf8ed1f2aba6a777a44cf9580376cb8c2f44c5cc139fad08399f20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686048355, "uuid": "faba755a-239e-4b50-85d7-c3d02305f541", "comment": "Malware payload (GuLoader)", "value": "86124ee8bb31d7bead2472234d4cafe8f19b5f25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686048355, "uuid": "2e8b08cf-000f-422f-90c4-ab5cd2be4088", "comment": "Malware payload (GuLoader)", "value": "75e70d58314761dda069091d849b1fecc3bb302be8addb2058ac2b203f289d540c061544a918b2808922cc2ef2b60f11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686048355, "uuid": "b5f539e9-d043-4264-beb5-82c89bab77dd", "value": "T14084020478A0C723D5AB0F708D7A436A2FE4FC625C35A94B5F22FB5E3D32650553A726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686048355, "uuid": "be69527e-9980-4e7e-a5ce-10ebd3da887c", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686048355, "uuid": "1485e54f-cf33-4eba-ac71-c6051ae0b843", "value": "6144:NIw3EwpCSb69ZYNDuvH4zdEFa70ij9+ThwjKvpNwYH3JdPEnNi9eRDVFkC/TlO5u:gSbqaAoduu0BtWOpN7X/ERDJQ5ygA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686048355, "uuid": "9e9c7104-8740-4604-8f28-d7d45f19f2f6", "value": 388494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686048355, "uuid": "a9f44434-cfa1-47ff-8085-c7be0b6f3210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686048355, "uuid": "9e90991a-e35b-4c5f-b78b-8af217183876", "value": "EXTRACTO BANCARIO.PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442fd44e-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686089995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089995, "uuid": "54fcc30f-f3f0-48f6-a065-ff19f6a21425", "comment": "Malware payload", "value": "10b337ecb054da0a410738f56bdc256b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089995, "uuid": "12c4c48d-c160-4dbd-a269-851a05d74789", "comment": "Malware payload", "value": "9ccbf2987eab8a9f6a21769e9ca374dcbee75f72961fa8c31e30a677a9e87e69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089995, "uuid": "0c9f270d-0457-4f42-a848-e7f03f2e2f94", "comment": "Malware payload", "value": "ea81257ab5f39f25642fd9d893ed927b65e95a35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089995, "uuid": "2d993cdb-a093-48bf-8d1e-bfafb86015e6", "comment": "Malware payload", "value": "bf054ee7dcc8d5877afadcf02f80d74c02e2e9bbcc5f04df41b5594ff46098cdc65586576a4e2df3bd1c8a12e095500a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089995, "uuid": "5912ee99-d702-481c-8fe8-c433f29ee9a3", "value": "T1BC73B516BF650FF7EC9BCD374AA9270529CC650A21E97B367934C818F24B24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089995, "uuid": "fab155fc-b64e-4053-82d9-0d6db38ae698", "value": "1536:QH9f+jwn2CvmrQqFmtzwEnb3NYEZQPHgAA8:Qdf+jwLmrQFYEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089995, "uuid": "a5d4a960-3663-4d04-8042-f4441afa23ce", "value": 80488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089995, "uuid": "d66bfd21-e919-4ec8-9e48-821cc516d4a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089995, "uuid": "73495fb3-cd56-413c-b38a-117a91ee7f42", "value": "10b337ecb054da0a410738f56bdc256b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3a2bcc-0467-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686055386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055386, "uuid": "f5ad4a7c-a941-4fa6-95bf-59f13860a3a4", "comment": "Malware payload (AgentTesla)", "value": "63c33c64f59e1936f69c43877768c568", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055386, "uuid": "afe87095-cc3d-40a9-83e2-444340f1068a", "comment": "Malware payload (AgentTesla)", "value": "9cd47c4593254f37eb5bef6b0d887f7132ce6d9678af33799da736d6073382fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055386, "uuid": "0c3dbf9e-c674-491f-b911-d52ef42b92d4", "comment": "Malware payload (AgentTesla)", "value": "de4eaad10a7c7bcd5f5e52d293c425ddb68b276a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055386, "uuid": "2ae8610f-4d89-4844-b283-7d320f706a16", "comment": "Malware payload (AgentTesla)", "value": "7531641de5bb982e3688c4ce89d06e6054ac8c4efb3da9951d8e5a927692b5a46f0e66554568c02c6a7687574f3bbe3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055386, "uuid": "43c8fc28-d230-4427-994b-1cbe64272b41", "value": "T145E4021853FD4659E6B713BA4BA5533493BBFEDA7A30E34B0E42B68E1921F018510B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055386, "uuid": "4e9f3a31-56a2-48d8-bfa1-d91beb91a58b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055386, "uuid": "16923110-1d12-4d0b-afe6-a3418c5e85c5", "value": "12288:LsIduC2iNfmFx2iqNhujGjUqB5G1k1caBQ6GefZGbXcUxp2XIsgsw:LsIduC1lmFxU/RGeIb5D2ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686055386, "uuid": "3641955a-b1f8-4416-b7b2-29bd90694747", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686055386, "uuid": "be3443d1-76ee-47b5-bf54-eff3e69fb3af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055386, "uuid": "5f9a89c0-f5be-43c1-a85e-eb37e2a366c9", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f1dbee-0450-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686045517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045517, "uuid": "08c67c06-3c84-4d74-b4a1-9b16d5c2c6c4", "comment": "Malware payload (Mirai)", "value": "4db547a13530ffc8fbd61e968b574bed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045517, "uuid": "3cc869e7-b2f8-41b5-8598-069fb10e4d74", "comment": "Malware payload (Mirai)", "value": "9dc30a5f33892dd35c1f2fad44c0e17a70d80be407e50401c3a2684c4103bab9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045517, "uuid": "719bef77-e201-4ab6-ade7-c6e164646c3c", "comment": "Malware payload (Mirai)", "value": "e9248a68af71a9c5d39fa6a9e5a39b7636467d70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045517, "uuid": "80c5df25-63e7-485c-b03f-570a9f1cca0a", "comment": "Malware payload (Mirai)", "value": "3e84b6f95d5489d7cac17c41cd611b0c4ddc9f38e3ee7998f820c27a05ad681c6e3fe5e3cce89f4e183bde28e6c9a47d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045517, "uuid": "f1e10307-b301-4058-b23c-5e4218b354a4", "value": "T1C4F219D0E643E4F8DD290279E13EF33A6BB3F06A002DDE93C756D5635862A4C964328D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045517, "uuid": "b0da35af-1063-4c1a-b62e-53cf3de5ad11", "value": "768:435ICus9koZEL4A33vLDso6+4JeQGAkyplnplz:435ICuKkoZVAnzDsoQJeLAky/n/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686045517, "uuid": "df0fb984-a303-482a-9ebc-b416c9ac8df0", "value": 37648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686045517, "uuid": "9898f9fa-30e0-4e3c-9b81-1df02d1de717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045517, "uuid": "9c2d8714-c2ed-476a-9c0e-18ee706b7d76", "value": "K.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ca00ff-047e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686065039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065039, "uuid": "f30b4c33-82db-428b-8069-bec1a18c5a84", "comment": "Malware payload (RemcosRAT)", "value": "814c549027ffa7b070b8dcbdf94c3124", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065039, "uuid": "d97b234e-f7ed-47bc-b540-c71c70a79365", "comment": "Malware payload (RemcosRAT)", "value": "9ec972333e8ee5a045f432e0d9829a85b10361f717c57482c322d7077e237b3d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065039, "uuid": "6a162dd4-051b-4e40-870e-4f0fcb55b90c", "comment": "Malware payload (RemcosRAT)", "value": "3bc00c380c958fb225da0224ad8a90df6af8d265", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065039, "uuid": "5ec5b8a8-047c-4c9f-b352-9d398e8b5897", "comment": "Malware payload (RemcosRAT)", "value": "3763dece4e227fd5df92057a67dd297c99b8b635244e92e234806acbf58e1b2c70165342225df328fc8e7105ac3cbc63", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065039, "uuid": "bc78fd72-8212-4464-9dcb-a7139e013967", "value": "T101522B68D74F00A1CFA5A37B8326AA0854FCB73EB2459172B8AC837533EDD2D116647C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065039, "uuid": "230f719a-1bfe-4576-af07-f94522ed1f7f", "value": "384:NoO098d/Ejd0fyJXPTzkiQZ4/NpPFNkYsoY+qfdMV1l:tBd/ER0fytPTQi3//FPD/mWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686065039, "uuid": "225dceb3-1cc4-44ee-97b2-9dd97b931176", "value": 13511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686065039, "uuid": "6b8ea325-0cf0-4094-8e7f-21252e3865c8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065039, "uuid": "a56c4f4b-476b-4a1c-ade1-f6e697efedb5", "value": "orderXinquiry.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64ea2a4-045a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686049841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049841, "uuid": "1a55eb01-a0bf-419d-924a-68138d26ec01", "comment": "Malware payload (RedLineStealer)", "value": "c0f3f4d8c8bda00144794a92e08bd84d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049841, "uuid": "015f01f5-af99-4dd0-8198-4feeb4f0a229", "comment": "Malware payload (RedLineStealer)", "value": "9f00f5e381725660d4b5196d9f72c2a12b78db6ff2840af382f628b7b0095c05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049841, "uuid": "e20d205d-e427-445a-898e-7e07f472f0a8", "comment": "Malware payload (RedLineStealer)", "value": "d53cb672e46e339e27f1f70a5a6ef10ff84e9fb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049841, "uuid": "acc37651-2dcb-4ae1-818d-e3c6bba803fe", "comment": "Malware payload (RedLineStealer)", "value": "4d6056881c6dc11b35cd549eac24021649b7b731d6e7062d7d2d316fe4a1a0dd13608bb20f24579cb2d5ff48c709f8b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049841, "uuid": "f6cb588b-619f-48d1-aca4-4935beb9e0aa", "value": "T1EFD41202BAE49033DEBA277069F207C70B3ABD519578836B7785694F0CB3594A83177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049841, "uuid": "46c0289f-d1c2-4ed6-b1bb-2b4f172f3903", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049841, "uuid": "8f2761e5-4020-447f-a737-f80d7d7f4c11", "value": "12288:FMrEy90SJBwJ1RzrzzmycBB0KHGF1TqiWpsV5P:5yPBOrrzzmygYqVpsV5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686049841, "uuid": "dd53c3d3-14d5-4f71-8678-7eb8f987cfcd", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686049841, "uuid": "c3a6e1a1-2e49-4394-9165-f2c8a387423e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049841, "uuid": "41d8f1cc-daee-4b3e-b32d-41dc825c29f9", "value": "c0f3f4d8c8bda00144794a92e08bd84d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992c23b0-0415-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686020130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686020130, "uuid": "18360b69-b39b-428d-83c1-43f9025dad22", "comment": "Malware payload (RedLineStealer)", "value": "3638bba85c7aa1c64fb1ea26e6624a6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686020130, "uuid": "f2412e0c-49c9-4ac5-9d3c-5ae2064900c1", "comment": "Malware payload (RedLineStealer)", "value": "9f1dd575f894f515f33eb9333f22d2952fd8af16042395b63a6356fdfee3e8b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686020130, "uuid": "72c559ca-1825-4e64-bffc-132557c916ff", "comment": "Malware payload (RedLineStealer)", "value": "6058039284ed0f904ad47b4ddc49a87aff9d2e1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686020130, "uuid": "09d79016-df6f-4f84-a0b2-5cf5b546ff40", "comment": "Malware payload (RedLineStealer)", "value": "16942a11ddf9632ed07736953b2b3b3f91aba7e283543099d175a0881ec8296bc0e6f380df421a189f38e512760098eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686020130, "uuid": "fd6f627e-cd6d-414f-b873-27694134e388", "value": "T108D41282A6CC8073D8BA6BB01CF606E31A3BBC724D6897673755985E1CB1584B83177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686020130, "uuid": "548105e8-8665-4ebc-a3bf-00cdcbb6ae06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686020130, "uuid": "e6f6dee3-76f6-4b88-94c4-df07a3021886", "value": "12288:7Mrky90F3GrIOm6KzQzsCUu4GNZC8s/Uf5u68vRl4W:byu8IrXzGN4cC8ssf5u1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686020130, "uuid": "61c95c06-7886-42a5-bbb0-d7812ed6cb9b", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686020130, "uuid": "955232a0-43cd-4313-9fd4-63b40615d1f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686020130, "uuid": "d79409b1-36ed-4b9f-9f6d-1d0fbf572281", "value": "3638bba85c7aa1c64fb1ea26e6624a6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21c69f8-0454-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686047338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047338, "uuid": "6af0ae3d-6bf8-4a2f-867d-5fb89a8021c6", "comment": "Malware payload (Mirai)", "value": "ab0f4e20c86f5173e9374f59bbcea6c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047338, "uuid": "c0d8fd02-ad5e-4ebc-9b3f-1272ea6d5e4e", "comment": "Malware payload (Mirai)", "value": "9f5013fc9854c9f6ad7217c0d6f642ea6b1e880fc9d28308d6c595dcb4308262", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047338, "uuid": "b56a7c3a-326d-43a4-b4dc-8f9878e0e672", "comment": "Malware payload (Mirai)", "value": "7393fd7ee2084051fb4a95b1ca3362572ecacdc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047338, "uuid": "37bdd86e-14f0-4008-8ae2-4a07d2c024de", "comment": "Malware payload (Mirai)", "value": "e77639b35b114ab7dd4de1cab0e48c095de40f186bb304d3a4bf6449871eb1c64394add702862d90cc2ae1ef882fa77c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047338, "uuid": "ee1e9171-7b5e-4099-af81-b0c065682314", "value": "T163C2D07092ED2CB2C6500572E7B86AC97E434FBDFAFE3890114057FB388194529EA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047338, "uuid": "47a790b8-7abd-4594-ac8f-27568e60320a", "value": "384:AOt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEMqiGhymdGUop5hT:AWsoTAZ3alkXLvFh8nNEWGs3UozV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686047338, "uuid": "a6887798-5bf6-4ce9-81f8-c68e2ed6ebe8", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686047338, "uuid": "de187598-d963-402a-8be2-dff29b75081c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047338, "uuid": "ae01fab7-4275-41d3-aee1-eee78c208c53", "value": "ab0f4e20c86f5173e9374f59bbcea6c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ee6f70-04b5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686088713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088713, "uuid": "1cc22a01-0db3-4267-8258-68aa0e96a71d", "comment": "Malware payload", "value": "b89d39a218d75e45849fb14bee992d8f", "object_relation": "md5", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088713, "uuid": "d0ef8776-d796-4204-98cd-490554728f6a", "comment": "Malware payload", "value": "9fafaf1285386aae15a12881f74af53ff14b53d7c6dd367006b8c809ebfed8d9", "object_relation": "sha256", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088713, "uuid": "e03ee87f-7007-4ea6-92a6-bc13c974f47b", "comment": "Malware payload", "value": "daddbb3a0abe6268ae5a47c5129552e7e3dbc9f9", "object_relation": "sha1", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686088713, "uuid": "a23c4662-0cc9-4f7d-80bb-7df4fe9b0ff3", "comment": "Malware payload", "value": "5bd91d3df3d66514feecc1de74b8cf26fd770b9d0e7fd7785f72140d9e1141b3abe074b529d17d54dc53924e6ada7a7e", "object_relation": "sha3-384", "Tag": [ { "name": "5050", "colour": "#3964EE", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088713, "uuid": "e3459adb-5a49-434f-a49b-718bd85ddb4b", "value": "T177E4C4F49D1BFDD102B25CC65385E2929782BB10BD1A05E754CE0BA2177B781F6E30AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088713, "uuid": "7cf50443-cb85-4e16-9440-d0d367cdbfb9", "value": "12288:arSbdBpNbsXMSPS4TMykh7qg51sd9lsA6Xreb+UKGfQ+P49uGK7MUYQrchB73LoO:ar20S4mqc1szCArp0gYQaOJKLRap9Gvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686088713, "uuid": "67affb0f-2994-4270-8daa-f8e8524f1ce6", "value": 708449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686088713, "uuid": "5d39af02-2bde-4f17-af97-c9468df15657", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686088713, "uuid": "c5b34bd5-661c-472c-829a-99271b02e365", "value": "printouts of outstanding as of 06062023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd71482c-0469-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686056376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056376, "uuid": "05b03bfd-fe9d-4c30-945f-a97c785b19be", "comment": "Malware payload (Formbook)", "value": "19fbe04a23ba24b13c4c7bdd9fcba5d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056376, "uuid": "835698c0-fa4e-4338-934e-6c0d92dc5db5", "comment": "Malware payload (Formbook)", "value": "a022bc0ad88cce0b7ef8c68c7602003ff4150006503291b7ead2119ebdecb36d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056376, "uuid": "7a83ddc5-bf75-4788-aa44-9e1368ef7d0c", "comment": "Malware payload (Formbook)", "value": "979c3a2a6171794cbad8c36f52336f62e07348b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056376, "uuid": "2f6d11c1-945c-4741-b183-23c1e48e974d", "comment": "Malware payload (Formbook)", "value": "b1fde9459c3973df561e996763e68c5e039e06c592d66899a8d1fce39c7e73f472e2ad2709fe2f58af55e606b3297ec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056376, "uuid": "1999a5c2-b042-4b48-a957-be009c122254", "value": "T1A2F4122C23BB471EC4AB7FBD0D4055B9C3FA59987823D21B5FA3A89DCC19B150E86493", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056376, "uuid": "6dbb73dd-a963-4eaf-a0ce-3e0cf6872adc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056376, "uuid": "b8d048e5-a43d-4d3e-92ab-2763b9a40fd3", "value": "12288:+M+J/M+Jhewx/NscEQ+vgXK1HsaPyvoow2FOo2f8LcAFRYLs5MBQwEqZK/l1nrGu:+t/thewlqB6pk4oo08LcAbYQOBjEz7rT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686056376, "uuid": "fc7d789f-1a8b-473b-8ce4-cef43060e3a2", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686056376, "uuid": "90a124cb-c30a-4764-b4aa-de96eb22c32a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056376, "uuid": "524e556e-13c6-425d-9b07-56fcca0aac1a", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb098bd-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089986, "uuid": "84089d16-823f-463c-813d-580d1bc5665a", "comment": "Malware payload (Mirai)", "value": "f4297c22d7a71f3853c10a51adbae390", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089986, "uuid": "13d4d88d-7543-479a-9d3b-86ff3aa4c91e", "comment": "Malware payload (Mirai)", "value": "a04e90387327cc7070cf85159f6f29c50ffbe57d94e8dfc4405ec8e61178161d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089986, "uuid": "964ffb1e-815b-49b4-91de-c8aa74963ca8", "comment": "Malware payload (Mirai)", "value": "572738cf50ef34cf2a951c00c76c6b21b2f4a6c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089986, "uuid": "f7639d9c-8518-4065-b171-2574ae3b2678", "comment": "Malware payload (Mirai)", "value": "819b37ffe458de24282152826cd2486bd8b8e3d2ac2991e79750cc4445baf7ff87c5b8fdd75a784b687ef3987ab84f4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089986, "uuid": "edb564ac-0997-4a55-b38d-b799e0a2dac8", "value": "T146B2E1A1A1863E72D770213AB97CCB0157AB97F8A4F672753524B3AC4BD2C47647810F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089986, "uuid": "288f1d84-53ca-49ff-baa5-caf11756b63f", "value": "384:MZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdDHhymdGUop5hK0:nX1De9kONQG5xD+jHMDzuDHs3UozY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089986, "uuid": "3c2bf527-7677-404f-a937-9de87acb5d24", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089986, "uuid": "2a8d3442-9df4-46b7-abe5-ec7cf94d8b6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089986, "uuid": "7a0a0284-82c5-451a-bac9-bb623b8e9026", "value": "f4297c22d7a71f3853c10a51adbae390", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdaed5f-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036033, "uuid": "593ca6f4-94d4-4c1c-bee2-50d26fb054df", "comment": "Malware payload (Mirai)", "value": "1abb5fde6ac44df0ea05b0781c906232", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036033, "uuid": "e6aa6469-a650-4970-9d11-e056dd814a1c", "comment": "Malware payload (Mirai)", "value": "a0b1550044e160020380112b7d1d0a76dd9837e930b0ef9ed3f9cfb6b50bb5fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036033, "uuid": "8cf76d28-bf5f-4871-9659-a1d3775bd6a2", "comment": "Malware payload (Mirai)", "value": "b9c6ddf897be566e816e9d02acc89a001ccdc28f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036033, "uuid": "7588414d-90ee-4e08-9e1d-fff472c97297", "comment": "Malware payload (Mirai)", "value": "a53430dea974fbeb73e6afcb44759415f40183e8ef7a67a7a68224dac24cd63edb0c099b7d1c7bd8f0efae8aecb77ef0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036033, "uuid": "f09c0ecf-d862-44c4-a4e4-4ffee53c9df2", "value": "T186832B41FD418B27C2C327B6F79F47593B356A9457DB3302AA386EF42BC27891E29610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036033, "uuid": "6f64a64c-e299-412c-9e76-c735d94aa5a7", "value": "1536:oQveYIKnGHaEVNLOKGdHzBLnr/9sXPXBV3J7m9bqQ4a/U0XTQe:LaVKdHBnJsXPXBnm9bqQ4a80XTQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036033, "uuid": "32e62486-ce7d-4620-8c9c-1c63a1e99f03", "value": 84517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036033, "uuid": "bfcc8991-7b8e-4a14-877b-bfbb47cab821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036033, "uuid": "4f604b64-47a8-47c3-8571-ff64b5aadf4d", "value": "1abb5fde6ac44df0ea05b0781c906232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c9979d-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036128, "uuid": "3dc809f1-929c-478b-be6b-faeabcc4a326", "comment": "Malware payload (Mirai)", "value": "b7a6e0a2739fa546533f50321278f7e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036128, "uuid": "608beb12-7119-489e-8c1c-cd4635f7127c", "comment": "Malware payload (Mirai)", "value": "a267aee6e4e98991bbdbea837d2c3f1b7806633528c7e7dd1c2e002f0ffa88f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036128, "uuid": "15f2354f-a1d4-45a3-9422-6ee573d84565", "comment": "Malware payload (Mirai)", "value": "83109c32221bcde2d2ef9f430f85f60f2ace0850", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036128, "uuid": "0f43df57-e57c-4e77-84db-0121bdc838a8", "comment": "Malware payload (Mirai)", "value": "7ae29bd24c31dbfcd8e0c6737798a6a4d32f7c9cad344fe2a624e99050024f366b283cffc0bfc6b173b0f9eb82816944", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036128, "uuid": "2a351b78-02e5-4854-86c0-99813aa5933a", "value": "T1A3734B03B71D0B53C19B6AF029FB2BF18765F9E126A77180B11EBED41772AB02412F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036128, "uuid": "ce09ade5-adae-496f-ab71-413a2d09c16e", "value": "1536:D06QZ1omNxhnwd2nI5pHOFUSHYtLHLB7a7Xjd2tmrKVqmjsjf5Je:/6vsYI51OmwL56mrKVqmAjf5Je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036128, "uuid": "f9ae4df3-5555-4f0c-a649-21e9a55fbb00", "value": 80113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036128, "uuid": "d6cb03be-936a-42f5-b9e5-a97b352e952e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036128, "uuid": "78180119-c22c-4bc9-be8c-6df368a627c1", "value": "b7a6e0a2739fa546533f50321278f7e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07606e8d-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089893, "uuid": "7e8fb456-c2e6-415f-b6df-208d2b1463dc", "comment": "Malware payload (Mirai)", "value": "2ed9dab121d2cffc9a342acc3247763b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089893, "uuid": "6d70afdd-d36b-43cd-8af7-0175f6631596", "comment": "Malware payload (Mirai)", "value": "a2a4e261c540fe211be4da7442e4750b575df6da6635ad68e96f5f843ad9d301", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089893, "uuid": "fa989f5f-437f-4753-b36c-4d6e2be0c32d", "comment": "Malware payload (Mirai)", "value": "a4edd5388b7e94bf4c45c49be09c3effe962cb4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089893, "uuid": "d52a1af4-ad41-443b-8000-b6217c13f499", "comment": "Malware payload (Mirai)", "value": "a6de2bf64364ff133881c02e878191e048f2b80362200767c7e9065194a2b68145f6d13372512e173ecfc61c76bfcc51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089893, "uuid": "19d8b3fa-78e5-41ca-95b3-e6e59eb1c413", "value": "T1D3538D75D12DEEA8C0424AB4A9598E704F13A0C046733EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089893, "uuid": "26d7456c-0380-4bb3-8852-2b8a11e8d698", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089893, "uuid": "f9f5ae92-582f-4fd8-b6bc-b435cf8d5531", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089893, "uuid": "ef4bc38c-c052-40a7-ba03-53add2c6ca67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089893, "uuid": "5c0d4ef7-aa34-4a26-a071-71db8999668a", "value": "2ed9dab121d2cffc9a342acc3247763b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff177e8c-0450-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686045641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045641, "uuid": "6b466bcd-8d47-4555-8e9f-8264728d38f5", "comment": "Malware payload (RedLineStealer)", "value": "9ccd9cc6c2e3fbf4d4b4577c7b207d96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045641, "uuid": "f9b26962-32b3-4640-a9ee-bef383dcdd58", "comment": "Malware payload (RedLineStealer)", "value": "a3635b054acb399ff8719c53c3503240f582ede2976387331cf87901907993d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045641, "uuid": "7c5cc90a-baf5-40d0-ab95-ac5402ddd9ed", "comment": "Malware payload (RedLineStealer)", "value": "4ec412a532f322f3940c96568a3b3ae56468e54b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045641, "uuid": "9cd6bbfb-e1f2-4e12-b7f8-3b6f7302a87d", "comment": "Malware payload (RedLineStealer)", "value": "ffcc29c9c8a2d79489cdd8e53950fdb6a4f500664e0553942f514f22c46d1e85c9f4cb9d2767c53139266421e7845eb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045641, "uuid": "ab2ea7f6-febf-499c-9053-3f7bc44bd918", "value": "T1B1F41202E7D58072DCF95B708CF606930B36BCB28CB8961B67526D5E0EB3695A47133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045641, "uuid": "036732a4-5dd2-4cbc-92bd-2f2f444b1489", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045641, "uuid": "03fb1407-c1fd-459a-95de-a002e4fb5e24", "value": "12288:IMrSy90moG1w368E7A5PJ7BJSm5pXAkWkGrU+FV3/4q1LMTlNJ8mq+e5fB2Z:qyvoewK8Z5PhJQVXrU25LMTxhq+EB2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686045641, "uuid": "1a469816-2d77-4079-8184-5c42fa502d15", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686045641, "uuid": "83af1777-ecc8-4a71-b369-2c18f1cc84cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045641, "uuid": "9193835b-490b-449a-bea4-7228481d3357", "value": "9ccd9cc6c2e3fbf4d4b4577c7b207d96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78474c4-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686054541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054541, "uuid": "3088e9c3-073c-4d58-9501-16a14e9e8cf2", "comment": "Malware payload (Mirai)", "value": "6ba1e294f1e19d4abda24b3ec23ecf4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054541, "uuid": "7a175d7e-03d9-4e72-b5b3-c98122e359ea", "comment": "Malware payload (Mirai)", "value": "a4d172dd2e82f8f3e6cc701f97689b715d8d1c043af9d832c59bc2e1c58c4b76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054541, "uuid": "2d2737cd-46aa-4f2e-a408-e38e5d288708", "comment": "Malware payload (Mirai)", "value": "b6ee55e375cfe539d57a4ed0da1b03bbca6e0276", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054541, "uuid": "fd482a10-407b-4599-9c17-8d0731259e04", "comment": "Malware payload (Mirai)", "value": "661e34c45f9a56e8afde3e2e30736b8080518c369146f8ea599c2bafbdcce6feb70492e8e0c675b2377530c536a127b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054541, "uuid": "1a71ed32-02dc-4e9b-9e2e-cbee7d26e821", "value": "T16BF20965A8813A6BC2E0937EA6EE518D33B477ECD1DB3226CC111A15778161F0DA3F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054541, "uuid": "5cf792ad-e648-4a10-8bb3-8ad06b90eca0", "value": "768:OPGXBI/axd9lTKOqjUNd6B9nHjC32QaMbbrd:+/SdKcdQU32Qam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054541, "uuid": "b859f003-b073-46f6-8572-86d1ac4504a1", "value": 35672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054541, "uuid": "d7b7a0fc-72bd-4f8f-a020-3991371555cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054541, "uuid": "10b5ab6d-c176-4b1e-85d7-60d5e3b5135a", "value": "SecuriteInfo.com.Trojan.Linux.Generic.298872.2942.7439", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42acdc5-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036120, "uuid": "2dde88cd-efd2-46ca-b10d-fd6d9b02dc00", "comment": "Malware payload (Mirai)", "value": "59f6d397e155570eaaa304012738981d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036120, "uuid": "18c20e5d-ecd4-441d-90f8-279da5218fa9", "comment": "Malware payload (Mirai)", "value": "a507c52d304d1665eff458d6e97b68ddaba008a5c64d0a85eb4b8db77f6838c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036120, "uuid": "630e1a76-07cd-4f96-8e30-539a4b8dcbcc", "comment": "Malware payload (Mirai)", "value": "bee959e4b58e2a2911256329757a7adf4447375c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036120, "uuid": "af559981-8da2-4d83-b870-0cbbd31c3b25", "comment": "Malware payload (Mirai)", "value": "e8c9ed8b7391d063a57304304d8c639e36faecee1faea2f792d2dc852b811f44ca795918bdb03d35856f5870f6ec1765", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036120, "uuid": "7d54fad5-f954-4ae9-8792-56e35f961494", "value": "T156D2E168130423BDC97A90FD176707943DB58F35A083EEAA61C1FEC5ED005E439A3AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036120, "uuid": "f7a42e6d-753c-4b2a-a502-932fcfa5f7cf", "value": "768:dyvYLznDEB2iC+sDqC6NtxsfzxPnNsGb7yx1XIJgGlzDpbuR1Jv:4YnnDEBI+smATf7y0VJuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036120, "uuid": "0dbb7819-b387-4dcf-b85f-24ebe970e393", "value": 30840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036120, "uuid": "626da861-c413-4ffc-8ffe-ff329b081559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036120, "uuid": "3775dc6f-6676-4c37-bc89-b70e0bd75506", "value": "59f6d397e155570eaaa304012738981d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3267bb-046c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686057637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057637, "uuid": "29209118-ca91-4014-82e9-b6f4cf691a8b", "comment": "Malware payload (Smoke Loader)", "value": "dc076ed6da7792af479120129fad2716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057637, "uuid": "fd1cba12-da79-4fee-b153-7900e3384d61", "comment": "Malware payload (Smoke Loader)", "value": "a51b880c04fcc66cc1c561b3b490b04db675f2775bbf1dfc299572d2401e706d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057637, "uuid": "caf74da3-1cc2-42e6-b029-bc0de841a853", "comment": "Malware payload (Smoke Loader)", "value": "5950886a02ed459d9ffa92b98a1c4b0462e0de88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057637, "uuid": "662d8295-83e8-4dd8-801a-1d8ad0b33aa6", "comment": "Malware payload (Smoke Loader)", "value": "1352059e7cbe3d6b84796422bc4b49e877fbb8680920e96884c81ca30a9b341497382bf746c0f62a09a1a392d568ea8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057637, "uuid": "ec47e5c6-a0f9-4ac1-935e-80cb4c56bc58", "value": "T16A342B0393E07D64E5294F3A8E2EC6EC775EF6518E597BA522289E2F04B01B3D1B3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057637, "uuid": "ecddfd4e-dee7-48f8-9e48-1cd40e908735", "value": "0af0c6e3fe2b48c822ae2dd664bde01d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057637, "uuid": "34d5300d-b240-49b7-876e-cbbb29779439", "value": "3072:zfFQgZdMFWaC7RMgxSMGyfTuyyHM3IZcY+5wxv+mG+O3VKdFp7CnYTRqKV/c:zFQkMFxhgxSMGyyLUzSR+1+GXYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686057637, "uuid": "10b668ad-9d5c-4969-9558-c4dd2a0f9e47", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686057637, "uuid": "c8716a66-bd7c-4f72-97cf-11d8e89537ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057637, "uuid": "3fb46a5a-6d50-41c3-ba4b-31189916a4fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92d779e-047d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686064905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686064905, "uuid": "110ef920-e63f-467b-b95f-2075b98d6711", "comment": "Malware payload", "value": "80c6b04e085b473c4d18a412bd7efde9", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686064905, "uuid": "3417030b-0cc6-4e6a-9b25-242bb731f9f7", "comment": "Malware payload", "value": "a66857084d0c762fbfcf295b9eb96a27986146a25d55eb05a3a90604c729278d", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686064905, "uuid": "4d045d0a-7288-42fb-9cde-8ef46bc686ea", "comment": "Malware payload", "value": "7f1a9d23f825f3d8c6dc7f34dad3922cee679204", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686064905, "uuid": "d340d8f0-3a1b-406a-bcea-071ed9bf5e89", "comment": "Malware payload", "value": "ab2c1fec04f18f5b259ffcfe8c248ce7e5dd865eacbb27e240725037e850c30078199f2f893a8c8f69a496676496a5e4", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686064905, "uuid": "b67131a2-3d12-4f4d-b7a3-9bdb5a5c64dc", "value": "T140D022BE031AC2B4D789A4000264BC80A80A388B88D9E95523D1DDAC7C940C68AA8AE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686064905, "uuid": "a27678ac-1ab6-4dc7-8fb5-9fd1c17be5fa", "value": "3:J25YdimVVUTydaQFd2mqRAbABGQZGQsG4vnKLxtdggFtdOLHK0hpBKvQT0rKEgGJ:J254vVUWdSRYFeJ1nd3zkrpshf3Isn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686064905, "uuid": "d069d1b4-5538-46a9-9150-7e11941e4084", "value": 198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686064905, "uuid": "47f2de33-6765-4269-84b2-9b1d468485b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686064905, "uuid": "c24fc77a-737d-4908-b921-4e94f0498c2d", "value": "FACTURA_PDF_XML_173691.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4125cda8-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089990, "uuid": "85fe37e9-9213-42a3-9e01-cb0dd7886fdc", "comment": "Malware payload (Mirai)", "value": "e16a289938ad4a616ecfbe31e97bf809", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089990, "uuid": "cffe9483-af11-497a-a4e3-ae037609681f", "comment": "Malware payload (Mirai)", "value": "a6aeeb2892336768cf83d7a0d3029d8ee23d7ff1c15062546d9c42fafabafd72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089990, "uuid": "a686cd47-a935-4b78-8e2e-377c9a361dd1", "comment": "Malware payload (Mirai)", "value": "beb44187dbbf32cd92d363d994c79358d09bd255", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089990, "uuid": "e611c6b1-58c7-4e2f-9d47-efae142e2430", "comment": "Malware payload (Mirai)", "value": "d879a11e3e9021da648d0b9de175435f32705223d163723bd71145cab04b05f6caaf1a0c8642f6f271b794ea260edeee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089990, "uuid": "8d26eb59-490e-4da2-ac6e-c6d6f5cbae38", "value": "T12FE2F111661A847AEB30C471E0F682827B691FBC79FEB0A64466064DDCC2A4253F16DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089990, "uuid": "0978b0f0-3d92-4593-b4fc-fa6702040e0c", "value": "768:YEKkUgXAnURCr6HmDFStmYt3Hc9q3UELdw:gkEn7uHEemiHlLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089990, "uuid": "0b550196-4642-43ff-ac6c-dad1066d5815", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089990, "uuid": "4cfa396c-17a3-4a53-9f05-f1827bb5b5dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089990, "uuid": "1b3e0e40-3a7d-4c2b-95c1-5c211bbe2d4b", "value": "e16a289938ad4a616ecfbe31e97bf809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc03ad0-0436-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686034469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686034469, "uuid": "a2192576-17b0-4012-b706-6ef7748ece70", "comment": "Malware payload (Mirai)", "value": "e4cdb4748816e2bb1747d0c4e32a0deb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686034469, "uuid": "6091a869-6e25-4b57-be23-3a7305204edc", "comment": "Malware payload (Mirai)", "value": "a7ae35ac989420e6cfc4ede1b88eb72d0484b13a93e911ddcda7f71250d66c48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686034469, "uuid": "736ebda5-b489-4c54-8813-671db562e5b3", "comment": "Malware payload (Mirai)", "value": "4b0a2c9293d0353028fbe240860893088722059f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686034469, "uuid": "465e285d-1f32-4ae1-b587-67c9aae35d5f", "comment": "Malware payload (Mirai)", "value": "0b49ed0ef4376e038597c8f1663c264bfc96b71289c7ba58e02a100927321cb7638499fea8409298683c7154ec44db21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686034469, "uuid": "fece84eb-db8d-4292-b23a-4df123240871", "value": "T116D2E1B59EBA474EE4CA373C9D9EDCD925ACBC641FB9424906011E5331395D1A7D8CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686034469, "uuid": "bb8c09a8-fe03-4370-ac0f-75fe5f3efbd6", "value": "768:fN8fWlfoQmQAXV7EmQciiRcLprDKYSCAZRqu:1MNXFl7zN4PvqZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686034469, "uuid": "9c141b3b-96f8-4fbe-bc47-2b70fc3bb859", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686034469, "uuid": "e23ce449-b7be-4045-b120-ead615a855e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686034469, "uuid": "707401b7-b939-41ad-89af-4cd124654802", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b557263-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017745, "uuid": "1c39ef6c-8e2d-4080-b78d-775a35ec7d2a", "comment": "Malware payload (RedLineStealer)", "value": "c7bf75dc5395e5623f80df6f9080632e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017745, "uuid": "212517b8-3f6d-4252-a721-1d6e3f4ff9fd", "comment": "Malware payload (RedLineStealer)", "value": "a831f4abfb429b97536aa52605d5e7405007ea5b2af185e6dcee9234c21804cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017745, "uuid": "8d068ea4-0d4a-4c76-9881-2bd0a74f6e4b", "comment": "Malware payload (RedLineStealer)", "value": "a376dabda615aed4258a5c88e5360b84b71271fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017745, "uuid": "e7b6163e-bf47-46d0-a884-0ea14142eee9", "comment": "Malware payload (RedLineStealer)", "value": "4121a828403a564c906e1196d78d4994336d4400bc8eff31f67c56f5b32759bb51ae41448c08076351c33310dadd35a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017745, "uuid": "093bf3c8-0bf2-4fb8-a47b-bdbedfebcd88", "value": "T178F4230AA6E84572EDB8377068FB02D30F35FC215975875F6759AC8A0CB31C4A07276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017745, "uuid": "780c5770-d1b5-4581-bf6f-c713bafbcf92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017745, "uuid": "2dd9eaf8-800d-4bc5-b5ab-fa77f6225b57", "value": "12288:VMrKy90GXkxlINahTNCrvxyekItxPZ2sxMKyhH/sq0snucYgpp//NcdG:TyP0vYauvxDkIJ2sxM7hU/cYgj/NOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017745, "uuid": "30998903-97ae-4d73-9d57-73b701e1cd2e", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017745, "uuid": "c9c6431a-b69f-470b-b0cc-6e104783588e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017745, "uuid": "1627c3da-efa7-462e-b290-f2cb7aca640e", "value": "c7bf75dc5395e5623f80df6f9080632e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb83a08-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036111, "uuid": "165a6cf9-d57e-45d8-997c-a40466d91eb6", "comment": "Malware payload (Mirai)", "value": "36334af33323cf590ef1039af728bb58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036111, "uuid": "ed2113c4-4e42-43f9-a237-8e466e891802", "comment": "Malware payload (Mirai)", "value": "a86b3161e2baff34b0a6ff00b53e58a28cd24f2d7ac22e7560928668a5dda05c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036111, "uuid": "f8f08747-4b1b-4f59-bb90-4e004ac39388", "comment": "Malware payload (Mirai)", "value": "cecedad66f3b333edd41c09b41b07514a99d21f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036111, "uuid": "b91e60b1-ac38-4cfe-98d6-14970f216ed8", "comment": "Malware payload (Mirai)", "value": "878a0164ea7d0223d26874b7d899cb93bbb430ce31979e67f1463d4d6d5a35d5694fe02b186035a2f870fd6fe70f28e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036111, "uuid": "87ea7e06-7934-40fe-a270-3db859189a42", "value": "T17F633902F642CBB3C4830AB512AB9B264A31F9AA5B179F46F32C7DF45B430C93526B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036111, "uuid": "69bf5835-2570-4e43-bd6b-4c6d49b3c836", "value": "1536:tHWhBsiyl/i3dEBk30WAu1ThMjAFmFIXVOJjAxfITk:tUBsiyl/itEIp9R7mWXVOJkxfITk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036111, "uuid": "1bb91d05-cc14-4e96-b3e2-0db7ba76e131", "value": 69048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036111, "uuid": "44cb2c84-7c92-4a18-98f6-d32f1b5820c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036111, "uuid": "d2168b29-f4c4-4766-85fa-f2137351da70", "value": "36334af33323cf590ef1039af728bb58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a09a2b0-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686089952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089952, "uuid": "56e382df-e882-4640-b4a5-7a5baf3535d4", "comment": "Malware payload", "value": "2d9d3929c9b925613c7bd138a98446f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089952, "uuid": "2eb84c04-22e9-461d-871e-adfa3fda9d49", "comment": "Malware payload", "value": "a9e99064e755681a1982f98194e59ccc9a585858091c26475c0639af221c0c49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089952, "uuid": "cb57cd5b-abb5-45d1-9875-758a3423863e", "comment": "Malware payload", "value": "016c6981d34b24acf01b71c6d103b2ebce31baad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089952, "uuid": "d9ccfd35-939e-4af5-8395-be5637aed312", "comment": "Malware payload", "value": "1507ef8d563df1669551989b50a49c8b54ba741573f3a4734aac27289f44a14eb4a4993386b54cecc06e85a6746c52ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089952, "uuid": "62aed155-4a38-4344-84b1-d4183b748d30", "value": "T196534BA5FC01DD3CF98BEA7EC4120A05F63033A555D30F2BA26AFEA36D721A45D16D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089952, "uuid": "20f2c309-bff6-4819-9a03-f18305f98494", "value": "768:dvebrZrFnHEBha6MOe9bkcVMPHk7NR3k9SuIQEnx0JBwA1Tfd8dOvB:BWrD0/DjqMsQ9rIQy0JBz1TF8sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089952, "uuid": "cd6fef90-2cee-45fe-b64e-80d2015ed72c", "value": 60772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089952, "uuid": "4a45207b-501d-48b3-8cb7-d79196d1ee33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089952, "uuid": "d04655dc-3c2d-440d-8b5d-3700b1712ba7", "value": "2d9d3929c9b925613c7bd138a98446f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be542536-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036084, "uuid": "671eee6f-088a-4754-9e31-7a9047418afd", "comment": "Malware payload (Mirai)", "value": "e07a0f1a73686a819dd3b4dc6c5bf428", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036084, "uuid": "4229af27-bbcd-4756-a8e9-b0390ec5e10f", "comment": "Malware payload (Mirai)", "value": "aa006daf9e81c0b7feba290e52fc806bdfe6ae6b4659fd799dbb02cab453506b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036084, "uuid": "9a556622-02f0-49b9-976a-854da58dc488", "comment": "Malware payload (Mirai)", "value": "7e81d2c2da4d1d4721048118479bf6f6ef5d8955", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036084, "uuid": "eca053a1-be68-41e7-b324-36942252dbff", "comment": "Malware payload (Mirai)", "value": "7fe1ca7c875d41633e45d48b764660b95ff7aad32c21f7430842146270edfbd87192a4decbbf70559f65142639658d99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036084, "uuid": "57e45329-30b5-4140-88bc-b2834b61f7ea", "value": "T157332A8A64112E6DE9DB5CB981764F0ADE541220B093171FB3BBFEC33933264EE66449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036084, "uuid": "05f0ab59-c049-42f4-8d48-7b9531921e16", "value": "768:0aOTrZQlDVoueg2me2nPQCHEM/ArPwqLWH02TCmhPol7gSu9+f1prN4n40ezi1:0alDoRg2mew4ChAVLB2Y7gSyg1ppW31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036084, "uuid": "7b838af9-ab0c-4f29-96fd-756b9618efd4", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036084, "uuid": "06ffb996-143b-4126-8fc0-f2a0afb32d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036084, "uuid": "af744288-4feb-436a-87e1-e4fcbad2be99", "value": "e07a0f1a73686a819dd3b4dc6c5bf428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e49a219-0464-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686053827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053827, "uuid": "fb3fb650-2876-4c7b-9c4c-a7e6ed8b8846", "comment": "Malware payload (Formbook)", "value": "31930b852a0dab485216f0bdcb20ed11", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053827, "uuid": "0aaa0499-e691-4f7c-b2d8-f5a4d1e06361", "comment": "Malware payload (Formbook)", "value": "aa00e748db247fd785a6f6c6a1afac037e605e50a43c0b7050d98b607cd8a41e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053827, "uuid": "9a8a7bc3-2bc0-448a-abc8-43aa896fd9b4", "comment": "Malware payload (Formbook)", "value": "7fb1a3925da0aa8a2104e92dc84815d0fb5956c7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053827, "uuid": "13250e3c-adfd-414b-993a-f968e57efb26", "comment": "Malware payload (Formbook)", "value": "52a957b4f746f739f3f757154bb4503e647c52437a03c3f9298233f8b92ab662cd74d1b948ad9fb9b8906fe81a7eae4b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053827, "uuid": "29950c46-080f-4d4a-80f5-122e93bd104f", "value": "T10AE4239A28C2FE861F82C0864E1FCE97B32A90371A175A1B646CBA05E7156C65D23FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053827, "uuid": "fb5d82e7-a3b1-4cae-9d14-c308ca3fea5c", "value": "12288:hHBK7Wu7TiBZRE2Iwn0YpBaTGiRqS+HJGE/OI+59esGcgDWd2yihZ5A8K+K:hsL/QdIwn0Ypk7RsHQEni9fGcgcuDA8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686053827, "uuid": "938fd4cd-02aa-4f0d-b25b-0ec890c3141c", "value": 666512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686053827, "uuid": "fa7b08d2-70a6-48a9-b6c3-b9b77008c690", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053827, "uuid": "258957ae-0393-4013-b600-27f30d0797bc", "value": "GRANULATOR MACHINE - URGENT REQUEST FOR QUOTATION - 808923AC Viet.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81b5d4d-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686054542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054542, "uuid": "4b567ab2-a286-42ff-8cb1-38e1c463499c", "comment": "Malware payload (RemcosRAT)", "value": "582bd6f5d1720c34d07ea51b37b0a15d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054542, "uuid": "d3388aec-5ad7-4d6d-8493-0f631e30c6f6", "comment": "Malware payload (RemcosRAT)", "value": "aa6646da5d47bbfffce88075205a5e6c1af6107a9dae7dec98b14e7c3d022219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054542, "uuid": "2bfec2d0-9f22-4ba1-b821-5cccd1030bfc", "comment": "Malware payload (RemcosRAT)", "value": "5895b3f88e335c9884d740bcf8f2965d8aba286c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054542, "uuid": "4ec57b62-c929-4bce-a31b-3428fdc50be0", "comment": "Malware payload (RemcosRAT)", "value": "c4c8f631493a4e3ccd151c0db5ac3934b12909240b184863530d3bf4cf75ebc33c23b69aeff5392376870bd5f9bb502f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054542, "uuid": "796d49b9-f225-4dfe-ba1a-ead4e2a6904d", "value": "T124025C15A7588737CDB207B2B87393801631A34D296BC76F4844902F9F533918AE2BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054542, "uuid": "34c9e40b-bbdf-43e6-87e5-b287f8819481", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054542, "uuid": "b461b9c4-66b5-4797-a085-24989b69bba2", "value": "192:DyqfXcLYLbPdblLgdSOpoKL49Xi2q1AULmAFTIx:DxfXcLYLbPdblLgdSOpoDPYJRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054542, "uuid": "8e7fd9d8-aab4-4dd8-8613-ce40479eaee0", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054542, "uuid": "87b03a4e-3c42-4769-806f-63e2addf75fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054542, "uuid": "2553939a-f623-4665-8650-d04143d20019", "value": "SecuriteInfo.com.Variant.MSILHeracles.84870.1065.31623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5f2d38-045b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686049985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049985, "uuid": "38ad246e-1785-4de7-8bc2-8a079b086134", "comment": "Malware payload (Mirai)", "value": "2a9f304465d0001dd751338c416fc385", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049985, "uuid": "2f38e274-973c-40fb-8ad8-9cc1be17c4ba", "comment": "Malware payload (Mirai)", "value": "aac65700c20941ced7646f6dfd2f90650d5e6adf90645648653cc4e1143df8f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049985, "uuid": "66eb9c5c-f5aa-4031-a21c-8dbedfe445bb", "comment": "Malware payload (Mirai)", "value": "f60d690efc1f2f2ef0100f898ca7c524970bffb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049985, "uuid": "80975d78-bd37-43a1-90a9-a8d78224ce59", "comment": "Malware payload (Mirai)", "value": "c046d4c28e69fd9b6251677ac3c53f2bb758a8544cdaade398fe43f6dd7e72d10d257edff53ab85d1d1cf0835a43e278", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049985, "uuid": "639c31b1-274e-4649-9b5b-3897574d4f05", "value": "T180D2E1016641FEE1D5B00232E8668A9B72267D79C0D130FB963D0DF8A6E9A1D47F5E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049985, "uuid": "685940ee-4177-4ae8-9db4-750163de30a5", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXgP9q3UEL7Q:WRwynNIOQQ1KMw+Ls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686049985, "uuid": "d845ade4-a9a8-4909-b969-33e43252b0cd", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686049985, "uuid": "0ca71472-72c0-45e6-98c9-e22025bc5c92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049985, "uuid": "04597634-e87f-4e19-aec3-c06c2ca0cbf8", "value": "2a9f304465d0001dd751338c416fc385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c0373a-0439-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686035714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035714, "uuid": "de943f8d-8c2b-47c0-aa50-ac805fd0b322", "comment": "Malware payload (Mirai)", "value": "102c21d087dcaacaf7c58cfffc524fc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035714, "uuid": "034c68c8-c8f0-4afe-b5d3-b850ebe6b97b", "comment": "Malware payload (Mirai)", "value": "ab3cca37cf5da9a1e89a13630e73bfbe29c901dde99aa2b3e240f890921c8f58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035714, "uuid": "4a95d3e3-2c71-4864-be70-d94ab27bdcca", "comment": "Malware payload (Mirai)", "value": "e88c07ad98bea20689ece04acb394cab9d0f9dc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035714, "uuid": "8eca20d6-700c-4bc0-97af-e1d0d9e1c152", "comment": "Malware payload (Mirai)", "value": "bc9e643ca3b90d351631cf0b57333ab4afbbc35e05c92abfa862d44e4d471a8bced79f316e9fc1595e1b1d90e2b5a7ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035714, "uuid": "748a3f94-8de5-4210-be4f-b79a3ad2f8ec", "value": "T11CA3C72A7E11EFFBE169823007F39F2096E522D227A15385F26CD7185F6118D1C5FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035714, "uuid": "e8c67216-5661-4379-85d8-352d1a105ebf", "value": "1536:p7j+1TuZq+3xk0yDy/yYyALXgvlG1DvrvJetzJWC2mWItFBuCQCjn/:U8rXrJTvmITmWItFBuhCjn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686035714, "uuid": "038491aa-8ec3-4f72-80f2-737a3f18217f", "value": 104292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686035714, "uuid": "b55eed1a-065c-4522-ae46-af23c846f653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035714, "uuid": "cc4f7cdb-ba71-48af-a2a7-8dc7f4ecf669", "value": "102c21d087dcaacaf7c58cfffc524fc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52408fff-04b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686087013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087013, "uuid": "f201a6da-1ab9-4bb2-a060-52faf3c281bf", "comment": "Malware payload", "value": "dbb3dfab8dc652317f8a1e0ae4eb57a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087013, "uuid": "f753b7d9-0e8f-4753-b8bc-6102d35dae8b", "comment": "Malware payload", "value": "ab668131d24591e795eba9a2e73d91d9e5438f032e1519acf804c5dc157fe0d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087013, "uuid": "3e1808ff-d471-4fe6-9e53-e12019280927", "comment": "Malware payload", "value": "6a1a9f69a06a15238ab11033f9e1dc183309db93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087013, "uuid": "271229ef-31b1-4bd3-b8f6-29e0c2d04c55", "comment": "Malware payload", "value": "2ca0b19fce2758de22a49e3cd4838a9c6be255f51677f0793528a956fe058cf9da77123756656d3fdaf5cad273deb710", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087013, "uuid": "965fe174-9f28-4b1b-b618-6a38c718ea44", "value": "T127B35B77CC29AF68D664D5B4B0708FB96B53A911818B1FBE1967C2788043DCDFA053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087013, "uuid": "c9a1db1e-2088-4f56-b347-c8aaf7e05e89", "value": "1536:rX1uVgAw3Spfg/CvKu1lG7QP5Wm9N8LWLLH5B+Uvw+3yj:rluk3Ifg/HuSgWamLWnH5w9+34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686087013, "uuid": "0d6ff300-e5a2-416a-ab69-adf91c145f14", "value": 117164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686087013, "uuid": "ee6e4002-200c-49af-a263-04e08fdd03ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087013, "uuid": "4ab84e53-eefe-430a-a291-ca9041c92592", "value": "dbb3dfab8dc652317f8a1e0ae4eb57a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c4db59-04aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686084151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084151, "uuid": "0858521b-e687-4e91-b6c7-021f94ce8ad9", "comment": "Malware payload (Mirai)", "value": "8734e4ba653a1970700eb9d548218515", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084151, "uuid": "a21a1570-43b7-46b5-ab53-992dc758fd84", "comment": "Malware payload (Mirai)", "value": "ac857188f7c1d5be4eee848173f22f0c1f996e705f28574e4bf0463f3d6bf33b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084151, "uuid": "1e3eeb85-9b5a-4a47-af74-e38ace56bdf8", "comment": "Malware payload (Mirai)", "value": "add3587bf7646347e197c2e1689e9c8f2b513f2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084151, "uuid": "a9e5a743-c3a0-4107-a644-1e7f1028849c", "comment": "Malware payload (Mirai)", "value": "2e50acfea1c6422213cf4cc911a71e04319adf1db38f226ba2df4a2093ac8a7874e5ec6ee0b5b2105b77b85d820d3175", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084151, "uuid": "de3f766e-7374-4860-ba33-0032944455ac", "value": "T12FE2F170BB9CA270F9D42831FD3A924E335F4A349473312B552D8658DEC999630BCA6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084151, "uuid": "6d710c6b-ff78-42c8-96d9-f5d00dd1d6a9", "value": "768:0v38XxHIx67wfFjPD0E/YyxNSosaxs3Axo3Ucp7:EshHI5pD0E/YyxUaBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686084151, "uuid": "53644f9c-ccc9-40a2-a255-1363a8a20489", "value": 32600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686084151, "uuid": "09e9412c-9ed4-43f2-9f65-2e40d6d4b706", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084151, "uuid": "ab9d4c08-3c0a-4874-ae6e-fd7c09a6ada8", "value": "8734e4ba653a1970700eb9d548218515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3af5eb-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036000, "uuid": "d8936c01-3293-4f67-badd-6b453f6e742f", "comment": "Malware payload (Mirai)", "value": "5d4b44a3235178096d5e1cb8ae496600", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036000, "uuid": "c0466a85-cd58-4ead-9819-471e708a0e4b", "comment": "Malware payload (Mirai)", "value": "ac99e134bedde543ec454d6ef152d6c78ed8487393f570f5bd18fdbe93d29a7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036000, "uuid": "77d7ae12-1dec-4692-ae68-7592d55eec15", "comment": "Malware payload (Mirai)", "value": "e7fbf522652cbfda77b6b9952495afa5221883d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036000, "uuid": "1399b905-b98a-495c-b0e5-add96ab7a1b8", "comment": "Malware payload (Mirai)", "value": "b6f824a679893f3d7b73e7002bbf5ff13e21153da39c14fd1e2c8085d358ce5ab414df0b4391579a2582c4b67d9fec84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036000, "uuid": "a714fa3e-7249-4caf-a9e6-4f05c7d2ef57", "value": "T167F2E0224327D572CEB4DABBA93181E4296B47F4F5AF70A433A4C6CD98C1F02D4FA146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036000, "uuid": "f3dd371b-42f0-480f-89b5-2f05a6791447", "value": "768:VYVgAxkU1RHz5poClGL1aMnXha7WBNoWhSxHjk+9q3UELC0:VYyAxdRH9zILLBBrodjkjLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036000, "uuid": "b1d4a094-7a67-4c82-bde2-cbd4dc95202a", "value": 34484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036000, "uuid": "56ea2390-f746-45c5-9792-68cb706022ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036000, "uuid": "10479d81-4a1d-4d82-9385-f303b0354cb3", "value": "5d4b44a3235178096d5e1cb8ae496600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2702b4d4-046a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686056446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056446, "uuid": "d996b1e5-dc0d-48f7-af31-92fe8cc3653b", "comment": "Malware payload (RedLineStealer)", "value": "7b88328d85eeacebd2af9b9b89586111", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056446, "uuid": "3cf9c95b-8ba0-4fe4-bc5d-7aad3fe48e2e", "comment": "Malware payload (RedLineStealer)", "value": "ad781c23517e1e998db66015cb6874d04f4fe17066f683de9594e717ec5ae433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056446, "uuid": "739019b8-d046-4c02-a1d0-713bf7cf1946", "comment": "Malware payload (RedLineStealer)", "value": "cee13d779bc85e50476a9d1cf8607be0636c6814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056446, "uuid": "d61d125d-c69b-4148-a0c2-027cd9762880", "comment": "Malware payload (RedLineStealer)", "value": "e4a2ede2a763df1e6582cb6a7998e542e866254fbf7e14969051f2bdb119614f732ba05b19e03db871aae8a1ec3d1a28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056446, "uuid": "ce2a177e-556a-40e9-b866-ef73b465ae38", "value": "T16C152322E6D88462ECB22B7014F60387573A7D71A8B4477E1746AE5E0CB2794A133F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056446, "uuid": "1cfab158-c99c-4be3-a011-19d0fe569944", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056446, "uuid": "9a163cf1-e644-4cc0-a3fd-e461b9abf762", "value": "24576:LyH3akGAcEDnQm/OddmxeqH43+eVMJw5:+qTTErNOddmx68w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686056446, "uuid": "e0c7adf3-0994-4e23-b058-c6d6a203153d", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686056446, "uuid": "a1022fec-6414-439d-aa5b-d0d576e1fda8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056446, "uuid": "6495ead4-75b7-4789-8a04-f1052236c614", "value": "7b88328d85eeacebd2af9b9b89586111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d37bbd4-0475-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686061207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061207, "uuid": "50bbb0a1-42db-4a15-afa3-3c340e9e60b7", "comment": "Malware payload (AgentTesla)", "value": "a10751b9e231478eb2970d6235152a3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061207, "uuid": "aa8fd7be-39f6-47e8-a215-3831556fe84d", "comment": "Malware payload (AgentTesla)", "value": "add5620949d2784c56b3fbd811a417a72318dca2f8eda9fbe2757c60f272040d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061207, "uuid": "4c8eaf3c-d51e-4d29-b6fe-3a9e24895bb7", "comment": "Malware payload (AgentTesla)", "value": "d5607c21566f2736abc03b3fd03ea151d1e2e8f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061207, "uuid": "fab6c527-9933-4c6c-bc91-876cec75eaa9", "comment": "Malware payload (AgentTesla)", "value": "b64673f40d2e0c5932fd3117f3c23517f82be328a44c463e23d2ceb53d99ee684c5de13f54734f91d3abce50da64756c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061207, "uuid": "58ae7787-a30b-4407-a88d-fb4ce75272ec", "value": "T1A4F4F19475BB4B2BC1BB13F48514A2305BBE56ACB872E72B4EC7B4D71621F0119C2B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061207, "uuid": "a66eacd8-774f-4dd5-a6e7-c10a70a91bc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061207, "uuid": "72060b9c-98e7-4134-92e9-ce9eda4c9856", "value": "12288:Iv2B0xTGlxNqvNu2hZ+nUEsn9ekLTHHdVVvLEtcFWzZkCEwqCQxjVU9zVMZ02:IvLaVUH999eendDjEtcF62ecjVizC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686061207, "uuid": "a86af9c4-1dff-42b6-93bb-b54486da592e", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686061207, "uuid": "dd914d38-4d50-46dc-aa5f-c26449c42246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061207, "uuid": "bfe11dc0-81a9-43e7-b307-2a19e8cbd6cf", "value": "LkF28H7cqroAApT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172c307c-0460-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686052124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052124, "uuid": "d0e72501-ca49-43cc-b639-e15e4bf53f26", "comment": "Malware payload (SnakeKeylogger)", "value": "b3abc9c804aaf1615dd47a146320f2d9", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052124, "uuid": "eb471284-7590-4305-8ff2-8e1012953f4c", "comment": "Malware payload (SnakeKeylogger)", "value": "ae6503ac5cf2f1eecb86c6412def66a951542b4b4bf2a8dd330b88ed240bd4f7", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052124, "uuid": "6b411f95-1582-4c98-93a6-fcb9d9daafda", "comment": "Malware payload (SnakeKeylogger)", "value": "82621c5da1909f56c2aa0a061f026a96149a55d1", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052124, "uuid": "96f71a3d-231e-4771-9971-ca9d5d4ed10f", "comment": "Malware payload (SnakeKeylogger)", "value": "ea3623930acdd70eb2775da36d567f757a88754e39704084ffc5deb31aab32e67ed8b923a806e209df967874dad6a606", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052124, "uuid": "13e1fe7f-dda0-4ac7-a973-45166274bfee", "value": "T16415339BBAE207B4CDA5BEC1EACA5C0F4535DBB39658406BE374900D9A7138033275B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052124, "uuid": "119913ff-b0a4-44da-a97a-ce2a7437d849", "value": "24576:AegC+4KdE9eRxx9I5kU/qqBXikiT62YXDWdWFn:Ae6dEQXI5jbhiTm2YiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686052124, "uuid": "8228541d-b983-44d4-b469-1403b60f9382", "value": 907130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686052124, "uuid": "094cfd41-8182-451b-83ed-7b364dd63e7b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052124, "uuid": "11c4a9ff-a31f-4ff4-80e6-1893c0f3df46", "value": "Payment-086767.Pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8721eaba-0421-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686025254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686025254, "uuid": "5360b0ab-ca01-4a9e-aba1-4b8546a5786d", "comment": "Malware payload", "value": "d5b053c7aa22624f68bed01d19f346a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686025254, "uuid": "1b38bfd3-e140-4ad2-b8ff-10483274c1ed", "comment": "Malware payload", "value": "ae861671858f08789c7ddb6b214bf59eeee9b702021fc109b240fde2fd320054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686025254, "uuid": "0c854866-0882-4480-a634-3a7e4a1421aa", "comment": "Malware payload", "value": "6fda1074d7bbe20550ebb006ef9489fcc385d326", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686025254, "uuid": "b9814976-c4ab-4cee-ab65-5c1add6e9246", "comment": "Malware payload", "value": "d23c299fb9a912e1cf227b642fba585c0cedf59b8be57ce0b1449eaebde63cb120de0073d99e0ab7422b69ce172a4c1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686025254, "uuid": "00479f78-23b5-4f72-bf28-ee2e9019f7bf", "value": "T18C7633DA676209A5FCBE527FD9814B56D1E0B8EA0360D3D307A4471B0E43AC1AC7F792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686025254, "uuid": "9bee2fdd-0823-4e44-aa52-170e4f0f0e40", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686025254, "uuid": "8b125673-55cc-4b75-a204-d13b3a4c6aa7", "value": "196608:ahjHF2tb9ag5+iFOKr/lVzvNK1DTtl540tFEAn94llpaKP:Ejl2WgsiFOSDDNWhl73nKlrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686025254, "uuid": "2a115af0-3a23-4ffd-8dd7-8ef3a8aa12a7", "value": 7396671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686025254, "uuid": "209e45b7-78db-4e89-bd7f-0a2c69f34e45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686025254, "uuid": "ab4f3bb1-b10f-42d7-b434-e8fe0b25c155", "value": "FedHub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4e8067-0425-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686027173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686027173, "uuid": "76a684c8-77b4-44bf-a291-02c2e4c3f1e4", "comment": "Malware payload", "value": "dd47f33b56454960f38b861eaafcac6d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686027173, "uuid": "a02c5f8e-ff9b-4541-9ec1-98cb610c75fe", "comment": "Malware payload", "value": "b026eb7fd3853998406036d08ab772352f448f780f70ba77e969a8023527881d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686027173, "uuid": "153156bd-ba56-4642-aa46-6b8f518e1bd2", "comment": "Malware payload", "value": "fb3bce82df125ced53a0ef72b267599a9ad26fe2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686027173, "uuid": "30262cea-d6ff-4e1d-8e37-fcb979dfd86d", "comment": "Malware payload", "value": "c4612c6d60595b36dfe312460cf897313ffb5aaf0482c00e73b90e24046359992ccea74204fab3c9276c773466da51ce", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686027173, "uuid": "bfe06587-db0c-420d-80aa-bd9a72cd0554", "value": "T1EBD2237DF58B0A48DF5697B8061B7BA5054DF51DB3C840B236B8CB387999C2B4A2393C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686027173, "uuid": "c3ac17d4-4dfb-4a6a-9fdf-e7c4fa145c82", "value": "384:uQ6H65taGaDlVZGCLyCHw8tksK+xuuaI22pNDi3h2rR5b15sfPJuzIVbBIdpjHqW:uQoSaDlnuC5ksbuuaphUqbBS3xLMT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686027173, "uuid": "efea7bd1-12ce-4b55-a80d-1c423c6e1ef9", "value": 29717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686027173, "uuid": "9128d88c-92be-4547-8913-0fac19f059a8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686027173, "uuid": "00f5122a-054c-4dda-a21e-223aa01ea0b8", "value": "dd47f33b56454960f38b861eaafcac6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95da7b1-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686054544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054544, "uuid": "e76f3da4-2043-409c-9b07-34d75d24646e", "comment": "Malware payload (Mirai)", "value": "dad93159ff57896cbfbd2f5a3e2429ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054544, "uuid": "4f82354a-c98d-4645-bf4e-9e6dd6aab988", "comment": "Malware payload (Mirai)", "value": "b02f4d36c8862a2098ef3d95a85cb6762f20d03d0af1347e6443ebd7c16d2e46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054544, "uuid": "791b6bdc-2f95-4c54-b969-08588a8463e1", "comment": "Malware payload (Mirai)", "value": "2f9293261c05e3125ad5730ae583154daa20f4fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054544, "uuid": "72c2b9b6-d5e6-4bec-9ba2-500f5f7be6ac", "comment": "Malware payload (Mirai)", "value": "1bd860e66cadd8111b4aae65cad8a7f50a8506325a055dc9a1dec98fa297e5ac010085c135eae5924e87cc43ed433c7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054544, "uuid": "75e90f90-1ceb-42ec-bea7-f051a720350d", "value": "T121233B21BB751E13C4F0A8BA15F74769B2F6439B16A8CF5F3D221E4AEF11940A5036F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054544, "uuid": "446cffd8-5bc6-434b-8da0-0fd5d229d45c", "value": "768:NVov0yLT6q9XxW8q/6XU2OxY6r5O+Uix15PfJPfc8:NVk0yX6SXx3q/6XjOxY6d/bHJHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054544, "uuid": "72c0a59e-1d71-4de7-819f-6ae30e6c774c", "value": 45696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054544, "uuid": "ae4ae7a3-5f6b-41fd-b64e-bb970eb907d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054544, "uuid": "d64cf45e-7b0b-4716-bee4-649c8b38336d", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.1.2339.14125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2e33a9-0440-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686038765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038765, "uuid": "55edf1c6-66c0-424d-b5d3-b518c4229b68", "comment": "Malware payload (Gafgyt)", "value": "d0fa8cd79a1f8942071e154b4e87732c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038765, "uuid": "7d438f8e-6936-4c58-b0a5-4d3dd09b06a2", "comment": "Malware payload (Gafgyt)", "value": "b03d2cbea298f22f8df38da8ac1f1744ad69908c73a5e7d58c1ed2f3531386a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038765, "uuid": "b5e71b44-2a45-4f8e-afad-b37c2ad3bb0e", "comment": "Malware payload (Gafgyt)", "value": "2aadae703f4509d6487eea581f634f297ac1e9ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038765, "uuid": "a0cf73d3-a89b-41bc-ad54-793fac88a2f4", "comment": "Malware payload (Gafgyt)", "value": "e1c31a57a71e2826c210c3215aab83e659f0be1b24032ec0c167cfa6eaeb873892076f0677b9b1f5b6d63d5f8192d4b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038765, "uuid": "240d59eb-bf23-4e3d-9096-c41d0072a4a1", "value": "T199A33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038765, "uuid": "ce254f48-9cb5-4d7c-9582-87e34c4b89d2", "value": "1536:xfRuqNM5h7t/RiRt4nIphaQoRKzO6F6OXj6ufeRTe:OqN8jRiRjphaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686038765, "uuid": "5012b9a5-6d5a-4c02-9383-4dcd23af2855", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686038765, "uuid": "b1775128-8e69-4cfe-a237-46971150e645", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038765, "uuid": "2e290002-36d7-4709-b28e-1ec1bc2aa93a", "value": "d0fa8cd79a1f8942071e154b4e87732c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8a7113-0467-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686055521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055521, "uuid": "f9953a1b-ea20-4162-a430-391e5dcf55da", "comment": "Malware payload (Formbook)", "value": "3140a30f5c0dc6411a5e525ed3e8a33f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055521, "uuid": "0f46400c-5c1a-43ee-b9ed-d7d355e4cc6f", "comment": "Malware payload (Formbook)", "value": "b1106ab504f88dfbecebc66a4942c8bf73173c60bccce7ecc433e3a668777093", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055521, "uuid": "d42cb637-9793-464d-9b9e-84cfb357168e", "comment": "Malware payload (Formbook)", "value": "39ff4cf121156f49e4f87485d3a4ee9a331a05c5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055521, "uuid": "aaa1a729-2960-47a8-bc4a-e1a56a6af1a7", "comment": "Malware payload (Formbook)", "value": "f24d57d2ad736bd199784a842e92db788cd9a4199cd643b69d94ecfb957728509c438252c5bf0cfe270e92c2f524382c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055521, "uuid": "3e4e3810-869b-46d4-a76e-0fa1c4897417", "value": "T18BD423A206E6616A10ACB52FA0CE33FDDDA907FD80D3FC848645270B5A514B77A15FCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055521, "uuid": "34fe1359-0bc9-4432-b867-3a22266fdf96", "value": "12288:5QsX027dKCwRc7MzF1x9Z2cnA1eVNPZvbfAnmsJAqmt/U1bWl:ZL7vw2IbC6NPpFqtbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686055521, "uuid": "860f2b29-bde3-46ce-b2f9-1cf645e0c356", "value": 637709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686055521, "uuid": "9c130ca2-03a1-4277-8386-50ceb9d6973c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055521, "uuid": "f50a3983-6983-43d2-bba3-3bee5f94e628", "value": "wire_confirmation_7746362972.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad60a54b-03fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686009856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009856, "uuid": "371fa380-bd55-4ee3-ab0d-c4b0e9a4326c", "comment": "Malware payload (RedLineStealer)", "value": "806c44437de4c961e8e84a769cce8102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009856, "uuid": "4a2590b6-1d1e-4e67-bec4-d0b7c8b85084", "comment": "Malware payload (RedLineStealer)", "value": "b1fbe3864bf61ac4ecb5f3ab73bd8d92463ee61a4cf425952618844f95d50e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009856, "uuid": "d5a10e4a-1606-402c-9eed-a3f4e56e5510", "comment": "Malware payload (RedLineStealer)", "value": "400a1edf2a77c92ce5d0d9e7417352a38505074f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686009856, "uuid": "868656c8-cf81-4129-bddb-58f5d9f67612", "comment": "Malware payload (RedLineStealer)", "value": "af7b2acfb95c8722572e1be2755aa82ccf35c863978716f444fcc70ef831dd6ce4b75e0887749c41170fddb5c7735d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009856, "uuid": "3aaeca5f-1533-4c31-9f2b-0351654da134", "value": "T175D41203ABF44136E571277168FA03830A3ABDE1AC7493673B96655A0CF3B90A532777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009856, "uuid": "1ef2ce59-a38e-4a2f-98d1-0d894aee1c4d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009856, "uuid": "49768d29-5d23-46a3-8dbb-7a87ef25b198", "value": "12288:7Mr4y90XujCFP5X3f6dDqHGjjrVGe+UfTfYBkHHgmJEYGJs4DbD:HycuOlJ3Km2wNU7fdHH1+fbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686009856, "uuid": "744767ff-f9dc-4d46-9a30-d3b5893ebed8", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686009856, "uuid": "d3660a6f-dee1-4a7d-9469-a37f12518b4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686009856, "uuid": "b12b903a-0343-4765-90cc-440856935279", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6a3e9a-0442-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686039387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039387, "uuid": "66511b59-8ebb-4b9d-8b78-66474b77076a", "comment": "Malware payload (AgentTesla)", "value": "d3c7409accf6c0b36d500d68be6eb07b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039387, "uuid": "35bb896f-28b0-472a-96ed-6e04b34c7f44", "comment": "Malware payload (AgentTesla)", "value": "b2eb42a73b2d0577b927a7e2f287262116d8b0962e975d66ae7c1f2dc50626a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039387, "uuid": "f25d665a-a00c-4d51-86af-aabaaf3809ef", "comment": "Malware payload (AgentTesla)", "value": "4d6cb1522da5bd581877e280eb943cd66a66d774", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686039387, "uuid": "e0e066ac-781d-463e-b9dc-a4ee4f2bcee3", "comment": "Malware payload (AgentTesla)", "value": "dcf6f87577b26031547ea4ff64057c3c918f62da9fe0f1e239ad1cd19951d97e85a527f7db0a84c40618499324d4ce26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039387, "uuid": "a55b0200-9ea5-4395-a19a-f59a700d9807", "value": "T14115125823BB820EC5973FBC0D4416B5C7EE9A95B033D21B6F67B8CD8D24B140ED4A96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039387, "uuid": "024b2122-4def-40d9-bf0f-f76e30724603", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039387, "uuid": "19f8a9ff-881f-47a1-8449-7f317b8a0c4a", "value": "24576:n/thewlqB6pnPOdrxQi0rxhxfCoKw4prAyIxBSV:Xe2q8pnPyPXoKw4JAysB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686039387, "uuid": "0ea1dd88-375e-4ef5-bd4a-07700705e21e", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686039387, "uuid": "b451d138-e765-4ae0-877a-94827222345c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686039387, "uuid": "1614b577-4959-40cb-9d5e-739ddfbe32af", "value": "Fiyat teklifi Istegi_23051609051 \u00fcrun Etiket scan0010_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f074cd-045c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686050451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686050451, "uuid": "29812c8c-60ae-4f9a-bb85-4378ab13635e", "comment": "Malware payload (RedLineStealer)", "value": "99c0cd96d46794e20fa539b20e4cff64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686050451, "uuid": "4dd8f483-d6ac-4e62-aa69-29bcf06a3c8d", "comment": "Malware payload (RedLineStealer)", "value": "b35a9c4ab45487ac9ba5b5717d975d76679a93a76c81fdd8e18841f16d2266f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686050451, "uuid": "6750a734-f33d-445d-8c5c-4925f26cf4dc", "comment": "Malware payload (RedLineStealer)", "value": "97e5aa8366cac78fbd329dcc11d9ca8a6c55415e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686050451, "uuid": "5de8bf8c-01b6-4457-8f12-a9750346dde4", "comment": "Malware payload (RedLineStealer)", "value": "e245f0b6506ce50eafb8a81c886005a9f5739f8a157e0b7ef7f0b5eead25c9038c24c387dd3e48a89dde719e87311837", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686050451, "uuid": "b282531b-b2b2-45cf-b420-aee4b5abef3e", "value": "T13B547E09E4DF41D2FE4630B5216E805AF5BF90F7177FC0AEDF8A3AD21C571A09AA015A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686050451, "uuid": "5a3236bb-d075-4d45-9f7e-544b82defcd1", "value": "9a420839291c450c6e0e5c21b3466023", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686050451, "uuid": "0545bb40-92e6-4256-9b08-cd3e3b425b29", "value": "6144:krcV9LR1LM8FaGwVIF52EskSvtpF/mZpgx:5V9jLM8QGwVIn2EskSFjMyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686050451, "uuid": "83762a83-bfd3-46c7-9ec9-cb108468d01f", "value": 289208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686050451, "uuid": "2390ac99-70f8-4431-9824-06e8da865955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686050451, "uuid": "3ddf66c6-683a-46a9-be9d-8ab0d41aa773", "value": "99c0cd96d46794e20fa539b20e4cff64.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09355b13-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017741, "uuid": "a50be36d-ca92-4c53-8228-3273420de309", "comment": "Malware payload (RedLineStealer)", "value": "78acac8185e2047d03adca753bac2121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017741, "uuid": "5f75b3e6-9ad9-45f2-a347-b34b0214bc9a", "comment": "Malware payload (RedLineStealer)", "value": "b3d95c95d03dca71007e104cf69f9cb60988f9645f7690600b0d530fed57aa1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017741, "uuid": "5eeabf55-b3be-4133-b048-ce1f2a6dc9db", "comment": "Malware payload (RedLineStealer)", "value": "5d77ae6c22626aecb4fee7d222f0371735d96373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017741, "uuid": "f3bb0c96-d781-4419-9412-5bf607b7054b", "comment": "Malware payload (RedLineStealer)", "value": "22d78d6c11f84e1699b9491f05f82bac33a9babe3d38d515b8d8c825bebf768c1be8f45638e44504bad4b72ac31b1f59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017741, "uuid": "c1ff2add-750c-4004-9951-1f850651f51c", "value": "T114D4121366E94072ECB5177288FA13C31A3A7D925E74936F2B86A85B0C736C4B43537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017741, "uuid": "258ee7c4-455b-491b-bce5-7c2ed06eaf5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017741, "uuid": "d834301f-258a-4a5f-8ad1-700a51ba2ff7", "value": "12288:9Mr+y90/b4VK+z/FnUN86QDDnheKH915tof9HEy8C7U56hK:3yOs8+jFUNxWsKT5uf9HR7UIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017741, "uuid": "e548ce4d-ff3f-4af5-b651-0bf149f9f8e4", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017741, "uuid": "29d94f74-e4e5-4141-9fd5-3ba5d8e3742d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017741, "uuid": "179b1179-4383-4692-a013-cc00a70035e9", "value": "78acac8185e2047d03adca753bac2121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7310123-0449-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686042514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042514, "uuid": "0f49532c-c690-408b-87ad-11dcaf7956a8", "comment": "Malware payload (Loki)", "value": "7c823274ec6a711a73c4c7df54d1d4cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042514, "uuid": "5855dd82-65dd-4b97-8ecd-5bb57c63a0a8", "comment": "Malware payload (Loki)", "value": "b432b8aa06d6977b2f87eafa17634e0fded464c7a521e0120c393c4f4d084fc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042514, "uuid": "d4bf2879-97a5-4de6-bab1-a2fead554dbc", "comment": "Malware payload (Loki)", "value": "8c78efece5e8c83205df2b18390b3e53396bd237", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042514, "uuid": "38842eda-b5ce-45d7-8e6e-b49f98d06a1b", "comment": "Malware payload (Loki)", "value": "725cce87c684553b21d6218ea7a860d8da507fb46dc9c24d9f1b1f08794927473a0e57c998a0a53c1550ceb783fc9064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042514, "uuid": "70ac2377-0924-4423-934f-db042863a00f", "value": "T1CC03F65D77EA9E13E35C0B3D6463168D2739D3086E43F767E868813A3D923E69CE0192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042514, "uuid": "141340fe-5da0-4295-b2f4-c8586c5103f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042514, "uuid": "a19b13a7-f982-449c-b338-58a0e63303b7", "value": "768:bNyecx7gKng+pF0WeIUDNC6YGcoMcRC7n8Yila:b0ecx7g+70dIUpC6YFoFo78lla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686042514, "uuid": "7779a6da-fa82-4f1d-986d-cc7758393704", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686042514, "uuid": "c4f65f64-ba4f-4854-b352-72e43bd9019f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042514, "uuid": "740bef4e-7ebc-4358-bdcc-dfc64d3faa7f", "value": "Sipari\u015fi_P.O_4029064_Decorgru_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec7b409-0440-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686038769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038769, "uuid": "327b3520-bca4-404f-a75b-840497619249", "comment": "Malware payload (Gafgyt)", "value": "300401332250046123de0dc3b669d271", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038769, "uuid": "d6f0e96b-785d-4219-9030-168c7091a1ef", "comment": "Malware payload (Gafgyt)", "value": "b44e7094f5eedcd9ef7619703a50cd329501d9ea6e40db44405691540ffce400", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038769, "uuid": "ba7f501d-712f-4757-8e1d-22464adcbe40", "comment": "Malware payload (Gafgyt)", "value": "313d18e316a2f8403caba4b1324699d2117685d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038769, "uuid": "05cb1ce3-453a-4acc-bb1f-a408bfc94588", "comment": "Malware payload (Gafgyt)", "value": "49ae70d013087c48a9450ed8ff6e411f405960e4be5dfc78465c773f9a4352e3d9de8bfa780cc9ca6c2bb9a186997863", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038769, "uuid": "3da6c11d-187b-4b68-83f9-9ee925b584dd", "value": "T10DE34B09F6408B53C0D32776B68F534537239BA5A3DB33069928AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038769, "uuid": "6da0b2b2-a208-4f40-ba4f-f8076b2ab70c", "value": "3072:tdntU2haO5H1XacBoGmh9H5n5hDiGRvEM/9f9T637m5wTsL/Qpyn:ntVhaO5H1qEc9Hp5hDiGRcM/9l+7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686038769, "uuid": "6b7f782f-222d-4084-b3eb-5efca5797326", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686038769, "uuid": "086d293f-afcc-44a3-9123-c75fb7fb150a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038769, "uuid": "43dfe921-5927-4b09-a194-a4c6aabfe0f1", "value": "300401332250046123de0dc3b669d271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f282560-044a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1686042877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042877, "uuid": "61db1b10-95a7-42db-a0ba-fd888f27d3c2", "comment": "Malware payload (ModiLoader)", "value": "6028853b647d4cd0ce83f5add2cf0b5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042877, "uuid": "4053c0ce-9da6-4556-8df3-2559683c6425", "comment": "Malware payload (ModiLoader)", "value": "b5a72e2705d54b0c562e3e68bed8d3652570666182a236b491f724200d3e38db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042877, "uuid": "a7ddc2b5-cfde-4cb7-bb0b-ad481ae17f2d", "comment": "Malware payload (ModiLoader)", "value": "47daf71b2ee89818eb89277c86aafb6b9573d507", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042877, "uuid": "f4f4781b-2239-4297-bf05-253231bd5a5e", "comment": "Malware payload (ModiLoader)", "value": "359fabcd704a1533d3ada2e06389db65fa8b17dd050b5d98326ad65514ba755f9b98b70a483e6c24814332c7b34d993b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042877, "uuid": "119c471f-fdba-4c63-a2ae-a7646330a097", "value": "T15515AF15F9608C77E0626A39DC0B6769A829BF503D245847AAF43F4CAF3D7813825E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042877, "uuid": "87c74adc-4f1b-4478-ad00-bdfc0eacb41f", "value": "f5b94f87a323eb9c8534a95d7c6241cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042877, "uuid": "89adbfac-8921-4b04-b058-99aa454ca080", "value": "12288:339wCUzsHZGNTBQ+qqKY6kROWtMgPHY796W2QvXZb0nSoiKf:3twsHZCQoKY6sLHY796W2Qvpb0Sotf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686042877, "uuid": "bc99707d-615a-413c-97a0-3f51b8062dbc", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686042877, "uuid": "306ab811-a264-4e59-9273-3d03631d5879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042877, "uuid": "a585550f-c3b9-44c0-a077-5ac9e3d06622", "value": "modi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdc09e2-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686090015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090015, "uuid": "085ea355-1829-446a-90d7-734f259ee72c", "comment": "Malware payload (njrat)", "value": "b7dbdae666095355c2b1737459f7b8df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090015, "uuid": "19e2e770-7987-4dc2-a6b4-9ef099163500", "comment": "Malware payload (njrat)", "value": "b640ee680aedb79ac683a15f29e96b866ac4994171f3ec7aa0dacf75499efa7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090015, "uuid": "7ed94113-96f6-458d-a09e-4eb16ba89678", "comment": "Malware payload (njrat)", "value": "f0b46ba9cc1d1c262ebc1ee65cc15273eb6c4226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090015, "uuid": "28e5b537-29d2-4bd2-8c68-73bd1e2eeba1", "comment": "Malware payload (njrat)", "value": "c86630c71e5d6923db86150e792131135a4b1824e909ef4defafbdd8e8d60f6a318375590190740a9414cf8d2a1346ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090015, "uuid": "50f4a9aa-5965-4206-a328-f51b129c2373", "value": "T1E393E84977E56524E1BF56F79871F2404E34B44B1602E39E48F219AA0B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090015, "uuid": "64661b00-874b-4d4c-84df-0ba5c1cbb119", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090015, "uuid": "d10fd076-d60d-41a0-8090-e783ae32bcc4", "value": "1536:JUk1GkeUqZJO5iNSimjEwzGi1dDADQgS:JUPUqZJOQAOi1dG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686090015, "uuid": "e9eaee92-c50b-48f8-82d0-ce27a4d6bde2", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686090015, "uuid": "59833f32-4712-4992-9f50-759e3767039b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090015, "uuid": "79b7273c-aa1d-4c4f-8d1a-506ad57a14f3", "value": "b7dbdae666095355c2b1737459f7b8df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b8c1b7-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686054508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054508, "uuid": "2fced91e-a265-49d2-81e8-dd865a8f4241", "comment": "Malware payload (AgentTesla)", "value": "f628caa18ad7944b7a45c95b7d8adeca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054508, "uuid": "bbcacf8b-a9e1-4660-acc7-ea25714645b5", "comment": "Malware payload (AgentTesla)", "value": "b79e15432c5d072dad863ebcbbecab43542e9792d125f726212bf7556dc8ca00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054508, "uuid": "f8cbb5cf-d5b1-40ff-a00a-7c9855f8b209", "comment": "Malware payload (AgentTesla)", "value": "0d27f0600d256cb00aa3a89924e8de9de7688571", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054508, "uuid": "63828665-8443-4938-85f9-fc3a904375d4", "comment": "Malware payload (AgentTesla)", "value": "4dbd08d34497f43e4d858886e153a19164c7f47b87b0fdd3a7827fea41b2ae456e761db8a93b0492eec1d94febbe16d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054508, "uuid": "1c36690c-62f5-44f7-9111-1ccbeb47ba00", "value": "T17ED4233D4B32EC6473D33FC9845BC5AA2ED54631AC11E376B9AEB36495C34E8499ACC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054508, "uuid": "7246ca67-e5e9-41f2-a364-8a45c237bb65", "value": "12288:h7Xp0HWyj3JrTVlBzqH0nsYpMnALE1R69Fy8mQDjEB91TVc4w9b7LZfTLr:h7Z0HWyjRVlB+HoGcETQFnDcB9tVc4Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054508, "uuid": "bfea47c8-fd64-463c-8e3c-ba34dc95d599", "value": 641520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054508, "uuid": "711a3412-c228-4fb9-963d-33e26ccfa22d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054508, "uuid": "97b9ce75-f795-43c3-97e6-f8bb778827f5", "value": "contract and payment copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed10152-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686059170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059170, "uuid": "c3d4e7e0-50b5-4ac4-920d-4d0c14873852", "comment": "Malware payload (AgentTesla)", "value": "a26862aee259220b47db0f4b62fec82d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059170, "uuid": "4916b0fc-5010-4542-8cfe-997e9b72fc04", "comment": "Malware payload (AgentTesla)", "value": "b815d7fd1051cd00487f704e8bcc7cea210d3a6bd08213b5b14e98c14971f90a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059170, "uuid": "9047ea36-e436-4880-b17a-8a4faab59a2e", "comment": "Malware payload (AgentTesla)", "value": "0ff43d70994e1acc71b41fc9e6ecff42eccd652a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059170, "uuid": "4bae69ba-3c07-4d6b-b313-01e21832cc6b", "comment": "Malware payload (AgentTesla)", "value": "f6d5a548ee81dcee5a2a06a6d373cc145c881a9a48f52bf540706d4d3a4abd41cef4246a5c79d78b5c4c8c3ce4228565", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059170, "uuid": "ce36745f-431d-4784-a145-77661b50e181", "value": "T143F4233CD6CCED7E8C63743C94D9595EBB43E6A9785DD4E8284B2823F92C18C29A5680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059170, "uuid": "47e714ee-de70-4006-9eed-9a7849284d77", "value": "12288:h7hg0FU68kO4xi2yj6zx3njFv2ld/f45BT9jO++1LPdCce8PwEh9fqtfTD7pg9xL:h7hPFj8gxDzv2l5gHw++NPdrxPbh9fwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059170, "uuid": "ab48341a-468c-436f-8133-0a71782003b8", "value": 723380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059170, "uuid": "b621c6ba-6b81-4bea-80e2-8e6092706cf7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059170, "uuid": "bc180d1a-763e-44b1-8b04-f94fcf3ebaaa", "value": "SOA.raj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a02c7ee-045b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686049981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049981, "uuid": "4191a790-ba82-4887-807c-75de292642f4", "comment": "Malware payload (Mirai)", "value": "a7c4d1a31a826b9e0f19553ddaffc2c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049981, "uuid": "a531f33f-fc08-4a60-b159-3d8688c3ad63", "comment": "Malware payload (Mirai)", "value": "b93eebf80feba2d775792cbdb410dabe691c10a5bbfa921059dcccaf461991fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049981, "uuid": "3c5351aa-cb15-4169-a368-00afde6ed4a9", "comment": "Malware payload (Mirai)", "value": "0f54ff8348d6d76c20f316faec6764fd4afedcf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049981, "uuid": "fa0f976e-1caf-4c92-b97d-d1aa22b928b2", "comment": "Malware payload (Mirai)", "value": "8672ea89df7c78296a13bec3d68a54e85f2966c42f5d475418d77bf816d53236ef8998ed2037fe5fe082fed16fb61ff1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049981, "uuid": "24edaa01-d55d-4c34-b02b-6e8dc759d800", "value": "T14AB2D0717011F8B787A50077AAEDDB43FB801EF8D0E8B3295465099EEAD5D42BAF1207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049981, "uuid": "02acc76d-98ba-48c4-9d95-cec461ae7c85", "value": "768:5X9nxn8o9wnBoWzEQf2EjKb3pYU3s3UozN:5tn+o9wjfBAZnqzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686049981, "uuid": "6f7d7924-31ff-4d40-a4d6-ee334be0d112", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686049981, "uuid": "79814999-7ca8-413d-baed-7d10280d1e88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049981, "uuid": "d8bcdb01-5899-4ab0-a3c2-f662fe9e5e19", "value": "a7c4d1a31a826b9e0f19553ddaffc2c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27935622-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089947, "uuid": "b1195386-7dac-46c2-80c2-9255f4edd8ed", "comment": "Malware payload (Mirai)", "value": "211de588887bd4769691a772ee6ee941", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089947, "uuid": "5a70023b-198a-4f0c-8c8e-8b13b38eb129", "comment": "Malware payload (Mirai)", "value": "ba60ebb06a10709caaba80a6e88e62b60bffe93a859d006a42ad4d5cbcbdcef6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089947, "uuid": "f2224ddf-c7f4-45ac-b15d-c048d095a981", "comment": "Malware payload (Mirai)", "value": "9bb21c1b959141b7f975cc2d84ddd0583623663b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089947, "uuid": "67bf2bf0-82be-4999-a4df-7f612c16111a", "comment": "Malware payload (Mirai)", "value": "c062de1f434f3ecbff2bcc6a37653d09d21c12c99696e5cf6aabaffedba5a01d44e7c7ebff2d7f16183454bf7e51b85b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089947, "uuid": "6598871d-064c-4cd5-8da2-44e3539dbcea", "value": "T1DC732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089947, "uuid": "353269b0-2167-49bf-bfb2-8940768f801a", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9W9:927jqCt8v3GI/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089947, "uuid": "41f0a996-77a4-4daf-8035-8e5d6dad77ff", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089947, "uuid": "0ad625c2-5fb8-483b-bce1-f3541bb1a694", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089947, "uuid": "6f2cee04-96df-410d-8029-719b8e9d7ed3", "value": "211de588887bd4769691a772ee6ee941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a233c0f-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089898, "uuid": "a41a5092-cea6-481e-a3cc-5eace3fb78bc", "comment": "Malware payload (Mirai)", "value": "15c0482cfce5ce87a910cefd97562b9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089898, "uuid": "90c853c3-6c12-40cf-b412-7712cd9caf42", "comment": "Malware payload (Mirai)", "value": "ba9a9d27ca94e907cb67a9cc6e7bfe60c37e4de7417b82e2bfe390ef55cb26e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089898, "uuid": "fc23b9ee-fe69-4dc8-adaf-447425dfeea4", "comment": "Malware payload (Mirai)", "value": "2e2de2405c5c6f1d6f4b2e5c9f624698e318750e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089898, "uuid": "06697d13-66d3-4a4d-84c1-136403185701", "comment": "Malware payload (Mirai)", "value": "e9c5a9687a584b4f040bb8ef5a929fa5e22846cc313a06f472b53f0e1ba11563ce4a62451ccb3e321336244c2d5b9b03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089898, "uuid": "a3bc4156-7771-4660-8918-33e87d16be6c", "value": "T151C2E191E1B62DC9FB767E901AB4D2C17BB04E5EB7B7CC9225589F0804A721B4B05ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089898, "uuid": "f7168bfe-025c-4366-8783-d465569e6935", "value": "768:yG959yM0HWubJsWDYcGj24uVcqgw09S0B:4M0HRJswYcGa4u+qgw09S0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089898, "uuid": "c0595e1d-8a2a-45b8-9b73-9e69d75ad39c", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089898, "uuid": "16620c03-2dd2-47ce-911c-c731126ae4b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089898, "uuid": "3462a854-ac89-42d5-8994-482b8b6b18f0", "value": "15c0482cfce5ce87a910cefd97562b9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee5e17f-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686089906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089906, "uuid": "4441cefe-8a23-4f4b-8b0b-8cca306d60ce", "comment": "Malware payload", "value": "d881d89761e113b67ae1cbd38fc1d105", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089906, "uuid": "d67c29a6-1ba8-4561-af24-dd1d01fa2442", "comment": "Malware payload", "value": "bb12034a4ae2a1487f748d651f3c2f27e58c21bd70a066d2277fb0f3d52d1ae3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089906, "uuid": "3998729e-9766-4d0b-9564-0d30d7a7e5c1", "comment": "Malware payload", "value": "fa35ef1e1ec4fe1b2b1b242d4fa161cab4cc22b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089906, "uuid": "55518906-0e51-45ab-b0d1-48f36e58a5bd", "comment": "Malware payload", "value": "34f92efe10a7fbb643ae7786683a9890cfbc38717335ac4c0131e1f9a1969a6c42137eaa26c624a6db724658dc595d08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089906, "uuid": "0420795f-a766-43d5-b0c1-33e17240c567", "value": "T1E4632AB9255AB2ACEAF5A039F40324E539510B1C37DCA1C3B1830479FE74B4CB56AD6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089906, "uuid": "a1f790da-6bef-4dd7-965b-86caf8ba06c7", "value": "768:XTe/qu5VWWy06imQ4NxZZ/OdvVwcirs7wfX4yOaqCeNaOw0ABwaIloY:jsJ5GVXmwJ3IyO+ea8ABwaYoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089906, "uuid": "b98c119d-875a-44d8-b806-cbf14497cc85", "value": 67024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089906, "uuid": "68229cc1-5f85-4574-971f-0862e1e34c52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089906, "uuid": "646809df-43f2-4cc1-ba06-947d6b4de36f", "value": "d881d89761e113b67ae1cbd38fc1d105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee9e16b-04aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686084135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084135, "uuid": "acf23270-5b7a-4cb2-a768-48c31ed38c5b", "comment": "Malware payload (Mirai)", "value": "4cdfa71b4281fdd50995864ab4f79826", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084135, "uuid": "4516b406-0cb0-4661-a708-73186cb6a9a1", "comment": "Malware payload (Mirai)", "value": "bb777a19775c7d14ab03f96846f707dec828a919c8d5a4e6cc9fae9a5b15c6b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084135, "uuid": "e3a7781b-7f48-486d-a1e6-933c5cd1766b", "comment": "Malware payload (Mirai)", "value": "a14d3695d4269c1e7582a44777a0bec710f03f20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084135, "uuid": "f4347f18-1cad-448b-bf1e-c91f25d0cf40", "comment": "Malware payload (Mirai)", "value": "0d5c19a2e9a7438cf7c5cd5923ca99d0924ae13f54c9ed8e7280b2c623faa6708fab8ee6673a7efdb2600f02017e2d21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084135, "uuid": "eb6ef4fa-2363-4015-a2eb-be85f1c2013b", "value": "T1B513F242D34A48B0E9D02D79ABD4F4A82359EB2DEDC6196C711806AC86D5CCB32FB607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084135, "uuid": "83f0bddb-90f7-4938-83d8-d1ef2693f048", "value": "768:ihzfDmijSg1fyyhggKPhZgjTU+9cK5p0M65rM2W+NIDQei3UV:iNfD711fkZZmhB5grrYQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686084135, "uuid": "fc3a3773-6e4e-421f-89dc-c9b8820134b3", "value": 44384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686084135, "uuid": "433341b9-687b-4a6b-8f78-4ef2c73a8a73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084135, "uuid": "e55e255a-55b4-4081-ba42-8f0492c7aa9a", "value": "4cdfa71b4281fdd50995864ab4f79826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2bbfd1-043d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686037182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037182, "uuid": "592f2b5c-fcc8-49a3-a8af-7e431e85b691", "comment": "Malware payload", "value": "ee334338d69baa04e0bc5a273fc2ae1a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037182, "uuid": "47ecf529-b461-4c87-ba20-60d0f3a9a38a", "comment": "Malware payload", "value": "bc3af4140b26daa0c2d3e1069f3e002c071ef869a89ebbf5ed5d21bffcd83808", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037182, "uuid": "bd71f59d-b789-4a0f-94e7-081eaa3f702a", "comment": "Malware payload", "value": "1718fb119f6c98693ce970dbf68e7d6ff5cc6b6d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037182, "uuid": "e587d419-ac43-4d57-b653-5ed2c8d55720", "comment": "Malware payload", "value": "7ac207daa85996ccf6873adb9c65e7b065755c98d42c3f18f483897c015d57fd684a46e9fc845bbc5de4be9454b626aa", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037182, "uuid": "0bcb0d83-82ee-479c-a7f6-e90627ad869e", "value": "T132672261FBD7CA26C3A74239427D2D3316168DD546C3A687590B3A284873FF84B47ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037182, "uuid": "0c7e0d6c-c799-4f98-ab07-56cf270d9376", "value": "786432:FTSgddVEYvqxJS6hntKous2UwmLquMkio1pa:F2gDoy6hntKous2ULqu6ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686037182, "uuid": "f2fc175e-1a70-44a9-8332-a934ecd491ad", "value": 31825428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686037182, "uuid": "cc1f9de5-4520-48da-92cc-67c573352ee0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037182, "uuid": "26ee9369-cb12-45f4-ab46-6d575e996450", "value": "MetaMask_v2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d3f0be-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686059316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059316, "uuid": "3f514ae5-5cb2-440a-bf3e-36aa877fadb8", "comment": "Malware payload (Formbook)", "value": "5ba4bab377c6656e50a48cd48bd84c59", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059316, "uuid": "2cc0428f-a618-4300-a66c-bb66b25c5bf6", "comment": "Malware payload (Formbook)", "value": "bc54380e0004ee82e6e6a07b4dc3c37481572257294fabc856248e597bcb8ccd", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059316, "uuid": "92ea7480-e27b-44ca-a3dd-4d21b44a8edb", "comment": "Malware payload (Formbook)", "value": "2b2a666c4608ec38bf7e4816c4dd46bee2502459", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059316, "uuid": "8cd26748-dbc4-4a82-9a80-599f1f744ff3", "comment": "Malware payload (Formbook)", "value": "58fb241a2774b7a3fad7c3d2ff3e93c64c2795932995545680761aef18987c7da6bd3822b3b5d2b55169a69619ceabf9", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059316, "uuid": "bbaa875a-e358-4e40-afa6-740bd36b1fec", "value": "T1A064CFED362072DFC857C472DFA85C64EA6074BB931B9207906316AEEA1C987CF144F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059316, "uuid": "7e00dc22-faf4-44e3-ae45-f2292ad0e56a", "value": "6144:c3QLMIdc1UkV3IM3tl72olNKGlkH+SYCIByNkjxBplE2AukfCsLPVSOt:OQFcSkVYA6yFjx1/ARCsLPVSOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059316, "uuid": "d2aaaa70-159b-4dc9-b4f3-775cbce6c67e", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059316, "uuid": "980c2047-52b3-467d-937f-cdca8fd9cb4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059316, "uuid": "e8162c61-ff39-42d6-8017-4fca37ac11b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec247dc8-0434-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686033584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033584, "uuid": "92d0cb23-f9a7-4bde-ac9f-fea3af2e8860", "comment": "Malware payload (AgentTesla)", "value": "931ca4722b0a56e4f1019f9823cc3ff4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033584, "uuid": "77b96774-4b4f-4d96-8f57-a569b9dd42b4", "comment": "Malware payload (AgentTesla)", "value": "bc5589866214e617b6b2c837f304660d6ee61d46dfaf99a56e79605ae7af277c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033584, "uuid": "6e2515ac-8a89-40a3-9f2d-71e7c02688a4", "comment": "Malware payload (AgentTesla)", "value": "937ed049eca33f9797955aa8d75015bb4fe5c91a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033584, "uuid": "518dfb1b-8aa5-4f3d-afaa-5d94a42c331c", "comment": "Malware payload (AgentTesla)", "value": "e4cd0e932848d283216cda239f0092ddcf6b355ede8be29d10ec65e755cb9df7afb9701b75c04993365d7f4470b7c6c7", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686033584, "uuid": "bf0ccaa5-a817-4e03-9193-b675d3fa0ed3", "value": "T170D4239E3DF292F1A5DCCDAD8B9BEDD3C4F10371862A4419625C113922E61D0ADA78FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686033584, "uuid": "f073f033-29f3-4b3f-aea6-c2cdf9afeeed", "value": "12288:+XzMTVeicKHu679A/ubph+YhXL1Y3lu4nkPkUhw+GWO0x58mZVblJ:+XzKeismA/WL+YT4nRUI0x5RbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686033584, "uuid": "b6802b2b-a4f4-45f8-871d-def4f8226740", "value": 600721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686033584, "uuid": "dd90cf9c-52e3-4349-a39e-f19617ed5e80", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686033584, "uuid": "8bfea78c-6b9a-4f78-9230-6bd18260bc25", "value": "PO 804704 2023.7Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ab4bfe-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036063, "uuid": "7cc99ae2-1423-4ee0-a7af-21b60f7f7ef2", "comment": "Malware payload (Mirai)", "value": "2a2166b5e4509c07286117cc407bf0c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036063, "uuid": "94384d9b-dee6-4310-b4db-4a7e0c1b9cba", "comment": "Malware payload (Mirai)", "value": "bd9fd6c30fe1630967c282b1044467d78818654ab70b671feb37a03edfc0da44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036063, "uuid": "b74fa14c-1222-4157-9883-48290b5a99ee", "comment": "Malware payload (Mirai)", "value": "d48b93c4e3f44b1d10d3600f2159fa5ead09d2b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036063, "uuid": "b63333c2-9752-4a5c-ad8e-c1d027faa640", "comment": "Malware payload (Mirai)", "value": "8f43f14c3a241fbb8dfdd48b3852367b1c4a57bf00710f16f9fa62da6e943f7f692e3ef3a4316099452ff427ee0b1df1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036063, "uuid": "80816746-3d0f-4efa-b113-bc1eba5eb31f", "value": "T1E9535DD9B8019D3CF84FE6BE80220A09FA31735151930F2B9BABFDD36D721656D16D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036063, "uuid": "0c15ca74-b8bd-4c14-853c-623e74c9f24f", "value": "1536:q8AeFryZALOodWghYWfKyI68WhS89q+daeswV:7hFryZ8Ood1YWCf4g+wzwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036063, "uuid": "d532fdbc-8290-4f26-8e10-b1aae4efa4cc", "value": 60812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036063, "uuid": "e9de3353-7eb7-40ea-b2d3-1e13232d7faf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036063, "uuid": "1bd8e08d-723b-4133-99c9-6444ff04029f", "value": "2a2166b5e4509c07286117cc407bf0c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5a3f58-044e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686044432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044432, "uuid": "51fefd7f-3368-42d7-ba6c-ce1ec53ad272", "comment": "Malware payload (RedLineStealer)", "value": "30ab384ff7528abb56b2bc2172324ee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044432, "uuid": "1d764701-b25c-4b2f-acfe-765a686e318c", "comment": "Malware payload (RedLineStealer)", "value": "be5823c29efaa6892b51a79052ffe4dec799fba75242ffa3427f020712fe0115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044432, "uuid": "209b3869-b975-4da6-b2a0-3d3990e4b9f8", "comment": "Malware payload (RedLineStealer)", "value": "1f59cd7b66fa481aae17dcd646acb4f2de91a80f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044432, "uuid": "8471a25b-e13e-44c9-b7ee-2eddd2d6d036", "comment": "Malware payload (RedLineStealer)", "value": "f0d04abea9ed5a174f6b21d3c359c315c19f107ed4cced4df8b8bcaa23b9ad80a550b751c732166cba12f7f90ebc8797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044432, "uuid": "7313fa49-ca8a-44a1-aec8-ab6f52d16ef5", "value": "T1B9D41216E7D54472D8750BB429F702830A3ABCA38668573B32159C5D1CB36C4EA76B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044432, "uuid": "d8e2ff90-c315-4def-8b86-b5a0ff6dbb38", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044432, "uuid": "106f54a1-483d-4ac8-ab23-98ead37e0725", "value": "12288:XMr2y90tnAKgqF8f5jX9qElOkxNUAS+x9qTf5FmZ7:RyWLgJNXICNV96f5M7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686044432, "uuid": "023973bb-cdf8-4219-94b8-e321d828e292", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686044432, "uuid": "e9f51b76-6f76-40c1-addd-ac9fb04b6b9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044432, "uuid": "9396dd3f-81a6-4caa-affa-a23932c12570", "value": "30ab384ff7528abb56b2bc2172324ee7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44469654-040f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017411, "uuid": "7d7b1b8c-3ff0-4bac-9540-334af4b4e252", "comment": "Malware payload (RedLineStealer)", "value": "59d5d24142c291ab36293355b3b494f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017411, "uuid": "3987d76c-334e-413e-938d-aa3849e5293f", "comment": "Malware payload (RedLineStealer)", "value": "bf748ec3ec65b7b357c1724db3de2f6eeb7718ea83b0e42062fe2c6c71628244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017411, "uuid": "5d1d62b8-8c3b-4462-af90-affcca9b1fe8", "comment": "Malware payload (RedLineStealer)", "value": "d44221de701e710ecfc88de42b062c3d60a9a9b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017411, "uuid": "802a1482-c987-4597-a56d-8d192e25e3e5", "comment": "Malware payload (RedLineStealer)", "value": "9a85e4dde53ddaec0794f56cc196eca2ecde74e6c121ded4ee1e1d9242874435659c28aad2e7f996f3cc4d7af0c04d72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017411, "uuid": "fbae8da2-abb1-4753-9f95-be1c40bbd61e", "value": "T1F5D41212FBFCD027D8B6177059F613870B393DA1AD78832B2785A89A0CB29C5597137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017411, "uuid": "f2338ad4-372c-4072-8648-11bbef9be41d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017411, "uuid": "4c765a01-0e24-41ae-a265-bdd419006713", "value": "12288:fMrsy90Fi3nvkvZF05CdC8FYQqgBM6NzEHkir5RLvqJ:ny0iXvOTdCyxW6NzUr/eJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017411, "uuid": "56049527-edf0-456c-82fa-b066e4aacd98", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017411, "uuid": "926c1154-0c3e-4de5-b845-8bb1444e9d81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017411, "uuid": "b60762fa-7a0a-4718-b7d8-e35f1ad1b282", "value": "59d5d24142c291ab36293355b3b494f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcb4bb1-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686054548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054548, "uuid": "ded6f099-5375-4195-802f-cf508cc9107c", "comment": "Malware payload", "value": "93181fe8838ba340547c840ecdc61bec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054548, "uuid": "7da0e90b-00f7-4e9e-b6c9-808bca80a100", "comment": "Malware payload", "value": "bfd88c2dbc77d192995433dc2855ecb782254237013e849b3c8c32e2efa8a2a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054548, "uuid": "972b5631-cff6-4441-a292-20e8b81fe8b6", "comment": "Malware payload", "value": "f1ec52d6735fc483942ccc998515957ef2bd4662", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054548, "uuid": "d8446e1a-8bd3-4444-8693-8620710e386e", "comment": "Malware payload", "value": "1fb67989af02bcd52f309ee665798a00da8371935a74106c2d5ba99e61da53ee8b69310d193760b0de429c1b1e3d34a8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054548, "uuid": "3c0a47e1-568e-4cce-966b-4108f1c2f993", "value": "T113A29229D38AC3B1EAD171F43247C752405E793027D0B88B3EE3777A64642DEB652A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054548, "uuid": "d7a24cb3-abeb-4ec2-80b6-1a6f86a0399c", "value": "0f3c64839e932c0ca9fa9a333320dfa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054548, "uuid": "d326468c-f7c0-471d-9452-85d588d7cedd", "value": "384:8RJUQoqk9ENlznv8mYNdpnOqseV7ToGtL198yONZ:2ddJv8mEplseVXNn8yO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054548, "uuid": "45dc889f-61cd-4ca7-b8de-54de6b586abc", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054548, "uuid": "c1786326-5446-404d-8771-323a2d7cc9a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054548, "uuid": "535806be-fe9c-4d83-ac21-d78e0c6034a4", "value": "SecuriteInfo.com.Variant.Barys.320444.28076.23329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592a0d15-0463-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686053523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053523, "uuid": "6b573666-35cc-4f78-b23a-aa6fc687e9dd", "comment": "Malware payload (GuLoader)", "value": "8081970a212f3daf2249abb85384611c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053523, "uuid": "bfff9324-1ce6-43f0-8abc-f2b2820e826b", "comment": "Malware payload (GuLoader)", "value": "c01119367072c1c37368da3c14e800e66f9e3f89d304612686ecad896af6daad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053523, "uuid": "70b624e7-c0b4-496a-a4a3-0e389808f726", "comment": "Malware payload (GuLoader)", "value": "a186e350b3cd30fbe157077aed389aba452185e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686053523, "uuid": "a3779333-f381-4237-932c-50fb965a18f5", "comment": "Malware payload (GuLoader)", "value": "72646e31ef0ea1aec15f2f16ec40d296a4b37c8e993a571f617ba7e353b82cdb08d644292c605816af94fa4b6672e963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053523, "uuid": "63af2748-a8ce-401a-b6cd-58709ff96c50", "value": "T164D4AF93B7074177E808A936723B4BE369732B8F92E941BA1191F73C51726311EDF226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053523, "uuid": "93a4b6b9-9e1e-40fd-a92a-92bdc769068c", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053523, "uuid": "136bb4ed-82bd-476d-89e3-2e890c5d0aa2", "value": "12288:Uoqqqqqqqqqqqqqqqqqqqqq0qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqF:U12FGRxFukDzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686053523, "uuid": "459edb0c-405e-4ac8-a193-61a6275bd30a", "value": 625852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686053523, "uuid": "736a9b86-fa07-49be-8bb6-f5d79ea70071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686053523, "uuid": "50652ca2-5cde-4f56-ae8e-96fe583e3b95", "value": "A08000143_ESP_B64891013_ESP_823041009945_20230405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbf5d98-047e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686065292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065292, "uuid": "291590a6-1844-4498-a8cc-7524533efe30", "comment": "Malware payload (Formbook)", "value": "d39050a4b6ef3f4aaa5808d30501d4fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065292, "uuid": "676bea55-b8fa-4f87-8a80-d979bf0469c5", "comment": "Malware payload (Formbook)", "value": "c0bb580c3dde7904d5d5153e20e7bc81c34b7c3bf120aa8ffb7bf1f87753dfff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065292, "uuid": "d3795187-fca2-4bba-8d34-c46aad3749cf", "comment": "Malware payload (Formbook)", "value": "94973f7bed70958e2d03bced0f57d1d12f2d3c74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686065292, "uuid": "ac7cda12-d3df-4fd9-ba85-bf83f8a0a922", "comment": "Malware payload (Formbook)", "value": "d60d5ac65e6986c7a3bfa42b33623748706068a63eac52feef6051e9ecdbfae4c1ca6b38759da0717a6b1687310e604b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065292, "uuid": "5ea8e344-2e5b-400d-882e-763e95f185bb", "value": "T11C922918B3F8C322E5EE4FB568B31280137BB7BB7463CB0D5AD850A659527C086527E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065292, "uuid": "9c110564-a452-4a8f-84db-641280b0fcd1", "value": "384:SAHZSCDIGODfNIb2kQG217SXBB1VjNCa21kjMGBFD91zfgHm+zbMgodF:7ODfNIbD2RSXFRd74H4dF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686065292, "uuid": "9a4a4ebe-4cf8-470e-8185-9c50d05c33df", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686065292, "uuid": "97618748-4236-42ec-bf01-faee9963c776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686065292, "uuid": "c2e0a9c1-f595-4b41-939c-0d9e3f2bccde", "value": "SecuriteInfo.com.HEUR.4358.27211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9204ed0a-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036009, "uuid": "e2e6a3af-3981-4a12-9b6d-816cc21fcb8f", "comment": "Malware payload (Mirai)", "value": "e568cd8f2c5213db0c988108d579018f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036009, "uuid": "200b75f4-5861-4e86-ae69-119df62e52cd", "comment": "Malware payload (Mirai)", "value": "c0c8da58156d8c278852173fac532807809957ed22c411cf47fc65b5c5e910a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036009, "uuid": "bec79cdf-c5ef-4e51-88df-0d9a5c07c5a3", "comment": "Malware payload (Mirai)", "value": "fc076a2666441f870fb4673dc398979fb6571e95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036009, "uuid": "4d23584b-b6f4-48e5-ad63-1bb38d4e5caa", "comment": "Malware payload (Mirai)", "value": "be9f1f8c7bcdac813660d7ffb033f6128bb279ef466001695e4d7fd426e08fd66bec2bb10a015ae1ec69c4fb1f487f5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036009, "uuid": "d8d68d4e-9b4b-4f26-82c2-3ad392cf9414", "value": "T161D2E174A28638B1C0F11235FA9C479A058B2EB4D0FF727776141471BEF728A3BA15E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036009, "uuid": "9b48c568-f203-449e-a8dc-b80ad7145fed", "value": "768:wA4uBc0T/nVvqV072G+IFYoXHZCx3GJsb9s3Uozw:wPuB7/nVMYn+Kf5zzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036009, "uuid": "1f0a764f-c94d-4aa8-aca1-73415d56876c", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036009, "uuid": "809ccd14-ff3e-4906-b5e2-fb87edea73a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036009, "uuid": "b0de149f-157b-420a-8265-bba1df40192f", "value": "e568cd8f2c5213db0c988108d579018f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c86877-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686018026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018026, "uuid": "dd98b3df-6f6c-40d8-adb6-713a34bac3aa", "comment": "Malware payload (RedLineStealer)", "value": "ea3f5b6cfc2a5334e478ac21e703948e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018026, "uuid": "1071d57f-dce4-406e-8d62-ec2659b7f361", "comment": "Malware payload (RedLineStealer)", "value": "c11cbb1c2f70f4563ddcaf23f1c7072590782f3d89d8143bd2cb1e74f804c5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018026, "uuid": "ef507190-d3d8-4df8-8e8f-deeeefea2dd9", "comment": "Malware payload (RedLineStealer)", "value": "2545af88d881c7d395e06721c4431b21bd8cc2cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018026, "uuid": "46633489-0759-4034-8eb2-2511943dbe06", "comment": "Malware payload (RedLineStealer)", "value": "095fbcca942fbcef95f5b22f9c1f64784268cc07537fbf2f53f219c6057fdd6b49e80df3586d37149f07df05787a6ceb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018026, "uuid": "c53b1f56-0a70-4ec6-bc31-18c4cb75de21", "value": "T1D61512035BEA2432DDB0237068F743D70A36B8A19D76831F279959DF2CA36989432777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018026, "uuid": "97b38988-b03f-4fe4-bc5e-bf622d7bc73f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018026, "uuid": "2cf687a9-774c-4270-8b87-130b6e03ac65", "value": "24576:RyWVlmTtoUKSRYoFjMf6AQ69YTExgsNeJwS:EQlmTt/YAMdQ6+ExzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686018026, "uuid": "e97e0de7-960a-439d-a16f-69e5b5214edb", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686018026, "uuid": "65483695-6d60-4522-b223-c49205df19b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018026, "uuid": "0a008507-7ab9-4914-aab5-8f2fa8571836", "value": "ea3f5b6cfc2a5334e478ac21e703948e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bbfee9-046b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686057038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057038, "uuid": "4543c680-6662-4f0f-a44d-c9b60aad0194", "comment": "Malware payload (Loki)", "value": "b4f1b4ec9732645c73e73261815a2d88", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057038, "uuid": "d46c6252-b228-4316-aa06-dbc08169c9cb", "comment": "Malware payload (Loki)", "value": "c168fbe77b50db29e162c513bd6ab692d4a2592b098f17fd4a12a117b207a5c3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057038, "uuid": "540a8dfc-311a-48bf-9cc6-07334643c27e", "comment": "Malware payload (Loki)", "value": "5922ed5ddf4a62322d0909de47ef0034ed487eae", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057038, "uuid": "56a78046-a105-4d09-a2ed-c3221d18eec8", "comment": "Malware payload (Loki)", "value": "aaab09b1eff4f61f30da011550bf4175e09468c4b92a2fbaf87e9dd585dab05aa0aa6b903b7fbb6d0dc0fbf9ca1dd2fd", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057038, "uuid": "3dd4a918-fdd9-450b-ac68-ddb2cf65fe92", "value": "T18BC4233B294E473F8D33D6531AE4160BE6FD899991E04CD71AEFC5AC48DEE80931119B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057038, "uuid": "91c59498-1d7f-413c-a7f0-aa9999c24ac6", "value": "12288:e3B2iSnpd6lw/9qGU5hi2eM8IO9Wc6E52a9CfqdoiYpkElskMINcJwlNg:2B1SnpN9qnh+ToKaS6N/NcGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686057038, "uuid": "0f4961c7-37fd-48ca-b858-004e82375004", "value": 555590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686057038, "uuid": "42fd338a-7540-4116-92be-b43b57bac32a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057038, "uuid": "cc2859f8-f83f-48fe-a525-70c44d722551", "value": "Suppliers registration form.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff53d9f3-040f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017724, "uuid": "ce4b68d4-7116-4366-9d07-550e11b8e7bf", "comment": "Malware payload (RedLineStealer)", "value": "601c49c46b829ab6f9628db2d7fd5ca1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017724, "uuid": "9e408cd4-47fa-4c43-8f2d-efb40d2003a7", "comment": "Malware payload (RedLineStealer)", "value": "c45e3c52f6d5d3c081dc9f70853caad11f7972f6ce6091a632f4de99727b7428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017724, "uuid": "1f11141d-88b7-42d4-9d1a-eddc9dcabae8", "comment": "Malware payload (RedLineStealer)", "value": "8c1f609b8e05394c5c26643b04ec9781c092d260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017724, "uuid": "9f1d2bb4-7eba-411f-9082-aab2e4143216", "comment": "Malware payload (RedLineStealer)", "value": "e5ebe51b5ea2f492bcf05d73df6f78784404a712a7a48606ad5b4ff8ffe6f884d2db6cc54d365de311d65503322ec607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017724, "uuid": "a81c5b06-62ef-4acd-9cfc-4a5a8c381ee2", "value": "T16BD4124296DC4073D9F167B01AFB1383063ABC719D78836B26D9E81E4D72784A931BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017724, "uuid": "3e86a9e8-d61e-465a-9cc2-61b516a4b3cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017724, "uuid": "22ad085b-1516-45a1-a224-e0aa436e1a5d", "value": "12288:IMrWy90UuwWDGWHEDYUTrmPOgCloHOb235rc5815PHv9Y:eyTuwOLk5X39I5rc58bPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017724, "uuid": "90c09e43-9ba5-437f-a0d9-c13846140f2b", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017724, "uuid": "0c1e02c3-dc8c-4c99-86df-acf010b76ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017724, "uuid": "5ea00cb4-31d4-4f2b-89ff-f1796ec90cb3", "value": "601c49c46b829ab6f9628db2d7fd5ca1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bf7037-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089973, "uuid": "b3ea9544-c8ea-48e9-b0ac-7962b9401189", "comment": "Malware payload (Mirai)", "value": "a8a089f73235a23326c902e1a68376be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089973, "uuid": "930ff21f-75ae-4a9e-98c1-ce0a86613a78", "comment": "Malware payload (Mirai)", "value": "c51e387becfcd678d499010bdcfb64ce80961b2c62a46c28e8ec31f00aec85cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089973, "uuid": "889ba44d-3e41-49e2-9ab6-1491b403565d", "comment": "Malware payload (Mirai)", "value": "fe67713c639e4141bc675dd88211978f617758fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089973, "uuid": "ae801305-41b4-4d3b-b3e2-1c29c4875385", "comment": "Malware payload (Mirai)", "value": "5635939e492f4b8bfa14a22d85a87d751dda367ade34b18d80cac3a7af47a8fd3eb135785d163f4948581988bd64df62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089973, "uuid": "37c98e09-7e60-4f4d-aee1-b7ddf7324734", "value": "T1A3533B15D657D4F0D90209B0106BFB76AA36AC362120EEBBDBD9FE73BD61E42904325C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089973, "uuid": "ebe66dd1-5032-4589-8b48-8e9c7a81d451", "value": "1536:DOrfWfAouzQjrYHOSlXoEFFX4SOGHyqe4:DuuAouUfc/FFXLHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089973, "uuid": "180b2e47-d416-49f0-8f96-6604ccb3da16", "value": 62148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089973, "uuid": "651f8bcc-bbad-44a7-b00c-538e19abd961", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089973, "uuid": "ce41b2a6-806d-4a17-835c-5851568dc643", "value": "a8a089f73235a23326c902e1a68376be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9624dca9-043c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686036875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036875, "uuid": "e00cf7ec-ecc1-47a9-8069-0d11d99f0878", "comment": "Malware payload", "value": "7b03234af94f90aefa50668b40976b0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036875, "uuid": "a0ad8c36-fe0f-4933-af6a-48bc91f7c1b2", "comment": "Malware payload", "value": "c55ef5e7232f8aa0bbc8fabb66324941b043f594e4ad9618ff43910878f9377c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036875, "uuid": "df59d281-f6ed-44fb-b213-fe5522341c83", "comment": "Malware payload", "value": "d34a1f505c854476f11477eb2332ee28885c3034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036875, "uuid": "d5a077b1-e30d-42f3-9d06-f66bfed38799", "comment": "Malware payload", "value": "f5304e9ed92c42aee4065dd68e14c99f3a56ea85b13b2c50d127d4bcc103064e3e07a3a1f580e649e463af269884475b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036875, "uuid": "eff06d5a-d3e4-4db9-ad33-561a8c82417f", "value": "T191A5E80A76870CA8FDEA32B2D1F296644A20F7629F37C06F358113D957D92C35A6C367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036875, "uuid": "2d078598-e063-4348-b490-b2c4ed2d99ed", "value": "12288:Dma295tJLK7kyIV9PgyCoCkDLlwQEVrGjrU/H89bCGq6144m0tNDnim3D7NUoXey:D2fqnholHlUKfUv2FimdUO+9b+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036875, "uuid": "1e19b2e8-b2c0-45c4-9d63-13dadc6fa9ef", "value": 2120704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036875, "uuid": "c396793f-5c26-4cfa-a2e0-1aab27a0d702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036875, "uuid": "82944aaa-1aa4-43c8-910f-8fdadc88d692", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2351d65-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036037, "uuid": "3c5a8d2b-c40e-4f20-b161-d837d8aa063a", "comment": "Malware payload (Mirai)", "value": "96b29afdd6b4ca2faed26ab7300d0d6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036037, "uuid": "1b60913d-0745-43de-9bd6-74036faaa6d9", "comment": "Malware payload (Mirai)", "value": "c58d8169bc8be1d25da9b608c46b47ea58aaa2d70a3c6713cda3cf3d9bfb6290", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036037, "uuid": "4641655f-6a44-466f-b35f-e81d5c6ddb38", "comment": "Malware payload (Mirai)", "value": "0c02a5c791e534f62821b3f53e751fc788df1eac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036037, "uuid": "fe89748e-7848-4997-a5fe-955b76bc2ca9", "comment": "Malware payload (Mirai)", "value": "1278062adfe33c1a8cbf3203345d49ac625577f024e9a00f499d9afdae3d617feb6c69b4937d2a43dbf9b0078fa1870e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036037, "uuid": "c269bf35-57d2-4bc2-9e78-37617f9141e4", "value": "T146537B316A7A2E17C0D0A07E22F34754B2E0679E36A8C61E7D721E4FFF25650A40B6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036037, "uuid": "71c978c1-7bfc-41b8-b9b7-aa6ebca8edd0", "value": "768:LuoVS5CjwAE+RU+fECef6Vq98btPpqoXdC12AgYMO+EkqrwJh+CVNUZ:LuXkjY+RU6ECef6VS8bxpqsm21f9VNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036037, "uuid": "dc5dd0f3-18b6-49e2-98d4-060978cdccc1", "value": 64768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036037, "uuid": "fbd01b74-03e7-4bad-bb0c-714070a88a03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036037, "uuid": "8b1a70e7-fb39-42b3-be00-1a8ecd58a818", "value": "96b29afdd6b4ca2faed26ab7300d0d6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c9bdec-046a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686056739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056739, "uuid": "fd6a6463-ced1-4c7e-b6a8-8a1e353ba7ae", "comment": "Malware payload", "value": "e6a09c3f037fefaaec5a01fe9a45ec0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056739, "uuid": "83e3929c-be66-4f03-9f2e-9a014a29f7a6", "comment": "Malware payload", "value": "c6021b0eaa95a92d7546b5943a74fe64022baef337409a0f9baa21e0e5217e91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056739, "uuid": "35f029cc-549a-4c63-9d55-dea4a6251913", "comment": "Malware payload", "value": "def86754c160e3a635dd092335f003a5dbe8a43a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686056739, "uuid": "75f4a7ba-f5bc-4d79-9561-1aa9c06639ef", "comment": "Malware payload", "value": "76d319783751c7d32c2874a42d76f6b7cc5acabd834941143e6486ad351563c2a94d03771e901e9d1ca436972ad38d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056739, "uuid": "a29e71a9-ffd9-4385-98ff-d891726ff69d", "value": "T18B15129C23B7046EC6AA3FBD4E01C6B5C6F41C56B913D18B8EEBA99CDF106450EA05C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056739, "uuid": "27d5a800-d06b-4c73-b610-4b99b1d22958", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056739, "uuid": "fadfd699-fc11-4a21-ba68-6cfc670f5bdb", "value": "12288:v/2iNUewx/NscEQ+vgXK1HsajwseGaBxu+gxJvUGFHaMPQhnvfHSxxEZdz+JQQGK:31iewlqB6pMOxuZU/MPQoeqqQG4Jlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686056739, "uuid": "9a7a8c9f-7b4c-4c72-955d-d557bea4aa1b", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686056739, "uuid": "4fab633f-ec27-45de-bcfd-eebc6bf80737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686056739, "uuid": "be50cdb2-153d-4f44-bdc0-04c95d4a6355", "value": "obizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923e7d44-045d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686051042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051042, "uuid": "e3868808-54d5-413a-80da-342dcdc1b7be", "comment": "Malware payload (RedLineStealer)", "value": "4fd73b97e5cafadfd9e180ebab390001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051042, "uuid": "a2105797-27fa-42b7-b587-9388dbb4a935", "comment": "Malware payload (RedLineStealer)", "value": "c612fffc0085b0aa52db0740bf0414806671a08d68e1fd0e755928af886a26a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051042, "uuid": "9d865974-a93d-4192-8277-ce37ab6fb923", "comment": "Malware payload (RedLineStealer)", "value": "8d0aa05d90c6d1fb87a006d0139a62e9766861fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686051042, "uuid": "781b804c-bc13-4a62-92af-9f3db73d2090", "comment": "Malware payload (RedLineStealer)", "value": "1ed7874a11caae88b1f2e69cb19dbaa0ad783124dfc9a18f5c44d69d028e5f31cedfb9ceaab86f5d76aaf2bb8ea59c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051042, "uuid": "36cbd32d-9e2f-4d55-bbb3-3ca28b80d524", "value": "T139D41242AAE850B2ECF563B054F703531B32BC906D78876F2795A8CE1DB3791E53136A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051042, "uuid": "1195c21f-b534-4c4a-b9f5-98f3d1987db4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051042, "uuid": "d19844e1-89ba-4ea6-b970-275a44ac406e", "value": "12288:ZMrmy906d/ZtJ2AOqOD0Acf2tWIPgZXPyaC5+BYruKqgpd:Dy5Pz2gORcf24OgKH+BJzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686051042, "uuid": "77b5ce5b-e445-4843-8957-71267a004f05", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686051042, "uuid": "3638e96d-e128-41a1-89c1-5dfe213851fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686051042, "uuid": "cc684615-e7c7-4e28-ab54-284c28c78c9a", "value": "4fd73b97e5cafadfd9e180ebab390001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5498b9-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036005, "uuid": "a46898e2-67af-49b4-89d9-c37b1460728d", "comment": "Malware payload (Mirai)", "value": "1e6a3441c0b927ee3a1e8a5691b85e1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036005, "uuid": "4720a9f7-a9eb-479d-86cd-2d7fe95711ee", "comment": "Malware payload (Mirai)", "value": "c67ddf8833da08de6e35ec4796127adefe6cc85ecda0a002065c029a927f3031", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036005, "uuid": "35fcad26-eb4f-409a-be29-0944ef1de57f", "comment": "Malware payload (Mirai)", "value": "ab58a24237d39a5535d4800ebef378924a7277aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036005, "uuid": "a40bc116-6060-4b09-8d9b-bc4b038c558e", "comment": "Malware payload (Mirai)", "value": "85151d3960a6523b5593f9ea3c5b0d7f378e72047493bafec89b80236bb3e2408164338f23da720cf7887ded8850183a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036005, "uuid": "5901d4db-ffc4-45eb-b00f-b44b8ec81d99", "value": "T100632A03E9629F77C0866EB522E75D300B53F9911F4B17857139AAF807479CEB80EB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036005, "uuid": "77c09541-0ff8-4af2-8ef1-af350863fe13", "value": "1536:r68JyUZYJPKjxnjp6SCYKWo8m2KVqlLhVf5Ee:TJyUrjWS3N9m2KVqltVf5Ee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036005, "uuid": "08607d40-6e24-404e-87bc-f03795888b96", "value": 71847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036005, "uuid": "c13ab23d-defd-49c3-99c6-d15ccae5b765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036005, "uuid": "f6c787fc-3d53-4821-a1f3-ea16aa0d76c0", "value": "1e6a3441c0b927ee3a1e8a5691b85e1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25718201-03fe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (OrcusRAT)", "timestamp": 1686010057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686010057, "uuid": "9585e8dc-a838-401c-8cb8-9032ba3ca527", "comment": "Malware payload (OrcusRAT)", "value": "12f8a4a361c7ab3345c4070501bc33a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686010057, "uuid": "71377e01-82f7-4ffd-9376-5d1695d604c5", "comment": "Malware payload (OrcusRAT)", "value": "c6939bc875f81b901808a9ec37c55f1254f068cee9580fc84c2c8975c24d021b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686010057, "uuid": "ab48aa05-02b1-4d44-93a2-f765f13a01d9", "comment": "Malware payload (OrcusRAT)", "value": "2588391add0c541684b05908acfcc1cd13f8411f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686010057, "uuid": "b4841ef4-e7c2-47d4-85e0-8f500446038c", "comment": "Malware payload (OrcusRAT)", "value": "a29b02edac3e97eb9d1f06558eb9ae40af6869d8445c7ecf5a4b02388c9741e49310f110a6e65bc087741ac2fcde0060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686010057, "uuid": "41b9b76f-dbef-4634-8cb2-f697ee5fefba", "value": "T1C796BE013BACBD06C1BE2678A673DAE80778EC066051FA4E04D86D9F3DAB701BD55367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686010057, "uuid": "c0fd4a11-aab4-4699-94f3-a042f42e4a1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686010057, "uuid": "a2e10f83-3f5c-41bd-98ff-35d78b0ec2b4", "value": "12288:yXBM21gsgPktzYX7dG1lFlWcYT70pxnnaaoawUjKgRRAJrZNrI0AilFEvxHvBMFr:duQ4MROxnFSgHSrZlI0AilFEvxHiAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686010057, "uuid": "98b1f87c-165e-4a92-bf1b-03de390a03da", "value": 9437183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686010057, "uuid": "e8d09d67-f2b6-435b-b3d5-3f9ba7397897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686010057, "uuid": "58ee0abb-0318-48a9-9368-5e69db4ae6b3", "value": "Extreme Injector V6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab8bda8-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036024, "uuid": "b76d6ba3-bdad-4500-9622-ca8e12483a43", "comment": "Malware payload (Mirai)", "value": "30d55d167130b5757ab59ee7afb47ec6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036024, "uuid": "a6a67a03-768f-47c5-a05f-fe89b3f49c97", "comment": "Malware payload (Mirai)", "value": "c7029f79f75f79d000859cf836e383dcaae317d8f8c26c3ad20cda598338ee5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036024, "uuid": "04021cc8-c86b-49e0-9085-144ab8bb5380", "comment": "Malware payload (Mirai)", "value": "f2c42e82620b6c924a88374338bfddd7e8b4df87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036024, "uuid": "6617d26f-efe4-41b1-94ae-7301240f9134", "comment": "Malware payload (Mirai)", "value": "28da0208e3c32c0b5ef0045e3e6ff2f3b41b671566d16e03d85efe83f1db3e19b8b47ca30210da2d5a3d49cc3ff50112", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036024, "uuid": "40fcf79d-33ff-487c-b265-6924822d707c", "value": "T181E2E15FA2E42EB6DF8C5C3E128C0A79FBC6685713649B89232544C4EB6D498F8DC43D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036024, "uuid": "3c7acfee-652e-4196-8b8f-6489f08dea7f", "value": "384:A3fpCLrsjHIX69URc+hmnulY1qHprFKt6zhS45vDajssVwfo++a3FRWGVCz0Nv2I:4fpWcehzJFYKgULAssKfoBa3zWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036024, "uuid": "4ca47917-fa61-44ef-b210-a6dedb20b7cb", "value": 31960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036024, "uuid": "43c22193-af02-44f5-a5f6-398413e3a1cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036024, "uuid": "a0bcde43-feb6-4558-a8ad-a3e020a77075", "value": "30d55d167130b5757ab59ee7afb47ec6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14f107f-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036089, "uuid": "55d3284e-347e-4cb9-8d5a-f74f67fafca6", "comment": "Malware payload (Mirai)", "value": "757ce1803f99ac864a4a891a4b3e6285", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036089, "uuid": "6ccbcaf9-4907-455d-93b9-3421478baa14", "comment": "Malware payload (Mirai)", "value": "c8144a3bd89e809b13b985681d301092551c2a37160fa75ba6664bc633a5d1dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036089, "uuid": "f40779d2-02a5-4ba9-9c14-60d5f8abf1b3", "comment": "Malware payload (Mirai)", "value": "48ad1eb74a2ba00ffa0458104f2ff790c7460687", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036089, "uuid": "6110933c-0484-4d93-b65e-4ac689be9295", "comment": "Malware payload (Mirai)", "value": "45c22176d3264a46d5e68061afd25defcb78357d514c6a58802bb020f9599729df2f66651c3770df88c100874f5ce6c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036089, "uuid": "c1693124-713a-43dc-8be8-2fd5e9b2a9ec", "value": "T169435D42322C0E57D4A61AB0253F17E083BFFD6014F4BA84694F9B5A8A35E771586F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036089, "uuid": "b3762942-7f6a-41eb-ada8-696b136d9075", "value": "768:4YbRczG0TQrVR+9BxAJ5yaPvY2VuRvRxE1QCUgkH0RjT68Hco1ksG36nZ71dUV:b35rVm2BSO1QCNjgo1ksGqnl1dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036089, "uuid": "6b91e91c-c0eb-4802-9671-302b9c6c2a65", "value": 59880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036089, "uuid": "f40634ef-e2b9-46b7-a32a-67b0221a4c6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036089, "uuid": "6f424924-7c36-466f-9246-d063581a4a09", "value": "757ce1803f99ac864a4a891a4b3e6285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214796bf-045b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686049994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049994, "uuid": "348a7b93-9de9-45bb-ad89-9decaff9e8bc", "comment": "Malware payload (Mirai)", "value": "b96647abd3bf0d4edbe8f89d712cb272", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049994, "uuid": "625918c9-9c4c-4c98-8e3c-c36d42ba37f6", "comment": "Malware payload (Mirai)", "value": "c81c3b1d3a6f98d375f03aa184011b4f35ebba4e9abe312f29c3648d2904f80b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049994, "uuid": "5c9f64a4-f9e1-462f-9482-d84792c53c32", "comment": "Malware payload (Mirai)", "value": "6a4820387a9be785ce7dd91a372f7c7fd9a3db2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049994, "uuid": "f3262c7a-e462-4b35-9a0c-88942d798ff9", "comment": "Malware payload (Mirai)", "value": "cab2051f8a1259ae5d74d9d962abd7c0efaca53631229ae2b19826f74c107cd68fff232fa7fcf384c8bcfffff40b1d37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049994, "uuid": "1997a0fc-82ec-4c1c-8338-3aaea39905b2", "value": "T18F337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049994, "uuid": "3d371460-2fd7-4e7c-b18e-67a5f57063ee", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvX:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686049994, "uuid": "0523626b-f868-4349-9744-5d1e2f1abd95", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686049994, "uuid": "fd017e14-8c12-4dc3-b1c7-91928a2ac85c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049994, "uuid": "2d0a615e-ec63-44b1-a32e-69b208cea802", "value": "b96647abd3bf0d4edbe8f89d712cb272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccc586e-0483-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686067139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067139, "uuid": "b19c0ea0-df97-41d3-be75-9721521a0282", "comment": "Malware payload (Formbook)", "value": "d216f97d9061c4f779f6df79fe6bc446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067139, "uuid": "9b3c20a7-3f5f-4c30-ad1b-72c2785d6778", "comment": "Malware payload (Formbook)", "value": "c88bd050908fab9335adb9750835b3dd14ed46d185e69490182c5a8e327e41db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067139, "uuid": "1eabf090-e585-4412-9d82-d8bb9b1f69d1", "comment": "Malware payload (Formbook)", "value": "3e508c0336da3c56ca937bb3f1ba10eb88519855", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686067139, "uuid": "67520428-9989-4461-9917-d73445bcd6de", "comment": "Malware payload (Formbook)", "value": "06467070cb81042ab8954ca9f904b26d04f2ef849b156052a721bb6741c57a11dbd2b3b766b8ccec471c5444ca29f397", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067139, "uuid": "9abc2093-4d1d-4264-80eb-5de32d6b893d", "value": "T15035E0D817254E4BC041377C9F81EB398BA44EF06A11C11ABAE22EBFBE7E7519C42711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067139, "uuid": "2c672543-b8fd-4849-8962-58488f10d858", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067139, "uuid": "7c558650-1b59-4bb3-81c7-235a67b5904f", "value": "24576:g/thewlqB6pi2GEmcY5+ktI2g0o7p6Pbb5EYthkJ+8Peq+8my:we2q8pPGEmR+ktI2g0/5Emlq+8my", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686067139, "uuid": "53dde1c3-5531-4655-acc1-d035780ed7c4", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686067139, "uuid": "e1eb5ade-d6d0-4639-8655-4ac1c2f4b64e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686067139, "uuid": "bd2337b6-3757-4c90-bc5e-28add1b4df08", "value": "RE RFQ-Huada Superabrasive Tool Technology Co., Ltd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cb872d-044e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686044438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044438, "uuid": "3f98dfe8-1588-4ead-8616-dd4db5aa4033", "comment": "Malware payload (RedLineStealer)", "value": "53e5e40a649b942e9b3e1562bceedd4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044438, "uuid": "aa9007ca-5e94-4085-9031-a82db690522d", "comment": "Malware payload (RedLineStealer)", "value": "c8bccbaee1f3570d090d5c1b6ce8c8576b48035727d59f632738c35864d19684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044438, "uuid": "2d3b8f70-3a4a-43ec-9357-c153c81854f5", "comment": "Malware payload (RedLineStealer)", "value": "d4ec9ace64d5e46a7c04b60adcee7c9b35cd6da2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044438, "uuid": "ba95f00b-9eff-4608-89eb-5bd8566d3202", "comment": "Malware payload (RedLineStealer)", "value": "c14a00f2819dc2b0e3937490a3528cee659cb2e19484647139bdbe40920a816253cd0010b53451bd9e8106b54e423b3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044438, "uuid": "95a2be22-31d6-47a2-823b-cf66ed70bffd", "value": "T1E1D41202EBE94973D4742BB04CF303931B357CA19978D3AB6B44A95D0CB2698E87177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044438, "uuid": "bc939d79-8acc-4d88-939b-65fd47638a93", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044438, "uuid": "9ab6de28-836b-41f0-8320-66b5ebb31940", "value": "12288:RMrmy902j9EZR6TJHi6GX8JSxrQQzVcd0N7cKBGRxkyNWfAXEsQO7IjPTh:byBMMH48JStQQRc+4GGcyMfAX9FIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686044438, "uuid": "5ec55b19-f07e-4b26-91b0-908396c1c476", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686044438, "uuid": "388dd297-fa28-4d5f-9fb1-695d60630df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044438, "uuid": "537b9945-44a9-4f6e-9c3c-840aedc6204b", "value": "53e5e40a649b942e9b3e1562bceedd4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2966d8c-0430-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686031876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031876, "uuid": "9ce1d773-dcfa-4583-ac96-e6d24a2f4cfe", "comment": "Malware payload (Formbook)", "value": "1499fe3130277df55baff73e4b74afda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031876, "uuid": "09b02833-fb7c-499c-999a-8a0e6bcf5613", "comment": "Malware payload (Formbook)", "value": "c8c05a269a36f55703b101b52b67014daf3929df328609f50d6b339bc9df5bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031876, "uuid": "fcaa693d-eebd-4f6e-9d34-b3cfe5867ef6", "comment": "Malware payload (Formbook)", "value": "c83dabdc4e5ebfa6105bf8c3ce6ca44a12906ef4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031876, "uuid": "396da6d9-01df-4a1f-ab2f-330c2a0c8329", "comment": "Malware payload (Formbook)", "value": "82c2cae2766f8a7a911db6b2272322f82c5c4dba4590d68dd49df2b17f1c29b87a1a1095b09d68bbd457debd5e2d4418", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031876, "uuid": "ab60cb71-2ea2-4d61-bead-78a39b3b9a33", "value": "T1D15412543570C467DD670731583A2B6ABBB2682325F2924E23E0B76E7EB6341C50D3BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031876, "uuid": "c8e69385-d32c-4b45-ab2c-a37de4b055d5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031876, "uuid": "3b9cd79a-e28b-406f-81b1-ccc7c1da0b80", "value": "6144:JYa6rn/GRB+ruuXxAqdu7KQheHqE6U0RROLJBMo48yuf5xdzOBTh4iAF:JYdOEAIIh8qjSUSzJYDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686031876, "uuid": "52ceafaa-6cc4-4a13-ac05-2df11078af0d", "value": 297112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686031876, "uuid": "853e2acb-169e-494c-bc54-fc282407f8bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031876, "uuid": "993f9437-1555-48af-b97f-1e2cf4a5b6d1", "value": "INQ No. HDPE-16-GM-00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db4d093-048c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686071140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686071140, "uuid": "31391b02-e77a-4d90-8b14-e0b3b26bb69c", "comment": "Malware payload", "value": "61e6735126b6504424d090ac796f8a49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686071140, "uuid": "5cfda6b1-84cd-4f90-888a-b49e2791b824", "comment": "Malware payload", "value": "c8e45719240f875784086abcc66cdbf68a102c1d3d5edabb0c7da44516621e51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686071140, "uuid": "980f849e-af52-4c6e-b52a-77ea26da13f6", "comment": "Malware payload", "value": "7e8838d573b193beedfa12ff74e1e4933944587a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686071140, "uuid": "21434664-f924-467e-98ec-f37736a7a670", "comment": "Malware payload", "value": "67ace54548a41c612184ae1fa1c41abf39a4cbb4b15286e3753b0acf6ed9b41e0fb9c61b1c43cef1a35ee248d1bc9dfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686071140, "uuid": "8bb7157b-85b0-4189-9ad4-796efd49f05e", "value": "T17F87239366C063E8C3C34518628F529F51C1987AC5FD9E1D6EC36C032E21EA76A4EE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686071140, "uuid": "7d023d3b-0688-4046-88c2-5d79781c85f1", "value": "22a71214a0c9214caa6b4dfa0b409cb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686071140, "uuid": "167a1857-2591-41e6-a5e2-ee46ccb92a5d", "value": "393216:NS3GX6iThaMcP5L56QHbe/klf3FWpis6n93CnVspY9rw20amy/dtzEvQ4iD6t+t2:a3iTkFVBn9Tpkw3dUzMri2ty7I9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686071140, "uuid": "d4a02f92-53d9-4e52-95d4-2546a9d066bf", "value": 38811256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686071140, "uuid": "d97cae0b-58ca-42bc-bc42-45a8e3f868d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686071140, "uuid": "0753eeae-b3b3-4935-8eff-ab198437532e", "value": "bank_statement.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d5d190-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686018027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018027, "uuid": "03b712f6-b238-4216-8862-94f843cc727f", "comment": "Malware payload (RedLineStealer)", "value": "f80b96d73669e7f3e20cefdfb33e9287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018027, "uuid": "df9cc8ae-4cbe-4aa9-ba50-3f1ab208aacf", "comment": "Malware payload (RedLineStealer)", "value": "c8f561531a61e3e3d05fdf3ef55ef42dadeed8904af678259cb8ecb071795994", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018027, "uuid": "c75eecf8-fbc7-4723-b431-b5bd9400c6bb", "comment": "Malware payload (RedLineStealer)", "value": "ec297dc9cdb69070e9175dd694d4f7ff4d22a378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686018027, "uuid": "36b13ea1-b74a-43e7-8f81-700133e02892", "comment": "Malware payload (RedLineStealer)", "value": "dd0040d8dc2cf5e25ef16771950889c7c78602112644f1e6d5c506b4f98fd4e4484312526a602583c155fdd83c5aa81b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018027, "uuid": "6fa62851-6321-4922-8fa7-5efa9cff62d2", "value": "T153151203E6E95072DCB527B01DF603D70F76BDA09E74476B66852C8A09B3AC4B93472B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018027, "uuid": "8ad79530-a7ed-4c3a-8577-ba57b8f86337", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018027, "uuid": "416a6def-ccec-43ed-9c67-969f8802a033", "value": "24576:FyMD3vXuzPwl9gTNd5p7YOjidBkm25M+9:gEfXS+GTNLtYOjaG35M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686018027, "uuid": "c3febf89-4f43-4f21-87cb-9e4d32e3d42a", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686018027, "uuid": "496ad402-a9d9-4990-bbcd-409080062926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686018027, "uuid": "ce0f827a-b98f-42b0-9c83-41be1f1ee230", "value": "f80b96d73669e7f3e20cefdfb33e9287.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26519082-0434-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686033252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033252, "uuid": "2b2c5f3d-dc9d-4756-8338-fe5b77f57eed", "comment": "Malware payload (Mirai)", "value": "27cdb18684ed957621948517c76d12b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033252, "uuid": "f55c947b-4ad9-425b-85c5-9a82cc906c24", "comment": "Malware payload (Mirai)", "value": "c978005c04128657771c35425d201cd7a1438b7a2e0ab4eb75a2bcc452e78e78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033252, "uuid": "00e1dd1e-a6b8-4c83-bac7-5e93095efebf", "comment": "Malware payload (Mirai)", "value": "6a1fa30eeb323c224128ad2d70051163349cea59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686033252, "uuid": "fa5cbfc4-4b2a-4b4b-a4be-90b4487dc3eb", "comment": "Malware payload (Mirai)", "value": "f04607231e8dd8d25544a27c9dadcea7ec738fa7aefd5d3f667ba427820da1eb2ca18025ada5445db73e7953d66b7d23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686033252, "uuid": "81838361-b626-44d0-b8bf-a05a97044897", "value": "T161D2E1B1AF68AED6C085A7349D9ACC5E70DDF4631F3E94094A810917703AD02B5F8EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686033252, "uuid": "2a2e3911-bdf0-44d6-89e5-28cef0da017d", "value": "768:UN8f6tfoQmQAXV7E1QDvjnVAiSZd8H0GuOZk3WHSwqM:IMJXFl7IQjU6uj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686033252, "uuid": "64a5e3f0-0652-4c4d-820a-5bd7baa7a89f", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686033252, "uuid": "017b4578-10a8-446e-919b-c38c477e189e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686033252, "uuid": "e61c82bf-f86d-42b2-9246-739cd9c8ca3d", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ed5dda-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036046, "uuid": "1407b1cd-63e1-4f25-bf4a-95c1eef48b94", "comment": "Malware payload (Mirai)", "value": "246354b0f5ac781c0a8c4fca8d80c846", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036046, "uuid": "0e417817-ac17-48fb-bae2-2c9fc83561eb", "comment": "Malware payload (Mirai)", "value": "ca9600d13e7df271681966140653b25a263f620385ab79a187b0b0a1962f8829", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036046, "uuid": "1c29ead5-bef4-4626-a327-fb9d5d01308b", "comment": "Malware payload (Mirai)", "value": "bd2c8784a3890f3d28c85ffb2ae67ad193222bd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036046, "uuid": "465d6b72-f9e3-48c3-acc6-5245b35ab862", "comment": "Malware payload (Mirai)", "value": "a864b9e3de5ac356348ba6acb394daaf4db8af0b0bb9530884f4edbe13643062d6f35690fab8c70bd0e939d40c99b029", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036046, "uuid": "d3895234-66b5-4e0c-8590-8cc03680042e", "value": "T1F933F155B004B16187703637EC271197BF4A17FED2E33437056843D4A8E94A77AFADA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036046, "uuid": "a623f203-eea1-4ed4-b6e6-e2f70bc4cf34", "value": "768:BMte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLrc7O9q3UELbOs8qL:BM84ISRX63dZQbS5rzZc7zLIVmWj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036046, "uuid": "79f03c57-12fb-488e-a731-0e36c40c0372", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036046, "uuid": "f6aaa0ce-506a-4df8-9f2a-d1ee6cb7cb36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036046, "uuid": "34c2e763-b6a5-4570-9b01-34be37952bcf", "value": "246354b0f5ac781c0a8c4fca8d80c846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a7a584-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017732, "uuid": "fdffc707-8c9d-46aa-af02-b44a4eb4b242", "comment": "Malware payload (RedLineStealer)", "value": "ac2430bd52b499a3cd95075fdf33f327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017732, "uuid": "7a5ffd59-3d92-43d6-aaca-2794f080b362", "comment": "Malware payload (RedLineStealer)", "value": "cad5d116de7a131cc11b7308483a866a9345017c66cb03405b92086292b0fcc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017732, "uuid": "1767028e-f723-4c7b-9a80-e820ff8e6459", "comment": "Malware payload (RedLineStealer)", "value": "5653ab58cfdffe58bde18f8fb9a5c1650064011a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017732, "uuid": "b55e756c-fdef-43ac-a05a-436390ad9533", "comment": "Malware payload (RedLineStealer)", "value": "33de963767f4828fde9029a68bd423f87e962836c152842294322edf55ac60adbf3acaf47bd7a2695433e92af2ce9f8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017732, "uuid": "e7088e2d-cf42-41c9-bbb7-cece6127e2fe", "value": "T14C15235667E9C872D5F11F7000F312830B36BD9546B8839B67A9AAD91572B84E8303FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017732, "uuid": "f2f97da3-0bba-4ca6-ba03-1cc26a98ca6f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017732, "uuid": "e556d33b-c4dc-4ebd-bcc4-fbaf633e0062", "value": "12288:qMryy90rR3FFDwxvX13MAjLca2LnIWHyqiH6yHnaMOvoqhE9oOAwPhdDZu3FIM/R:syG3YdXBD2bIoyLmvo3LA/Nv6bPWtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017732, "uuid": "6b28f7aa-27c8-4bb2-a844-936bafae6256", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017732, "uuid": "b380a582-cd48-4a2b-b524-9fddd87dc46a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017732, "uuid": "cc4018a6-9a42-4812-86c0-5014aa511990", "value": "ac2430bd52b499a3cd95075fdf33f327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b89f25-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036116, "uuid": "91a3ed41-0d07-4453-b5ff-fc840f57f335", "comment": "Malware payload (Mirai)", "value": "67d66906c7fb4f55c636093f5cea5ef3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036116, "uuid": "e08b21d4-97a3-475a-aee0-0b2cdfc7331e", "comment": "Malware payload (Mirai)", "value": "cb6ee4c935b47a95657e3cc2b045156cf93966afd656fd36e01c65cec00387bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036116, "uuid": "56a83d2f-c98f-4c17-b1fd-dd619caade0b", "comment": "Malware payload (Mirai)", "value": "4f2e6ab9ea116d821c80378d0a73840408c71c21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036116, "uuid": "e457a947-75d2-4327-a918-d9c4e17a7bd1", "comment": "Malware payload (Mirai)", "value": "00ce2ae9e92c7976313997914e29056d3847654db7da4dc725d344a89a754de5348107ab211ff1655b68b340f41b8735", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036116, "uuid": "18cc33b0-f6cd-4172-af03-196ac174207d", "value": "T1BAE2E09EA1F42DFADF8D483E128C097DBBD7689713549B89272144C4A66E4A8F89C03D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036116, "uuid": "9c402a12-033b-4d6b-8ee2-1028fb234393", "value": "384:A3fpCLrsjHIX69URc+hmnulY1qHprFKt6zhS45vDajssVwfTUG1Koyja3FRWGVC/:4fpWcehzJFYKgULAssKfT41a3zWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036116, "uuid": "7c1d405e-1424-4512-a8ae-6e375d38d955", "value": 31960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036116, "uuid": "9046aefc-45c9-43e3-afb2-53880b2c57a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036116, "uuid": "1847b15e-bfe8-4f2e-ab3c-f2eac3de35e5", "value": "67d66906c7fb4f55c636093f5cea5ef3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c75892-044f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686045037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045037, "uuid": "1a89367f-40e8-4730-ba87-07fe4dd3ba09", "comment": "Malware payload (RedLineStealer)", "value": "52bcdb83503454f17b9efce6aaf3a771", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045037, "uuid": "62d36d40-932e-4e03-a744-1a293f65cf53", "comment": "Malware payload (RedLineStealer)", "value": "cc1433e9c84457a2ca3fb5f8275b570f03a3991123028fccb739c202e093df7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045037, "uuid": "88a0f5b5-9fa1-4809-9d14-b5d0f97f1ac8", "comment": "Malware payload (RedLineStealer)", "value": "06853316e8c70bf4547bb293077f4a7093b84aed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045037, "uuid": "50ddafca-76d3-4db6-a61c-18fab514fd3b", "comment": "Malware payload (RedLineStealer)", "value": "af8cf0a829c192c55e571c3c24ed53e41962aff087cf99c66c940d28a5dad766b387a5e36bcbaf8c0bfe5e70e3a54a14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045037, "uuid": "e36958c7-182d-4797-8d80-7904556ff02b", "value": "T117D41252EBD89122D9B25BB02CF643C30B36FDB499A487573756589D4C73AC0B93232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045037, "uuid": "f5121348-74cc-4c96-899f-1a3882654ff9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045037, "uuid": "010f9e64-a91e-49f6-848f-1fb9c4092ede", "value": "12288:YMrYy901Tuo4xBT9ilgCYGYvMYLJmN51guAlFMm:gykTuo43pE6GYrmbAIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686045037, "uuid": "35b048f1-542c-4c91-b08e-f41a8a5bc54f", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686045037, "uuid": "2b3457c3-2800-487f-a07e-5366f0645ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045037, "uuid": "95db5e24-4d91-4c5e-85aa-428fae494659", "value": "52bcdb83503454f17b9efce6aaf3a771.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11da74da-042e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686030640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030640, "uuid": "9f376a5e-6c92-410a-bc56-f63b8527f36d", "comment": "Malware payload", "value": "5f691d38b05f393f4ff97567762c27a7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030640, "uuid": "8565b841-b31f-4442-a266-37754df5315e", "comment": "Malware payload", "value": "cc4843512076608573c285a95e03361732dab93ae78fba41daba40711ceb9a0c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030640, "uuid": "ef3fdcef-5b86-4453-bea5-4559ab2ef659", "comment": "Malware payload", "value": "d713e31e3f4c3543971acfd67d061b06a8ac9560", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686030640, "uuid": "b72843ef-668a-4f34-a300-9aaff8cd75f5", "comment": "Malware payload", "value": "5c12b67e756bc9e7da451a9e75abdcda57189d958813bd70950d00c2986fd0e5c0d753f9c1481fb9ef70620da1e917ee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030640, "uuid": "04543111-0e34-4157-a7fa-4acf287b145e", "value": "T11A837D1076D2C472E57ECA750824E6656B3EFD20CED08DA73B95167E0E302E1EE35D2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030640, "uuid": "a76ece61-7b27-4a01-9da3-4b86273451ab", "value": "d0396ff0a06d7a17afaaa395a69ef8e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030640, "uuid": "fa6770e5-7de3-4089-a32f-6a59aab32025", "value": "1536:XJ7izBfD5d/bj22eermtUBl3eGF9NFvjEssW5cdxpcTVxD/v0DBS:XItR/1eV2Bl3FpL6xpcTz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686030640, "uuid": "bd502dda-c1d0-40f4-87ca-bc6ceea3f5d1", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686030640, "uuid": "cc3c0efb-a729-40a6-a3f2-16c130e70436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686030640, "uuid": "2c44b75a-defe-4736-9cf2-34c9908bba36", "value": "rnthgfcoj.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d667f00-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017748, "uuid": "e97665c3-6fe0-448f-9490-020eca1302c3", "comment": "Malware payload (RedLineStealer)", "value": "b7a2cc89c3cd1a9f4107ec8c8132eb38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017748, "uuid": "3e0bc2eb-1545-4879-ad6e-26a9d633caf1", "comment": "Malware payload (RedLineStealer)", "value": "cc525eb1f14ff258ccd3fa32e3dc863c56c540f584f76ff650b7e275f2c530e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017748, "uuid": "ff7f4ff0-a4b2-4e32-b0b4-1e607578b8b9", "comment": "Malware payload (RedLineStealer)", "value": "41c6d937592d44eef03d4e50a5ffce560dd58bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017748, "uuid": "51ed1f1a-b9fe-4c94-9b8b-c8c430bfc539", "comment": "Malware payload (RedLineStealer)", "value": "ad0b2ee0ac4717b2654fe40e51cc0a61e76b1bdc7ce3e805d39db0181775da6ef9968d48aa1feb479bb03a2750f05887", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017748, "uuid": "fda4525b-a34e-470f-b8a0-5e9f035f7d04", "value": "T1B8D4120697F99032E9F517B16DF603830A37BD805DB8936B13C69D9A4CB2785A97033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017748, "uuid": "14884d7c-9899-4dfa-9973-68eaa404e593", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017748, "uuid": "d7276198-c8c9-425f-b733-073df8127d84", "value": "6144:KBy+bnr+Up0yN90QEUJy/3aL6l7KqKmdTB0mdH3O+DJ9LAgfGkGAiol3lITwl5KE:bMrUy9093FKqicXO+DDAgrZaQbYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017748, "uuid": "49473fd0-4322-4d83-bd02-8850b2fc8111", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017748, "uuid": "2ed67fc2-aafa-4213-b17a-d40088002798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017748, "uuid": "f61b6f6c-e5e8-4a7e-a4a3-2cb2b28afcc6", "value": "b7a2cc89c3cd1a9f4107ec8c8132eb38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d36896-0454-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686047344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047344, "uuid": "ceac2978-020e-4329-9414-7b791161fc06", "comment": "Malware payload (Mirai)", "value": "84915a20953cf7c3fa208c5ba5757b17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047344, "uuid": "1877977e-69d6-4518-8f4a-a48f9f42d331", "comment": "Malware payload (Mirai)", "value": "cc64d109d6f95a1acee61af78a4aa3a19efc1fafe0b493853fd8c80c9f7b0dbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047344, "uuid": "def1e826-0460-4e2d-9ede-b84fccf279db", "comment": "Malware payload (Mirai)", "value": "0d0fb30f8458b3de0b50079f93a8af36a79af91c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047344, "uuid": "512aca45-4778-44c0-8f04-e97bcaa751c1", "comment": "Malware payload (Mirai)", "value": "9cc1361b3d0686e7c7057fded442fcebc55366db9234f31e901c8818449d5c706c3019fa3c7c6cf3f039312fcc8411fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047344, "uuid": "70bee5a0-8575-48e8-93de-faadf33a34e7", "value": "T1D2539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047344, "uuid": "9a878d3a-605d-43b8-a5ec-6225dc0e6173", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686047344, "uuid": "a53504fe-3461-4685-a8e9-e271970a2f3c", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686047344, "uuid": "facec273-0b0e-41f9-b101-e1d9cd261d8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047344, "uuid": "20f21670-8ea9-49ad-8350-0e48f56716bd", "value": "84915a20953cf7c3fa208c5ba5757b17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b934d90-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089981, "uuid": "8ecff3e2-ecd6-4f61-85bc-0fb0379350de", "comment": "Malware payload (Mirai)", "value": "55c588c79940536ed044d176c8fb900c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089981, "uuid": "9bcbcd34-1693-42e6-b18c-43fcbdf4ba5a", "comment": "Malware payload (Mirai)", "value": "cefa9e2d5c22356435d75ec52ef0d6a39c91839d1991b3c4a891491460621362", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089981, "uuid": "78399bfc-042d-4611-b050-550bfb1e9fd1", "comment": "Malware payload (Mirai)", "value": "e5b090cf2dd7d5bab9d213c0e2557f10846ff7bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089981, "uuid": "5dad6bdb-f99a-4464-9850-e147a58e388c", "comment": "Malware payload (Mirai)", "value": "0cf2d5d5903b1c4e92a5eca516dff3101ba0d6139a3c5d12c823f164746d88f741e239c291e2d7816188729d6a6fc9e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089981, "uuid": "8478c067-6fec-4c9b-848a-c932032cc1d8", "value": "T10BB2D0CCA1443184C68D7C7C178D4A664F6CA0D0BAED9B26E354CD98B3BEA4F385D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089981, "uuid": "fdd84e81-f396-4d24-aa49-6450802d6abe", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpRrZqSWvG:4QlS07FUXqIYSXQKquRtq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089981, "uuid": "be54ad0b-3dee-4aef-9b12-8c8bfc01090a", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089981, "uuid": "b171e10a-08be-49df-9121-52013948c8d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089981, "uuid": "8e6e8c7c-27a7-4fb6-89a5-3daecded12ce", "value": "55c588c79940536ed044d176c8fb900c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f9ef6c-046c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686057627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057627, "uuid": "83d12a55-1d28-4e4f-bca5-7bf391a42342", "comment": "Malware payload (Loki)", "value": "a402dd613b2b1fb2b7f4b977a53762c3", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057627, "uuid": "9fafe268-fab3-4f57-ac72-062319faef45", "comment": "Malware payload (Loki)", "value": "cf2027d03fbff2de1d48b8e908a6161cb37014be0dd438fde844e872f5d0d8bf", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057627, "uuid": "0a56e15e-bc48-4105-b053-903e5d98fb32", "comment": "Malware payload (Loki)", "value": "32c5e316b3669c309195a79fa476780b31ea711d", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057627, "uuid": "eb76d7fa-de83-43c2-951f-8cb048b369e5", "comment": "Malware payload (Loki)", "value": "b08ba14cb51e8acd051e29b253b5ebd8a8b8ba339fc0337cc2fe09398190b3021f55643902986152688650e47cb62836", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057627, "uuid": "4d0e75df-ccbe-411a-9f17-7141f7c10b72", "value": "T1FEE4022C27F7871EC8A63FBC0D01427AC7ED2958B423D25B5FA779CACE25B114E80566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057627, "uuid": "e7aa7f0e-613e-4635-99e0-0219e800bc4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057627, "uuid": "b366a407-b583-42f5-8a63-a6826ac27a63", "value": "12288:DN+J/M+Jhewx/NscEQ+vgXK1HsaPDv87laM/cJLGELXKQB0+ET2lWArZr3tc9+J:O/thewlqB6pOv+lt/cYEJB0+EClWux33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686057627, "uuid": "97b85e9a-4456-47c2-9843-6c734e4a7e7a", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686057627, "uuid": "a5d88f67-24c4-4ea1-9ddc-407ed49b83aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057627, "uuid": "8705e383-ee7a-46c7-b60a-5c490f23af10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330f881c-0414-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686019529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686019529, "uuid": "9059b24d-187f-4bbb-b22b-0189b2c10770", "comment": "Malware payload (RedLineStealer)", "value": "40c85ae969ffabd2e61ab26027dc515f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686019529, "uuid": "24720bb7-8628-49ba-bdba-4c3559281d0a", "comment": "Malware payload (RedLineStealer)", "value": "cf9562f1f4b3a189173560854e6ef7a748b1bbcb6bb8f0b0f0947462ebadaacd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686019529, "uuid": "cf8c0006-a095-48b6-ab9c-b4b54c0a3bb5", "comment": "Malware payload (RedLineStealer)", "value": "3dd377da7e0c8fd0a6c728173e69467e68649359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686019529, "uuid": "da784c9d-53c9-4634-990b-a5945ce34307", "comment": "Malware payload (RedLineStealer)", "value": "266f05b62e892a8cc055db70700dc53fa178f109838e4dabea2b95738363c9838989de2bee19ab760dbb7e6f4225f9c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686019529, "uuid": "716fb232-4071-4c16-bc61-bcf653a920d8", "value": "T1F9F423165BF84473D8B1677168FB23930A35BCA27C68E35F2782885F5CB2681607673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686019529, "uuid": "5de01d80-24ff-4150-8c5b-280d4a9b4c43", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686019529, "uuid": "31092630-09c0-444f-9b4f-9068613b0830", "value": "12288:BMruy90L0z0JfmC16lIhvTab/sdAvveStsVrA6k6WNDdBzL0rrHeSOno:TyYT1lWbqTEsVrA6kXND/zwrHuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686019529, "uuid": "a4f3d1d7-ee6d-462e-8148-cb532cd31802", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686019529, "uuid": "eb8116f7-3e2d-4dbf-957c-f07b0f4a0dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686019529, "uuid": "babf7af1-c9ef-438f-82b5-56b6b446cfee", "value": "40c85ae969ffabd2e61ab26027dc515f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7471060-0499-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686076928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076928, "uuid": "774848cc-bff1-432e-bfeb-9f080d25b6b3", "comment": "Malware payload", "value": "e8b5043f0f263f7f66bdee786904268b", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mikehp-com", "colour": "#4D615C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076928, "uuid": "83e9ea0f-42ac-45ed-951c-d659760da690", "comment": "Malware payload", "value": "d025ee7d2be36308e13ea988e3e15ab0e687972624ff88db059d472df7f46253", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mikehp-com", "colour": "#4D615C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076928, "uuid": "3f4c1d31-544d-4acf-b7a4-a2a5f761be03", "comment": "Malware payload", "value": "2d29989d7c335af3036c22da4fb433007765e382", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mikehp-com", "colour": "#4D615C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076928, "uuid": "1f5ed256-4b6f-4d92-aa32-5e9e98f3f74c", "comment": "Malware payload", "value": "a97a16681e4905c60b992172d6524e9cb02a904e7fe683ca1ffd67b545decbe657e505abb2e12febf317a272bf45b13e", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mikehp-com", "colour": "#4D615C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076928, "uuid": "c0f149e5-11c2-494a-9468-0528549dd0c0", "value": "T1D0A3FD84060A2ADD409C13B5E48C3D5970953AFEED9A9D4FEBBC078D018EDCB5E5372A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076928, "uuid": "1f45308f-f865-4713-a648-a746743a4ba1", "value": "1536:ib5ox+pXEhuiykvoCcyGH33vI7n8GwKQ1JIYFJSJ9EYtgHHVCD2uU9tIsIfiQ:85o8tnQFBQnQWV4FPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686076928, "uuid": "102eff77-d607-4662-99f0-64e4480c785c", "value": 105585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686076928, "uuid": "4abbc069-ad26-4b88-8f8a-4581de64d729", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076928, "uuid": "c53467f3-2005-44d4-a080-4eeb674911e7", "value": "printouts of outstanding as of 06062023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6c230d-04b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686087031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087031, "uuid": "a601712f-6f2b-4c69-b3e5-9b4eb231b79b", "comment": "Malware payload (Mirai)", "value": "14739462f2714fb16e729786e6276d9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087031, "uuid": "f4f2015a-76e1-4076-978f-1f1cc8b889ac", "comment": "Malware payload (Mirai)", "value": "d18231fbe7432ef4e57da51117d96ecc7597881230bcfd82be56f69ce028b547", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087031, "uuid": "656e24c4-8b32-42de-b2a9-842f210799b8", "comment": "Malware payload (Mirai)", "value": "63066c9f91fe95f0ae0e3d9d602db2360e10430a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087031, "uuid": "95a8bbb4-56f4-4313-ab17-44baf4816bc2", "comment": "Malware payload (Mirai)", "value": "b4068d5578e04388e68ff2ec875dd1ca62acf2d2cff5c463c8828cd0d713671d7d796d3a4b4ecaf78acc70c5d44cc3c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087031, "uuid": "eaff3798-3355-484a-ab5d-2a37f1aba992", "value": "T12D042946EA408B03C0962BB9FA9F424533239B54D7EB73059528AFB43F8779E4F23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087031, "uuid": "87d5417f-52ce-44c8-98df-fb79637022f9", "value": "3072:1PkrrBwTcGIjbaOVfi9QNnrQUSABLtOt+hJUoNM/RxKn4G2Di:1PewTjgbaOVfi9QNrWAZtOt+/ZNM/Rkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686087031, "uuid": "9e926d74-736d-4b9c-85fb-7c12bca8b58d", "value": 180483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686087031, "uuid": "5ab3c403-c8dc-4552-ba3b-0c8f6bd49b25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087031, "uuid": "34099fab-4d72-4ab3-98b5-afca4ea1fa0c", "value": "14739462f2714fb16e729786e6276d9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830e3c73-0490-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686072921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686072921, "uuid": "c694d1a7-011e-4fbe-b473-debfcb337bdb", "comment": "Malware payload", "value": "a3f504d29e3c2c0cd1c47396534155e7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686072921, "uuid": "57a51d5f-fc0a-482c-bc36-329b7fc6fbcd", "comment": "Malware payload", "value": "d201eae7e44ab2e068c0beb28d9a68af2217bd6d3e6a149b9eb0de4bd8bfc377", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686072921, "uuid": "73523b83-28c8-4a98-8495-60cb8d911a1a", "comment": "Malware payload", "value": "d28e0accecf8701cb162c8e53468699ba35eda7f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686072921, "uuid": "a078d504-1b52-473a-aee7-88e3ca0f6eeb", "comment": "Malware payload", "value": "f24a473c04a3100ef2cc8713e3debfa8b98ee43e2433dff56ba500a7870d9304d49fcf094186efcea901c427a1d9d4fa", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686072921, "uuid": "5ed31b10-67d0-4229-894d-882f9214b68c", "value": "T1567492B0F51540B8D97CA977DCAB172848092A2AB9262CD27BDF3B6C2F45142CDC7F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686072921, "uuid": "ec603e28-fb9d-481c-84e1-b6372c7bf3a2", "value": "6144:FPYX+Yi6IU8TlUe75fmSgmv1N+A3iXfqd4IQMDPlY8MUJacU3AmR:FP98m1ga1N+A3iXfqd4IQMDm8pfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686072921, "uuid": "0f50e68e-e79d-4630-8338-0099d8c3bd48", "value": 351136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686072921, "uuid": "0dcbd8c6-f4c2-4904-b4cf-4c3aca098215", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686072921, "uuid": "41f0c57c-4814-4efa-9e59-d027269f0f37", "value": "a3f504d29e3c2c0cd1c47396534155e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42653be4-046d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686057780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057780, "uuid": "0bfae1cf-a68f-404e-b8c8-15851dfbc3d4", "comment": "Malware payload (AgentTesla)", "value": "e32465c461d852faf8ec5df1745b857e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057780, "uuid": "830f8c31-869f-46ee-b1d8-a39dd08810d3", "comment": "Malware payload (AgentTesla)", "value": "d37b5f567cc6114faa278efebb1643fab602ea3a47d2d0465a1b9dd0193fd075", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057780, "uuid": "1fd7305d-0787-4456-a569-06bc86447bb7", "comment": "Malware payload (AgentTesla)", "value": "0552559f4d55334b4d128e8f2f4c69968e197dcd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057780, "uuid": "76b0c586-ee3d-44bb-81ec-e14f1f1add32", "comment": "Malware payload (AgentTesla)", "value": "087ac5111f3ddf57e66f17f2e8fba1fe40ab8ddb2ee015af6476ef046449211388bec28f0489bcb65a97618dd4f308dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057780, "uuid": "fc6acb9d-3cc8-454b-8182-ac35124b8a45", "value": "T125B423EE035A9FFE881B3EF1B658567504D1FCE027B73A57CE14861F2710E58AC62A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057780, "uuid": "2bc72049-e98b-4174-98b9-69c00cf11388", "value": "12288:e5AQvmkLcIPVE/0PizdnmcdbdwNWkI57BeyF:e5AQekzPVEfm2xN7BeyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686057780, "uuid": "3769cc37-859c-4c1e-ada1-e489a1138d84", "value": 514229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686057780, "uuid": "c1b188cc-3569-40d3-b9c3-2786db2d8ff6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057780, "uuid": "768012b7-17da-45c1-803c-a15815962f95", "value": "delivery arragement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e354e677-0454-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686047313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047313, "uuid": "335016f5-19e8-417e-ab1c-02999eff0bdf", "comment": "Malware payload (Mirai)", "value": "4789c7134bc27b5ce2bcbb84a5dd6e17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047313, "uuid": "e1a2d7df-ca32-4552-98cc-792b8b497700", "comment": "Malware payload (Mirai)", "value": "d45fa0a25f7f20049fb7303feaf00bc279df57e7c6cadace46825bbdcd6666b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047313, "uuid": "b7f57c60-1047-4969-ae4b-0ba85474e8c5", "comment": "Malware payload (Mirai)", "value": "af4573430445fe76008a6e754dd9dc22b62df8e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686047313, "uuid": "d06b1e9b-c65a-4f28-84bc-b91ab3d141fc", "comment": "Malware payload (Mirai)", "value": "baacd08e68e596b0ce9650635525bb7eb3681fc7f59d6d866ed039c6e91246021fc66bd02f83d3f31eaaa99384c10432", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047313, "uuid": "bfb3f7b3-9bb3-4f64-8bc4-1d0515d0d3fb", "value": "T1D9735D24A9792E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047313, "uuid": "117236e1-42b6-41e3-acf1-cb7ab5e63af7", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws87:YwfdNu4cmZvFqI3w77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686047313, "uuid": "1770b6bc-4daa-4c04-abd0-df8ff2c6b032", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686047313, "uuid": "60f3559b-503f-4c01-8790-f1296b98c38e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686047313, "uuid": "341586f8-0504-4f4f-b585-a9f7fb12b1e9", "value": "4789c7134bc27b5ce2bcbb84a5dd6e17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc3f908-04b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686087035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087035, "uuid": "c585658a-a655-4ff4-8a1b-07047cbadc5d", "comment": "Malware payload", "value": "45a2c3ae59940b860e7e43f5a9527cae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087035, "uuid": "14f4c7ce-5834-4392-90aa-83924819b99e", "comment": "Malware payload", "value": "d47e7714cb1f5215cd0c7352285de1b30c5511f8ff9597e822314ca2cd07ab7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087035, "uuid": "1c4121a1-9477-44c7-a7be-335355c46fa7", "comment": "Malware payload", "value": "87c080f52606782037163dac388cf110e25f5d57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087035, "uuid": "3940b2b8-60be-4af2-b714-7a07fc6a080a", "comment": "Malware payload", "value": "7253424ec8362509ce30e1a53a03af6af8ebccbef985940a51b244cd83768e700ed2bcadc273a214a06a9edc1ebd65a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087035, "uuid": "578418b9-5cac-4ae2-b190-3b86a82b6787", "value": "T1CE04C81AAF510FBBDCAFDD3706E9074135CCA50722A53B793678D528F50A90B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087035, "uuid": "76e31c2d-3571-4712-b2e2-c2618980ba58", "value": "1536:rEC7KusRlY9rNi0igFU17eN10t1yaTxx9iSnIt81p0kyXpSIpiQvxodpfGVwV9WP:rEVuslYjiuqNt1MwALHxiQvGdpeOOqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686087035, "uuid": "5ca678d9-928d-4a39-b723-a844345a21e3", "value": 173924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686087035, "uuid": "6b863c7e-e76e-44d5-8654-9442fd95cd2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087035, "uuid": "68e511b6-34ab-4c3c-bbe5-53d60446679b", "value": "45a2c3ae59940b860e7e43f5a9527cae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3cfb3ad-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036093, "uuid": "4af6cea3-8d23-44d7-bbf8-5db90d9365e7", "comment": "Malware payload (Mirai)", "value": "d72dec322ae7a05ece32207dce095123", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036093, "uuid": "09549fd3-e7dc-4dbf-9dc6-c4de3a33a90e", "comment": "Malware payload (Mirai)", "value": "d5cdccb022b54ab58c708ef871d5cda96abb6d4f8a60ce943c0e78cc27245650", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036093, "uuid": "23bd65a3-e5fa-4b4b-b5f6-6585ba973733", "comment": "Malware payload (Mirai)", "value": "a8c4fed52deac0f531d09223464f2651d3a0bd6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036093, "uuid": "d466462c-a40f-4b78-a3ed-822af3a35e20", "comment": "Malware payload (Mirai)", "value": "3a305350f4db50c626c7da57ed225c2fa702ca48385815abd44587d4fb10860bf12f427559662a24706b2296a0e75f32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036093, "uuid": "f07179e2-7bd3-4dfc-adba-4b893d04d70f", "value": "T1ACC2E145E3002E89FFDF7CB59E2990C47B2B175E6B8794A3B27891137153D2B6C01AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036093, "uuid": "0bee4c1d-6c97-4085-a769-71d37552266f", "value": "768:DUbgeS1f8Dnz+AHyRas6JAshPVCoD4uVcqgw09G:DUbfaAQGAiNCoD4u+qgw09G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036093, "uuid": "3269c0f8-ce22-470b-8411-1d1da358862d", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036093, "uuid": "ec7cc4c5-0ed0-4904-9894-57c1e2712f89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036093, "uuid": "25b89f42-4abc-42df-a9de-b33d404ba9a2", "value": "d72dec322ae7a05ece32207dce095123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ce0fb9-046d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686058086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058086, "uuid": "1c3f40b1-5fd0-4231-ac2e-b233b05ea9f5", "comment": "Malware payload (AgentTesla)", "value": "38f255e921993350ca072daaba428040", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058086, "uuid": "b9818f78-041b-44ad-8c34-31e40d05c63d", "comment": "Malware payload (AgentTesla)", "value": "d616aefbc324763685be6e923e5d94e3272647f95187080e7e1c8fcf28173b72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058086, "uuid": "6bc91490-118f-48d4-9574-a79f35734123", "comment": "Malware payload (AgentTesla)", "value": "12006fe0f6d555e87fb4ccffcf68891a40bfb126", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058086, "uuid": "0f4b3d95-9350-4c99-9470-838bc82e8a29", "comment": "Malware payload (AgentTesla)", "value": "ef1ba83318ec2ef4ddfd54748a42ea8afc806070bd2572d0074ee1425e48552089cd8d67093563a339cd9034494c7a02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058086, "uuid": "d46a768a-1c76-4e0c-9870-55449e00f0e4", "value": "T11BF423E1659B442FC6CB0B754990237890AC46C9F873F3770E9FAAE4CB1BF29585035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058086, "uuid": "f892d6c6-ea15-4969-96d5-f50a35279809", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058086, "uuid": "b9f59bf2-4d0a-4dab-ab6c-52c988ddb44c", "value": "12288:ORP2B0xTGlxNqvNu2hZ+nUEsn9ynLX/UBkVmZWigtq5OHNVEUyc9/jUnhsaFhtKR:GPLaVUH999QvK/gg5JGJYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686058086, "uuid": "280afb57-03ef-4349-a8a0-8b5dfc155629", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686058086, "uuid": "c3708553-34bb-4f35-892c-9337974f4dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058086, "uuid": "243f0db2-47c9-4c9c-8273-eddb9f8d5c90", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bca2995-046b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686057017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057017, "uuid": "aa1c94d5-8897-4caa-87c2-76baef7749e5", "comment": "Malware payload (Loki)", "value": "0d1a6209704cddb135abbc85bfba2dc1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057017, "uuid": "b5f563c3-2e7b-427f-9d54-6ee4907a7720", "comment": "Malware payload (Loki)", "value": "d65c56de4ba43127d338477f64ebfde03afc406b3142e25f30d54900398b4521", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057017, "uuid": "b372255b-598a-4c52-b30a-da6b54eff6a4", "comment": "Malware payload (Loki)", "value": "815df974a1b4af8a2a3521cfd66b73eda22fbe1c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057017, "uuid": "8da1ad83-b3aa-4364-b64c-52815ab6f979", "comment": "Malware payload (Loki)", "value": "7b68949140f4f1cf95d7edf9e1c30607f188773e10c6bfcf6378fc0323c3e0c580f1515ba6d3251be7fbb415c79c972c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057017, "uuid": "473e9f19-e2a8-4bf7-806b-bba4ba046039", "value": "T175C4233B294E473F8D33D6531AE4160BE6FD899991E04CD71AEFC5AC48EEE80931119B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057017, "uuid": "6d332f1a-424b-44d5-ba7b-1834a4ebb22d", "value": "12288:v3B2iSnpd6lw/9qGU5hi2eM8IO9Wc6E52a9CfqdoiYpkElskMINcJwlNL:vB1SnpN9qnh+ToKaS6N/NcGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686057017, "uuid": "dd86c1a6-70d1-4df3-9bb9-3f7425da65bb", "value": 555552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686057017, "uuid": "8bcf6bf6-19b8-4efb-b820-030625474a6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057017, "uuid": "894eb14f-2b03-4a03-b2c2-5bccc68f0eac", "value": "PO 00234.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f1d828-043e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686037539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037539, "uuid": "494da0eb-aa3d-4583-b1bf-1dc2a336f606", "comment": "Malware payload (njrat)", "value": "a0e5bcf43052117dd2a61fa963fd9449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037539, "uuid": "b2b47f97-9910-473c-a586-9d5cc5d3121a", "comment": "Malware payload (njrat)", "value": "d664e5a74efe8bee93416258fe43fbaee485a4e1c585dcb3892c93359c48feca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037539, "uuid": "c3284334-4e51-4c4c-8aa2-dc3034370ec8", "comment": "Malware payload (njrat)", "value": "8d930eeb155437adee27fd4962888a282a1e67d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037539, "uuid": "bc58124f-e34a-4430-aadd-f9b9b8ed99b3", "comment": "Malware payload (njrat)", "value": "4bf676d7f5af1a1242910aec006697447f1563b8bc1d8b1d008e8ac5b9a8a21484b3182ade0f3c7db8797d5196d69e82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037539, "uuid": "aebf244c-8d82-44b3-92b0-7d844ab34a02", "value": "T14A54BF12BDC18471D53114350AF79B70693C7D212B768EDB97982B2E6E301E1AB37BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037539, "uuid": "cca1f406-ea54-4da3-8aa1-50b06de0f565", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037539, "uuid": "d411fbce-4f4c-4da0-8167-368a41f65256", "value": "6144:461E/QSnxoEMTlXEulocRT+tj1VMJlO15:46ErxJMTtEul9T+tjXM705", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686037539, "uuid": "b491d6e6-3caa-47ee-82d4-94b8de3f6f63", "value": 289911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686037539, "uuid": "a860b99b-265f-44e5-803a-be3f2986238e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037539, "uuid": "afab7530-23fe-4f24-89c2-a4fedf20ad2d", "value": "a0e5bcf43052117dd2a61fa963fd9449.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7d266d-044d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686044243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044243, "uuid": "c28e3d03-0b43-481a-b806-06117f88a557", "comment": "Malware payload (GuLoader)", "value": "6b1cb681b8aaef4da5d19b21d9c4033f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044243, "uuid": "30645346-3cd7-47bb-854d-1c22112be36e", "comment": "Malware payload (GuLoader)", "value": "d7cb445cb93acd1a875e2f82e7e28fa0ef541fdb87f79a20a87afddfb6aad2f8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044243, "uuid": "e1abd90a-ea41-4662-b7b7-0f65225ff04f", "comment": "Malware payload (GuLoader)", "value": "45de6b831c7e561f7828b621166606e18f5f8c3c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044243, "uuid": "aec4304f-8e92-4e61-be01-c103b61ffdbb", "comment": "Malware payload (GuLoader)", "value": "8bd5ee3ac9c973483b3a0d722857843e9974c0a276a666773a8bbe37c058d5e2939f3d1eeee7d48a88b1c63f29828ae8", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044243, "uuid": "c370a4fa-bb59-4e23-958f-109d96f588f8", "value": "T1F5D238565B8C4C61E26AE8BB835DA00E08BCF33634C255C4BDDDE2713B7D14E4B6A1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044243, "uuid": "ece252f7-0118-4a1c-bd13-30eb9ec0cd92", "value": "768:I+c7ndyJAq2hvSsWIayZ7ac2J6nJ5J7xVtHdAtUMIyt7d:IqJAPvSs72c2JaNVtCIwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686044243, "uuid": "ea3b2a90-7b8a-4dd3-aa2a-ea2221903717", "value": 28348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686044243, "uuid": "5b545675-0adb-4746-9126-41e91da589f2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044243, "uuid": "ca6d33f8-5e74-466a-89ca-6c81c744eb4f", "value": "6b1cb681b8aaef4da5d19b21d9c4033f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f55888c-0461-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686052782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052782, "uuid": "585f1383-cdfe-4cdc-89e4-bcc1ff733b15", "comment": "Malware payload (AgentTesla)", "value": "0c041029bb0bdc6bdfc0d3a0fcef9e0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052782, "uuid": "6f7f3211-59c4-48c3-bedc-61d057a3ceba", "comment": "Malware payload (AgentTesla)", "value": "d9fc434197aa093d63969f49f788012ef17ced51d2b6b60d705e6f1271bed3f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052782, "uuid": "a149d8e2-de34-4773-b439-6dcc8ef1e3b8", "comment": "Malware payload (AgentTesla)", "value": "78abcfdfb8d6782180dcdac58d845d79339d9906", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052782, "uuid": "969d7700-62e9-482b-a4e6-040cdded517f", "comment": "Malware payload (AgentTesla)", "value": "3207530fe7127d254fdf5c14e03a6059e095401edb269f6731e6ddb0359225392e0ef2e41a875953cb5f9017dcfb8c2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052782, "uuid": "eb016415-92fd-4476-8f5a-e1f1f37aad9b", "value": "T141D42344F64C2F516C12E5DDBD3B377168E94E0ECC87B1AE9588BF113228777A910A8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052782, "uuid": "e84db66a-ef54-405a-98c9-39c5244f0617", "value": "12288:2zsfr+Seo51N3MGfmTXneWV8n60Wct4L8JIVB5w6PEX1tkt30Sm7Bz:2zsftf51N3aSW2n14QJI5w/12t0SSBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686052782, "uuid": "8e344803-0b50-40b0-890d-51d6e7c714e2", "value": 621350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686052782, "uuid": "3d6ca8ea-ec2a-4463-a2d0-79f014f98a63", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052782, "uuid": "9440cf48-2d31-425f-96e2-4df2f52c032a", "value": "Purchase Order 430102318.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0caeaa25-045b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686049959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049959, "uuid": "9054ea56-e50a-4a33-b922-649d86b31819", "comment": "Malware payload (Mirai)", "value": "52817c715e94d240a8c7a0c06c3c9409", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049959, "uuid": "8949084b-0569-48aa-a23d-c2471a66fe0b", "comment": "Malware payload (Mirai)", "value": "da3363ec033b7ba01949fad15e808b9466a421bc32339a9a2f92f22e77e160dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049959, "uuid": "5731a54a-a7f3-4a5e-9244-595e423c6f96", "comment": "Malware payload (Mirai)", "value": "abc062c04fdcced5cbaf7361be680c7ba02d6a93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049959, "uuid": "eaf10c42-5ed2-4ac4-94a3-812c3e50c1f1", "comment": "Malware payload (Mirai)", "value": "4881cc088f7ddee51c3ec72f206ef5efcf316ae9e31b373ff793eea3d67e3d5d912787575651d14c1638b42d08109ed0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049959, "uuid": "38c7cd96-26b8-4d24-8ade-a6c99b0ebc32", "value": "T11A2302432093BA03E03058FF45628C8DB64AA6BCB1BF77A725450E154C74DA3ECB18AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049959, "uuid": "0d76ccb3-8017-4def-8203-48e81f993316", "value": "768:nK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFzl9q3UELWt/iw+kvBGg6+fYtrBHY:P12O1LCNguovDPH7TcrWLWhiw+kvBGgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686049959, "uuid": "75a998da-a118-4f64-84cb-880b04a5151a", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686049959, "uuid": "9c213378-d69b-414b-bbe8-667359d01867", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049959, "uuid": "80254f5a-11d7-418f-b66a-904906ff9e35", "value": "52817c715e94d240a8c7a0c06c3c9409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50fb4c1-0465-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686054563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054563, "uuid": "8b6f1cfd-cbcc-4f1a-8d73-817db0e52d05", "comment": "Malware payload (AgentTesla)", "value": "0cc13fd26f1c2977e08a9bae869c5ba3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054563, "uuid": "08b71ec4-817c-420f-aeba-ba33b64ae616", "comment": "Malware payload (AgentTesla)", "value": "da4ecae7257a2e3119792b37bde8c7879a70b341a54b2f24497a3d5b2f11c38c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054563, "uuid": "a2293151-c4af-40be-bbd7-1bb69ee80252", "comment": "Malware payload (AgentTesla)", "value": "39b4e895ab67ef54bf6d9cff0ce0b3944d51a3f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054563, "uuid": "c64f26c4-7ad7-4c3c-ac0c-cf24bf9c9fc3", "comment": "Malware payload (AgentTesla)", "value": "579feaa5471c33969904b549438e8579d5545ad6bd5f536e36de0f4fc53139d4a20fec83c36fc6f8e617a38859af0276", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054563, "uuid": "a1c96568-bedd-4b38-8390-b47de821e640", "value": "T12DD423B22E7FD47AF81548424513D8E1AAE7884B276133A53324ACADBF7FF09C9D1641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054563, "uuid": "dcdf0df3-4a46-419e-8662-3f6ba84d8743", "value": "12288:D2ifnfg+MikPJmQ4tLBKpkWaLyxa55HqxEWyuuYUV3HLD4oEnB8bNO:D1fnxoxmZcaLS/jpuYtnB64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054563, "uuid": "08bb2323-0d78-46c9-bd8a-63fa1dbf5e00", "value": 633463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054563, "uuid": "00229699-52e1-4350-b83d-0791cc361b61", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054563, "uuid": "c013e2af-e189-4f91-9a02-3ca3ac53f703", "value": "PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b572cfff-043f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686038216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038216, "uuid": "82b945f4-1ed1-490b-9b3a-0e752ccd5c3b", "comment": "Malware payload (RedLineStealer)", "value": "fbe0e58b064be5e45504f02dc19ad4a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038216, "uuid": "33de810e-37ad-4ffa-944a-487805874568", "comment": "Malware payload (RedLineStealer)", "value": "db519513e0ae73534a2017a965856adcb26101c3e13b25e34c93480d13035f86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038216, "uuid": "cbc94ac6-218f-4c12-91ed-6d097c835657", "comment": "Malware payload (RedLineStealer)", "value": "02ada666b568937878653b14b4fd2eae1e5e9c92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038216, "uuid": "201c7fe3-f01f-4427-ae5e-e1b433b657ba", "comment": "Malware payload (RedLineStealer)", "value": "a0b0c8bf94f48a5f687457a3cdcbca5c45c1b9b1c183d3c8e2556340986e183d9e5ea851ed85df1cd23405a064971a3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038216, "uuid": "e43f06bd-5ffd-4822-b7e9-13bbe1094d4a", "value": "T12AF423539BE85132D5B417B028F706C70E36BC62AD78436B3269986A0CF359079B637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038216, "uuid": "b48d8ec1-259e-427a-a7fa-ee4f2f463c08", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038216, "uuid": "94495c13-5352-4ea1-87b3-92172981924e", "value": "12288:RMrSy90gI5Y4/9j1rJUHqFbD7im7cgPPXvSO1e5aFFBUr9hhFVGo8wjM2JFyImb:by5I+4/3rOHqF3T77SO188FBUr9zn8wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686038216, "uuid": "0d02d0e6-d194-4672-87cf-25e834295d99", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686038216, "uuid": "2f081b9e-ceac-4838-ab0d-2f668995bd19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038216, "uuid": "b4895583-d260-450a-acc0-47f28f5d1bc9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941e945b-040e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686017115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017115, "uuid": "394f371c-fc45-4deb-945a-1142509ccbd8", "comment": "Malware payload (AveMariaRAT)", "value": "27c962bc41886b2fae4c822abfc796bc", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017115, "uuid": "4d0e4da3-9e07-4d5c-b242-03b54ee13c87", "comment": "Malware payload (AveMariaRAT)", "value": "dbe7fdd2f0e7270387053d2955f549a46a6699b29ece6b3ff20a6bd11c06064b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017115, "uuid": "837d12ed-47ad-4a7d-8a36-a188826f2c83", "comment": "Malware payload (AveMariaRAT)", "value": "e14f67bfe3b1cf5e9197b5e8437b23cdb141e0d9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017115, "uuid": "7d517a78-381d-4bea-96f4-4818ec057f5f", "comment": "Malware payload (AveMariaRAT)", "value": "ffaa9892ac379d46bd6f0359a9c1cd6170b3a787d632df36ccea1c871801c2cdb866ce17bbbea94d065a3823a838810a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017115, "uuid": "5bb78ada-de7b-48e7-9f08-5fa20a346688", "value": "T1E464F0142B698063FD7B8F30ADA4FA2609769CD30AA451465FD331AC3B3E1C9750AFD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017115, "uuid": "000dc29e-8263-4b0a-bfa5-ecc729b6e574", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017115, "uuid": "4cbda0f8-3afb-4c80-8da5-6972cff95707", "value": "6144:SYa6AvUotjvBsR61qoro5PBcxwN15a4Vr:SYYzjeRAqjcCBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017115, "uuid": "6175348e-e2a8-4d0b-8478-7e0787895904", "value": 315629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017115, "uuid": "6523873e-a73c-469d-93db-e5cef38817ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017115, "uuid": "2c5f3517-dcd1-41e4-a7a3-fd270a3ecb7e", "value": "PaymentSlipReveipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2f46df-04b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089876, "uuid": "00dea14f-f5d2-4980-af19-64847a536ff7", "comment": "Malware payload (Mirai)", "value": "693e834db07682573087887ace871cf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089876, "uuid": "b197fb3e-a50c-4eeb-b239-bb6907a2e99d", "comment": "Malware payload (Mirai)", "value": "dbe98a4021111427332975af8d51f5cfca696b528a426527213f1d18878565f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089876, "uuid": "27ebbc44-1402-4e52-b173-6cd07c075ffd", "comment": "Malware payload (Mirai)", "value": "238fdd820738237b25114fcaaa604e0cf7c8c1f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089876, "uuid": "24f0f498-e459-47ed-b55a-4e57477d59fe", "comment": "Malware payload (Mirai)", "value": "8c5a02abc42bf8ad444a62c02a7957a6095d2c346657b3a3e12b50ccb0259efede4651e46c3bcf8daf63489daf24e42c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089876, "uuid": "93a1c976-fef4-4346-8f66-6a2415812eef", "value": "T1A7637CC09A83D8F5D95705712433A3739EB6F23D0629E993E76DE637E851A42E20738C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089876, "uuid": "3368bce1-fa1c-40c8-97d6-a12a239244f2", "value": "1536:zce6NkuHPp64MEeQwvCpZdJ71f/R0eBbc6SQwgJZIFvDiBN4Sgr:zcecxPpFLeQwqJ1f/ieS6SNgv0+PG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089876, "uuid": "6c074f1c-92c6-4172-9538-812c3dd33253", "value": 71280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089876, "uuid": "246fc06a-ef30-4939-9be1-1bb69bc29445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089876, "uuid": "021189ed-bb2a-4100-a57c-c2ccbfff407c", "value": "693e834db07682573087887ace871cf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9cdbcab-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036103, "uuid": "37f1e9ec-fa81-49ea-a110-fd4aa00b7fca", "comment": "Malware payload (Mirai)", "value": "cab880e80054f589d41699cde51d70f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036103, "uuid": "ef3dfc39-3a4f-4622-ade8-6874f462fbc4", "comment": "Malware payload (Mirai)", "value": "dbf1eac3d2464ac5574650f6807ec8f2520048c52fbcf3fb5c0b0df8049c6fe8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036103, "uuid": "bb73d7f2-272a-4340-b671-e7548f6d1264", "comment": "Malware payload (Mirai)", "value": "2debb6821bf4ecdc41e511d04c911156e4599110", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036103, "uuid": "3d59c83a-c909-47ee-9a71-3a9d73708cf4", "comment": "Malware payload (Mirai)", "value": "09adb64f45f6f494edbb2ea7ba3b2bfaef22f667ef0da995f9c6e14a7b31bfe4b9ed5da4ca109b698795b5cc4e18755e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036103, "uuid": "def429cb-3d67-4bcc-abd1-befcc0bb8856", "value": "T1C8830893F801EBB3F40E977604D74B257630FBE60A532622736739A5AE322D53826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036103, "uuid": "1f1c75e4-1f17-4a69-8a73-b0284a2c29a9", "value": "1536:ZbUHH04mSbmD8GAU2zxSydjm1RkiON6zcjzU7+BePvcLtmzsKVqmjhRf5Ze:962SCd2zxSydjmvkiIU7+BePvCtmYKVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036103, "uuid": "561207c2-5eb6-4bc4-b4b4-a2ba27b24f7b", "value": 86757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036103, "uuid": "a09fa627-dc67-4b7f-ad8a-241a869c6a08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036103, "uuid": "fb855367-b065-4bdc-ae82-485467cbf34e", "value": "cab880e80054f589d41699cde51d70f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf284c90-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1686059305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059305, "uuid": "ddf14192-6709-495f-b655-e0852f9bb2dc", "comment": "Malware payload (zgRAT)", "value": "58a91896eaf6efe03ffe6ebb7b731792", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059305, "uuid": "68960603-ddf9-4b25-bcaf-7332c78adcdb", "comment": "Malware payload (zgRAT)", "value": "dc984e3a8de291d49bab5940b8f8047d2a7d8f0dab4231342c36edcee9cbb92e", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059305, "uuid": "5f79938c-4c50-461e-8b01-5b2f2eaeb02f", "comment": "Malware payload (zgRAT)", "value": "e3ec7807b22e91e887dd1bc752c426041607216f", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059305, "uuid": "5bbc3e7f-d2fb-43b5-8cce-66aa42c15d60", "comment": "Malware payload (zgRAT)", "value": "ccd74d23c99c50d4d9894d994bd63e79cdd2ed0ede7277769db98ee59c3cf3dbd088b278f50c3a97ef1a16fb35458ace", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059305, "uuid": "54ed3037-0e8a-479f-8682-fddcd0fe37bc", "value": "T1CEC4BF4A776AD46ED28D673BC6C50814A7A0DD82E30BDB4630C727994D0F3A7DF0929B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059305, "uuid": "5f30f660-a97a-4650-bea6-afda33a97509", "value": "12288:OBm+u0O5pDETlQ6ocFa59nBTDvdeLu3jaLWGaGAXd:uzAgQ6Y59hDvdeLuTwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059305, "uuid": "1cfa7b6f-e6e6-47fb-ba95-646da6b318c8", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059305, "uuid": "909c2962-4ee8-41ed-80cd-a5d96fee2c32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059305, "uuid": "23781a62-e988-4f3c-806f-ce745d0f9c92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d07570-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017754, "uuid": "6034abf2-eb0a-4c87-b996-6b4d087ff2e9", "comment": "Malware payload (RedLineStealer)", "value": "e7f16590b8d70430f4280834bb2acc6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017754, "uuid": "0944ddb8-e34c-423c-bcdf-8f0b8a520077", "comment": "Malware payload (RedLineStealer)", "value": "dd456a00b775915cd2b4e31415667b01c59e8f65b9e823f4d8b18b198ad7be93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017754, "uuid": "34865e8e-61bc-441e-a768-586b60b22068", "comment": "Malware payload (RedLineStealer)", "value": "7bb5c96daa36ad8908b3a82124975fb18bcccf36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017754, "uuid": "ad94809b-fc53-49ec-a861-21118938b2f3", "comment": "Malware payload (RedLineStealer)", "value": "48207ffa1a684e26fc5115ba9e555ac0874337ea261d9226c076622bb4d81db4444199258802556299a7bb156f677b77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017754, "uuid": "fbcb5147-d9ca-4d8c-a88e-24625a07b8bb", "value": "T127D41216ABE48163D9F43B702CF706930B36BCA25E7883673641A85F9CB3194A975337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017754, "uuid": "99c1dbb8-848d-4d49-b3e0-83ffbdc9f209", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017754, "uuid": "78e637e7-cd55-4be3-8ac4-b1a076e9a25f", "value": "12288:FMrYy9096S9JNW4TxQnAUkowaWfVaMZmhTYmA/Qm68qjO6qf:pyi0AUBwaWfVaomhTYm26HSBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017754, "uuid": "1f4edb2f-a1bb-4135-b49d-ab597768e4ac", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017754, "uuid": "867d2e63-98af-4475-b3c6-5b5621effc2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017754, "uuid": "241dfd82-370d-44ce-83b2-bf4edf9b64aa", "value": "e7f16590b8d70430f4280834bb2acc6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2eb800-0467-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686055359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055359, "uuid": "480f7a39-ed4b-41f7-ba41-32b5bc21a2a3", "comment": "Malware payload (Loki)", "value": "710d9ff3b02313f81c0ea6679a219c5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055359, "uuid": "5d988c89-93e1-4363-a87c-7683f54b2cf4", "comment": "Malware payload (Loki)", "value": "ddbe6aa81458808ff4ffb464a0871f0cde3e69fee90004625029ad882fc77525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055359, "uuid": "ef84264d-6479-4750-b4b2-000ddb39404e", "comment": "Malware payload (Loki)", "value": "0a14506262914b6d5a502fd407d2ca36244d2ede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686055359, "uuid": "cc929596-03f5-4b84-8597-8e461abcb6cd", "comment": "Malware payload (Loki)", "value": "77fdf87876b4ed489fade5b1ef013284b8c5b87fb542a7b9f48402d458f91be844dea599dbdc59ccb056144667448ea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055359, "uuid": "f75bde12-1319-41a8-b7a4-316b059b6576", "value": "T197D4F12853FE471AD6B367B656B4563093BBFE9DB631E30A0E87B08D1961F018A10773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055359, "uuid": "5fb87dc8-627f-4a11-978e-c7225b95ec29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055359, "uuid": "9bc10e0a-fc8f-438d-9544-91335d80f341", "value": "12288:ssIdul2iNfmFx2iqNhujGjU7eK6H0rvoCT81qCYdoC89GWlsWc1A+l:ssIdul1lmFxU06H0cr5MqPlP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686055359, "uuid": "ff495daf-ea1d-4673-aecd-b24bfc41cda7", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686055359, "uuid": "bf4b3a89-f974-4542-9601-9bc558efd4b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686055359, "uuid": "3a489157-8c83-4086-bbc5-579794d272bf", "value": "11121409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238bae8d-0431-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686031959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031959, "uuid": "3cf69382-16c3-4d90-9633-6f5977a3b270", "comment": "Malware payload (Loki)", "value": "918580a2ee130c88bee2e48902e20f1c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031959, "uuid": "e4bc390f-23c1-4d62-86a0-fcd73ea661cc", "comment": "Malware payload (Loki)", "value": "dde580a71be18b75001b8ec117a4d36e63e6bf39b7ea687a6a793913b07ce6db", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031959, "uuid": "96e30456-1b8a-480a-9299-fb3dc384820b", "comment": "Malware payload (Loki)", "value": "c61dc00f916d6c8d655b8f29d66188a92cb0be63", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031959, "uuid": "8dec845c-503f-4202-b226-2e17570ce896", "comment": "Malware payload (Loki)", "value": "a210ca75475bcd43551f9396a1283a6bdea43840adfeb40e6484a13c22efd13158e1facd5ce8b0ba9f8280941a5018a0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031959, "uuid": "c321abae-2fe0-4ee0-bae2-e4caafdd5f84", "value": "T1C9C423FE2FDBB0F84BDC5666645E30EE464D6C1A367A6AC7ED227A061F3190C784D042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031959, "uuid": "98cca633-c69c-4df6-a8be-7d416b7f5822", "value": "12288:AjgYYvHyghA11JJF5TPZXScQHzkLz3UHquvBDT:AcjH7m1J5TPcdTEzkHlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686031959, "uuid": "17806757-87ba-4521-b3a4-46aaebc23b33", "value": 545048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686031959, "uuid": "6289f66a-a590-438c-9df1-20aab6e7a4fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031959, "uuid": "fb5d7f3d-a615-4b24-ae19-1c62736fb2d8", "value": "Quote-19371.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69329874-04ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686090917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090917, "uuid": "ce297d3b-0124-4161-a434-40f46ca7eb19", "comment": "Malware payload (RedLineStealer)", "value": "b88343c63fc3a71531d9d82857832c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090917, "uuid": "3c275325-c92e-4a36-b9fd-aac1346ea202", "comment": "Malware payload (RedLineStealer)", "value": "de3c0f69ec7312383f29fa71ee88a7645e72f5063ced3952b2535c7fed8ce4cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090917, "uuid": "fa606aba-f7d7-4b82-b32b-704891bf1fdd", "comment": "Malware payload (RedLineStealer)", "value": "6a856512105d6aaf8d754b41ce064b796b1f2f33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686090917, "uuid": "b9894604-86ec-422f-b0c8-10e7bf6c650f", "comment": "Malware payload (RedLineStealer)", "value": "50ec5327364f671ba2903b509b61108d9f85ff23693a76dde9527718199b1b9f789461c50e67dd7cb6d3a88af9b4345e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090917, "uuid": "c52d2097-5ebf-4d46-bedf-8ac156a748d3", "value": "T13994BE60F585E8F2E54700B48C78EB55282DFB66062C09A73FB5786E09712C3B176E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090917, "uuid": "604a4fb1-fb4d-4b37-9cea-c20b491cec82", "value": "4702929088abf05768d9241bcca6fcd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090917, "uuid": "165efe46-505e-4169-83c9-d51246417536", "value": "12288:iv3kPTDVDzJtQvaXC1q7jxBP/YfsoJx+02WyYdXM:iv0rJIONBI3N1ymXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686090917, "uuid": "52a3a752-9f68-49fa-9f77-e6c5077038b5", "value": 443408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686090917, "uuid": "672e8d6b-3d9a-41ba-a627-8d517cab621a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686090917, "uuid": "fd9c04eb-37c0-4dd7-a937-02a7f62bb70b", "value": "b88343c63fc3a71531d9d82857832c68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118f3b2d-0461-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686052544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052544, "uuid": "4cc3f098-2845-4f2b-8bfe-7fc9b88bf79e", "comment": "Malware payload (RedLineStealer)", "value": "a5b705515cd97cddc3ca56f0bb984b15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052544, "uuid": "081a401c-dea6-4609-a1b7-53128c9e82a7", "comment": "Malware payload (RedLineStealer)", "value": "de466750e3251b670d847fee38ede68f4a019965cd086880b4ae1fb25faeae02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052544, "uuid": "9821c3f0-3a82-49d4-8fcc-d79dcff4cacf", "comment": "Malware payload (RedLineStealer)", "value": "5bf1665085e3a8e9da62d09057ffb8840d126400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686052544, "uuid": "5363991b-242f-46e9-bdf6-a9342a1cb998", "comment": "Malware payload (RedLineStealer)", "value": "46414c60f02f3ae44a68dce233437adb7fa5dbb2a329abbbadd79cc8df0de82e76c0b33e255eeef9d02335e86393a9f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052544, "uuid": "7c6d6040-2ea8-4b37-ba06-8f62c44bc303", "value": "T10DD41203EBE885B3E9F55B7028F603C31B39BCA15A78936B17C5AD6A0C726909531737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052544, "uuid": "a5da7f8c-b6e7-449f-bd21-6afc5c22062b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052544, "uuid": "9ce67008-dfe3-4670-bf36-232f427935cc", "value": "12288:TMriy90jGA21XIB7/pnu4V1x/FlzI2HydFmmycGXCfCVwJ3XNAY:Fyo21YB1nuIHjSFmmiCfCg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686052544, "uuid": "c641efb7-1d2b-479f-a05e-d2b1e093408e", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686052544, "uuid": "53f80f18-d29f-4514-aeed-e52be2eac7f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686052544, "uuid": "8cb95ad4-590a-4718-b2bd-c902518264bd", "value": "a5b705515cd97cddc3ca56f0bb984b15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02364cf9-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089885, "uuid": "1277faad-2a6b-4486-9753-29226ca106bd", "comment": "Malware payload (Mirai)", "value": "0e301b5bb06a64973655845483773c4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089885, "uuid": "10be6454-ce25-40c5-afc6-c89931da6d94", "comment": "Malware payload (Mirai)", "value": "dee8270dc576b8356f3fe5fedfa81deef55cec21f41455160fc0c2265f02b907", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089885, "uuid": "5d0ca5a3-4ca0-4028-8124-1252060aa8cd", "comment": "Malware payload (Mirai)", "value": "4cf404cf3e83bf4bb4c39ba0def6eec2ce49593f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089885, "uuid": "9f806b1d-eaec-4d61-a0b8-7aa73f538fcc", "comment": "Malware payload (Mirai)", "value": "43d44fefd658cd61911d722e9c029350299e8a7c66308a8e71ca7891555634e4d57ece1e484af312b1398d7dd6d30778", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089885, "uuid": "adcf01d8-6a2a-4fdd-bf99-85d4b2a3866b", "value": "T1BD439E77C47A6E90C04482B4A5218E746F13F90EC2A31EFA9AC5C6764047EBCF6163F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089885, "uuid": "7a2dbbaf-6a34-44fe-8439-d4433af2a8d6", "value": "768:NaaAwtAsRsqMeaYyGcmKUeVEIRty385n2SrBCtNX6NXCzjoSWU97CbBq:NaaAwtAX7/Gcv36QEjSaspXST7CbBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089885, "uuid": "c9a56e0e-11e1-4442-915e-0b38c990533a", "value": 55572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089885, "uuid": "4e12175f-c379-44d8-a611-dcdf3a7d436d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089885, "uuid": "17c38128-d59e-4d4b-87ed-33c62325f295", "value": "0e301b5bb06a64973655845483773c4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedaa70d-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686059251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059251, "uuid": "ad24737f-e1e4-4a21-b044-527809dff827", "comment": "Malware payload", "value": "e482a75a83329a3c0f13ad4b7cb02398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059251, "uuid": "49bf94d4-baeb-4541-a397-e9a834c1bf6c", "comment": "Malware payload", "value": "dfa1f1b246d6e73fe4479139d20a9e36653ebeede276cc1bedc82ca9c976b4d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059251, "uuid": "22973b34-7ab6-4014-ac15-f15d8ec90cf8", "comment": "Malware payload", "value": "65f5f11000d46f7cc6e316e849d5174ef9330d8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059251, "uuid": "dbe75898-8283-40c0-9d52-46f246977911", "comment": "Malware payload", "value": "ce6ef6e2caf016189714c50bbade83ab0fc32f9de733252baa8115fa99a4054b8e14a0a9c647190e73df42fbdda165b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059251, "uuid": "d881aa91-06ad-43a9-bcda-8b99b3f1401d", "value": "T11736332A2F8131BDC1D79C381FC662753A632ED950D598A7B690D40D0EAC3F7F91A878", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059251, "uuid": "26c7aa0e-31b6-4288-994e-9198086bf494", "value": "adb38126382ff2f605e2448a934a8ca5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059251, "uuid": "ab028a44-936e-4892-9283-f5ccef74c781", "value": "98304:rVtrewFbUiOrieB0TF+v2obiy+awfO58fk2XFwia8SN++o:LZbUtGeGJ+v2oH+awG58bXFVaHNro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059251, "uuid": "377164fa-c25e-40eb-b124-572ae8aede44", "value": 4973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059251, "uuid": "91a18e13-161b-40e3-af83-d376d9d0c291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059251, "uuid": "c782d529-614a-48f8-86b3-93a5b0c5efca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1525369-04aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686084139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084139, "uuid": "1e01dff2-761c-4a6e-84f9-0a1b84d9e7c0", "comment": "Malware payload (Mirai)", "value": "0c35e87ecb7f50920197af91263aaf84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084139, "uuid": "1723dd70-0be0-4991-8a3d-a7cd41ac4ed0", "comment": "Malware payload (Mirai)", "value": "e07c46f57abdb76f56e834dfcedb9849084c124c26993428c6a7ce9955fc1f69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084139, "uuid": "f2df8f9d-7dc3-4c28-9969-e17951a7d247", "comment": "Malware payload (Mirai)", "value": "42a273e520542a1d798f34bc20c3cfc5904787fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686084139, "uuid": "e6c4d18a-d35c-484a-839e-ad2908685b19", "comment": "Malware payload (Mirai)", "value": "4271d708ba862258304450888503973c90b45d6ad06907f1c8e3762d973fc0e68beb4708b01fde9699f29fdaa68235ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084139, "uuid": "5a40c7ba-cbe0-443c-a9f8-400cedc2b8db", "value": "T1B06302E1C4003839E4B0F8F9D701D0437B06B1BDD89B317792914851B9FB685E7E95BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084139, "uuid": "2f51a789-43ae-4867-9d32-9f5f3e7849a9", "value": "1536:xswJ4i3x6/lC0Xj/zSAfyUSk3XipGT2mdvTIKxIim8y:xs5Ph/SAfyvkH8GTHvtSJ8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686084139, "uuid": "bc436ff0-1d96-4ec7-9f9d-8e61e29bdf8e", "value": 71484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686084139, "uuid": "8d65b535-1612-4034-9dab-0bc02ed07b29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686084139, "uuid": "ffe368ae-99f1-44d6-a7d9-1d1d9c1a6b0d", "value": "0c35e87ecb7f50920197af91263aaf84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0c99db-046f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (EternityStealer)", "timestamp": 1686058551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058551, "uuid": "83bc3731-2902-4191-8df3-2d17b3c6e2fb", "comment": "Malware payload (EternityStealer)", "value": "85f723845b73f7791ecfc84bde974ef7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058551, "uuid": "8ecbf408-c3e5-4f1e-9c4c-2362cd7068ce", "comment": "Malware payload (EternityStealer)", "value": "e15df041092b52383517b47eae02f7e5f452b180dec8576f449cc582b62bcb57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058551, "uuid": "961d841f-1cca-4e85-99b7-37ebf26c1fdf", "comment": "Malware payload (EternityStealer)", "value": "1fb4bdca8d1a865422818205fc9f9ff915dfb353", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058551, "uuid": "ce8475de-9bb4-4df6-9d11-4e1f32b4a29c", "comment": "Malware payload (EternityStealer)", "value": "6198de9e110334b15c232bfeafbe44b5aa1bbbb166f6977287d76ef2824a8a63e1194471c04d4938cda5a6cd0f576e7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058551, "uuid": "1a9d8134-cf9e-49fa-ba55-b79172cb8898", "value": "T1153533F1B7950309DC1DDD32A5E1AACB4BBD39D1ACD0349BF63A4594CA113320DE6B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058551, "uuid": "2d3e688e-6216-43f6-8a1d-88d43c07a8e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058551, "uuid": "20c1ad12-8c13-4303-96a6-c1ce9f75e577", "value": "24576:wvYW8ajlsWzMs3JU7+FLj8eoF0mA88u4GtJM1pB1:wXlJzMs5Bhtmb8u4KU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686058551, "uuid": "4eaef657-b008-465d-993f-e0867079aa34", "value": 1069064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686058551, "uuid": "c7a4e212-9ef0-4ffb-b8dd-73945a774b01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058551, "uuid": "a6590aed-1871-4322-bf52-d759e3611949", "value": "85f723845b73f7791ecfc84bde974ef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b308df76-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686059258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059258, "uuid": "01197724-c85d-43b4-b6d3-e3a0ab3d3bba", "comment": "Malware payload", "value": "fd59bd3d4746805751cfe6a936dd2845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059258, "uuid": "24e8c1f2-8a4a-473a-954a-9245e22e4770", "comment": "Malware payload", "value": "e179897585a4cfcc0daccddacfdde085a4ce363706aa858707bd698ba42dc79e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059258, "uuid": "8ccfbd71-e2a6-47f9-84ab-e235b2ca63de", "comment": "Malware payload", "value": "5a50900e19a773e8253f9c0217671d66e1821139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059258, "uuid": "b7665083-e473-4ac8-b884-c77dffbbe19e", "comment": "Malware payload", "value": "88c3eca05404044894242b9b6308f3efb7a1a319d73abff14231a03d83ce5aff085a901c271be19ec69523f3ac3fa4a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059258, "uuid": "6f9049fa-577f-43c8-8526-af1601c722ea", "value": "T1DEA6E0E265C1258DC12AF6BC8005FD3EE7C7B4F91915B8A35DE123728D27840BB95B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059258, "uuid": "7821a9e4-84c2-4162-91ff-e26766966848", "value": "a3017ccb2c25f455f959277b4c3674df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059258, "uuid": "a5345ded-64cf-431b-83b9-084f1c592c63", "value": "196608:ndIRGWlhI6gUQWZtCjT0u7+gu4WO6d3rjX57QfOx8k2NwzIXK+JVsWj7X:nGMWlhI6g/WZHa+gAd3rjJEfOx8R/X/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059258, "uuid": "042c4c64-6adb-452b-9ee8-3b2ca42336f9", "value": 10362056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059258, "uuid": "d1eb483f-b67a-484f-9753-d2bf19ccbdc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059258, "uuid": "7f694deb-ef71-402e-a53f-34ebaecaf499", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584f03cc-04b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686087023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087023, "uuid": "3ce5c286-aab1-4283-9f19-004bf16cc805", "comment": "Malware payload", "value": "ac340aab119218d83bca2bc83c9325e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087023, "uuid": "ddd715b2-d20f-457a-8a2a-0336ec8ecc93", "comment": "Malware payload", "value": "e18057fbea6277c6bda4a6cb2315c206bb795de764991fd46d6ea8d613d4b71c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087023, "uuid": "0bc0c77a-0152-4cbc-936b-2e25a8322630", "comment": "Malware payload", "value": "2c2c369119de25c278daff9a19d3891d09e365ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087023, "uuid": "24e3cebe-4023-4543-9d4b-432971844257", "comment": "Malware payload", "value": "a5b66e7cf7945dc33706e39db43d01af21037fd9675a1a745cf464625456e735ee424b9cc3f4371577b9ef45084a0857", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087023, "uuid": "e188e676-6b3f-4dbd-b280-fcc4739ac4de", "value": "T15DD32A06B30C0D47D2672EF43B3B67E1D3EF9A8121E4F640255FAA8A9171E321586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087023, "uuid": "d85fc51e-edf3-4c8a-96f9-82c43e74e5ae", "value": "1536:tCaQKUmz5ZfaxBVvqzs5mcXcOVs6AoDzKwplvA8vXEVYh+Ug5q3dxqxl:fZfaxDyIoAcB63Dry88xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686087023, "uuid": "468395e2-5069-4d8a-b474-2828c0f8df61", "value": 133636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686087023, "uuid": "6f3be506-5408-4717-9995-31736e0f26e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087023, "uuid": "70ee28cd-ebfa-4152-9470-44e633d34381", "value": "ac340aab119218d83bca2bc83c9325e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3afca07-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686059286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059286, "uuid": "37c58bac-e401-4098-865f-200809f67d12", "comment": "Malware payload (RemcosRAT)", "value": "66108176e22e6f9513a62c76f2185468", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059286, "uuid": "63ae70e1-868d-4c1a-bf7a-642e98190d2d", "comment": "Malware payload (RemcosRAT)", "value": "e1eb3fe18ad660415f59eaac2c768afa1b20e07f107dfc207da8b0880a888aaf", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059286, "uuid": "56b36b3a-fb8f-4878-bede-0312a0363aa4", "comment": "Malware payload (RemcosRAT)", "value": "a05e217104b39485fbb4ce3cda9cb65b20960ccb", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059286, "uuid": "47c58dd0-3305-4ba0-9e16-32d0c0b8b015", "comment": "Malware payload (RemcosRAT)", "value": "692d81bfafcaf4dcf06a3c036895603ecad55442b10acb844d02c64a9d3fd24eaa848eda1a51ac85d2a6ec8f8390872d", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059286, "uuid": "c567b597-eec0-4a0b-8ac4-5b6e85a8635b", "value": "T1F7B4129CBB1079CFC897D630AA880C28AA94B437970BC343B497255E9A1D2CFCF555E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059286, "uuid": "7bdfbdf2-f370-441e-9c51-2c3d0b28084f", "value": "12288:oeV56CrxH8gnW6yhQNmPLXWu38n4RQgsAlVF+LpnN7TihIHVQMfT:deCrxsvh/Wusn4RHZvF+lnd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059286, "uuid": "ecbd4fc6-0475-4c5a-aa73-ceb1ac1bd118", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059286, "uuid": "ffbaedb7-bf32-4466-ae66-2b586250344a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059286, "uuid": "8d66f3fa-3d4d-4a45-8ad8-bda4c719fb7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac16855d-0440-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686038630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038630, "uuid": "70c0638d-5c6a-41d7-849f-2166a0ed2f2a", "comment": "Malware payload (RedLineStealer)", "value": "7c3b0a68ad72079bca534b99e6b3c689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038630, "uuid": "0ff91882-44e7-44c8-b1da-1a55a178957f", "comment": "Malware payload (RedLineStealer)", "value": "e2b5ba2b04a1ed38f0b9cc6ac3305e12b15369235b5796a41fd929ba99a4fbab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038630, "uuid": "cd267f19-9527-4596-84da-660a05d24629", "comment": "Malware payload (RedLineStealer)", "value": "7527c09df7e3f3afe5a9a75c25f41fcdbefbfcc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038630, "uuid": "c7edc109-0c53-4f5a-a056-b7a6867212da", "comment": "Malware payload (RedLineStealer)", "value": "eddb2526125de94eb3d7c6ff22975f56b9098758f526cfaa64d22a9def47bec952b5fc2c4473a8557153e54a43f93f02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038630, "uuid": "d4669a8b-a0d7-458b-99cc-36e0b7fa4651", "value": "T127C44107BD48FB80E5182C37C4FABC242396B1EB5133C54B5F45EE619A8335269A972F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038630, "uuid": "6440c57f-9695-4a36-8e73-d3bef8cb6429", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038630, "uuid": "d507867a-7070-468e-8bff-9f5fe84c5716", "value": "12288:1a9g3YVM1cux3DfH2pMUq/vtpFzKt3rNFUX8Ur:dOux36tq/vtpF21UX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686038630, "uuid": "8b96a366-dc23-4a6f-a93f-3f3a641ac251", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686038630, "uuid": "0490f845-3066-4ed5-b430-7babcb469171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038630, "uuid": "57bf4a0c-4a64-4f94-9fe9-705b42992d29", "value": "gorillanull.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29dc05ff-0430-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686031540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031540, "uuid": "18e0f72e-0879-4272-a7d6-6405dfa07d8c", "comment": "Malware payload (AveMariaRAT)", "value": "c722653b8cec7cb63e3915b698b46c22", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031540, "uuid": "5af8b9c2-cd6a-4277-8700-54fb9387e176", "comment": "Malware payload (AveMariaRAT)", "value": "e3578acb20ffc36bf721b7dd819047012296ad2c5e0aa5cbacee67d17b1b4558", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031540, "uuid": "e26bdf2e-94a1-4ce9-bf66-68d608193986", "comment": "Malware payload (AveMariaRAT)", "value": "721b7f738a31e88b2fbd6362404f14cb595fb686", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031540, "uuid": "ba761542-7355-414e-a1bc-f08122bb7b03", "comment": "Malware payload (AveMariaRAT)", "value": "9bad369335235c83be0c6bcff07f909df95ada2ebb95cdc35c1e56e7c3fd96977cfc7e0b25ec81bf5126e6b74d7c8a73", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031540, "uuid": "0c01f715-1fc8-4458-bd8a-2df38ea96532", "value": "T13405C027E9F04C7BC56765784C0B67B9E915BF603A28548A97E53E0CEF391803829E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031540, "uuid": "15c0768c-31a5-4c88-99b3-a56e2dade91a", "value": "0e3a57917dc42fbcd9ba577c5afd3603", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031540, "uuid": "59c5e41e-0db2-4d51-999c-ba6ea85c0dd3", "value": "12288:tqcXKzYRKvoT9GfENy1H+n4J6m39o8K796Wrk0SDpcCMZMg:tfXKoT9GfENy1H9Q7f796Wrk0OpcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686031540, "uuid": "c1ba1495-89c2-4dad-b2dc-90ce8197a046", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686031540, "uuid": "f235fb9b-09f7-4753-a4d8-c585bd64888e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031540, "uuid": "8b20a968-456d-41b0-bde3-ecdf069c58c8", "value": "DHLMS-PPT88122012816310TD012023060617377 PPT..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06995922-0476-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686061545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061545, "uuid": "767afbd4-1b50-4020-91b3-56970e44f9d9", "comment": "Malware payload (Formbook)", "value": "f522a519e7d28a8cd1222e9ae35665de", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061545, "uuid": "d8a406f7-f428-4838-a4b4-e3959985b37a", "comment": "Malware payload (Formbook)", "value": "e3f543b72690715726ceffb1b05fb2f9824e54692364cb676aedee3df0aa22fb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061545, "uuid": "9c871f2d-6bd9-4cae-9c69-112fed4f22f6", "comment": "Malware payload (Formbook)", "value": "3a6239f464fefa53e3155128cc48e312740b576c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061545, "uuid": "fdfbe1e9-1cb9-4a0e-b291-dbf41a0e2848", "comment": "Malware payload (Formbook)", "value": "6f4b7e38a5dba3729e5f5a494f9a2eb86a4d3bfff41e16261e8e626084ce47a3d953a739981733cdcf6da140d5b9abaf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061545, "uuid": "28ac0b5e-c5f0-4cf5-bf4c-e468715a4f9a", "value": "T170353301983413524B56793819FB99E974E3F46A66AAF10C81D0388B0CF9BF7E6EF471", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061545, "uuid": "1b3015c4-2ce4-4423-9c6a-f6d541164126", "value": "24576:QcLoH4dDpxKQ1yqCu+mpIEqgPUXylEH+xDGN5Sti7l3LTg:7LUsyvipIE1PUilEH+xDGHoadfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686061545, "uuid": "753ab119-c1ae-47a3-bf28-cb444683f776", "value": 1109079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686061545, "uuid": "31efe50a-96a1-47cd-bff0-dde9f72e1998", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061545, "uuid": "5ea3ddca-0bc1-4662-9edf-2d9eaf876f04", "value": "PLS. REVIEW ATTACHED INVOICE FOR URGENT PROCESS.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb500b66-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1686059298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059298, "uuid": "9834190a-49bd-4d77-becf-0e18f3510aa3", "comment": "Malware payload (Glupteba)", "value": "5e7d3490818e3f2a96f7a9dfc6950f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059298, "uuid": "4e047ba3-4a46-496b-9acd-4bb65ebb22d7", "comment": "Malware payload (Glupteba)", "value": "e498809a30cab90e8d5eb3ff4610bc177ea9e63110530da50643332263f4ab55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059298, "uuid": "e5ae70e1-4cde-4198-a517-a8ff3297d497", "comment": "Malware payload (Glupteba)", "value": "934454a655f32b4645ce827b3a39bed2cf5d891c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059298, "uuid": "fd048fe9-a58d-4042-a4e8-fa3e4e71f657", "comment": "Malware payload (Glupteba)", "value": "aeac47f30226930b977787ec45e12bf102a127998d87c7fae0f1564981169f143e6dcb0deb8c2c6cfa324de0283b28ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059298, "uuid": "2158f7a5-4d5e-4711-bdd2-ac17e21f01a0", "value": "T1E4162353D295BD50D9AB4A73AF2FC6F87A1DF4108F563B6A02298E1F1472772D1A3B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059298, "uuid": "2fd65fa4-03c4-4828-ab38-acb12de39897", "value": "96475f7ea3cc105ae1bb971e987af868", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059298, "uuid": "fdb42736-9768-414a-a56a-198b81f8e3b8", "value": "98304:6tF4ah6fnbBWKRFjbBoWQaZBcADzh9LZIm9riDYPhtZj:1c6foKbBzDcADzhht5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059298, "uuid": "5402b548-c8c0-4431-890e-ffd56860190b", "value": 4377472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059298, "uuid": "04620a61-e2c7-49ac-926d-e452fbd6bf94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059298, "uuid": "a8af510e-52cd-4266-b39b-a6b055bb5f4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab0f97e-0439-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686035702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035702, "uuid": "57cb454d-0ab7-4f1d-be2e-1b26d3dfeb1d", "comment": "Malware payload (Mirai)", "value": "481cd6c1171be7cd05c1b067ef8cd241", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035702, "uuid": "f2703b2d-89ff-44c9-a007-3bbec0f47682", "comment": "Malware payload (Mirai)", "value": "e4bb02ff8957e775524d0455e80bef510fdd59c7326633f1f8dc470e89aaa282", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035702, "uuid": "8111e19d-8343-441e-b637-c0662898578e", "comment": "Malware payload (Mirai)", "value": "0ced724a71a1a760cb29f6d11c0959282c9a80e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035702, "uuid": "c575a200-1527-43d5-b78a-d83300142240", "comment": "Malware payload (Mirai)", "value": "03e88369a4e2a88e390ca7323c027a14de5d37d13047f149279600b6c8e1bb8291ffb6c1eb9055362e6eac7563dfcde3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035702, "uuid": "36a42566-ad5d-445f-be79-f696db6d17ea", "value": "T1EDE33B09E7408B57C0D22779F7DF824633239B94A7DB33095638ABF43BC27A95E26905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035702, "uuid": "4c0aeb5e-569f-452f-8e23-5582d6274ffb", "value": "3072:oq3Bl9M6ho7KY1asT3BC8vc2DoM/9nwSFmSwf8mQ/zn:ZBl9MaouY1ayA8vpEM/9n3FmSwf8V/zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686035702, "uuid": "ca0a8130-750b-4925-af39-113c5ff3a2e4", "value": 143785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686035702, "uuid": "ebb6c496-5643-4aa4-8540-f893b5c8b450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035702, "uuid": "5ef398d4-f5bb-4260-b03a-77b2f5bc551b", "value": "481cd6c1171be7cd05c1b067ef8cd241", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a4f224-0480-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686066048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686066048, "uuid": "e1918645-1ebe-4eaf-bb21-8006aa5f7713", "comment": "Malware payload (RedLineStealer)", "value": "195225de9ad53f7c6bf764eb6714c9aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686066048, "uuid": "88d5f1f9-26e1-407c-b627-1418606cea63", "comment": "Malware payload (RedLineStealer)", "value": "e54b85af68b54873630516e9607bc07d3be2ae54696bf90396d9521ae7d06749", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686066048, "uuid": "64bd7f37-09ec-45d4-8552-1b43ac26f0e6", "comment": "Malware payload (RedLineStealer)", "value": "7ba40d913e60c3d4c8729d4a622135250364c712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686066048, "uuid": "d6697197-3b4d-40b1-bdf0-b03325e999c6", "comment": "Malware payload (RedLineStealer)", "value": "d8f26dfb7b48182b0413d02b94f24751b5b235c59c0a2b05d9c9d1a2156b587b83a2e17d80fd3c55148f6bed9727ce18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686066048, "uuid": "3dcd46e0-cdac-4b8a-a03e-3f2b4a1bf947", "value": "T110D41207B6F88173EAB517706CF607C32932BD61A975972E27546C5A0CB2AC8A43173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686066048, "uuid": "241469a6-4f84-4907-9fc4-a599bd047ec0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686066048, "uuid": "2a07173c-3645-4efc-ade3-7212a9ecee22", "value": "12288:7MrQy90O2OdSyxIjJygOWZkyjWJj+f4dHmKV3SpvnP9MrninV:zy72OdSyxIjJyghZejDHmK9kn1UninV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686066048, "uuid": "564877c7-47dd-42fd-8213-4937a1a5360a", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686066048, "uuid": "370ac0c2-691d-41a9-b863-3d6a9a6f661b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686066048, "uuid": "476b588a-4241-46f2-bd55-7c0bbe29df4f", "value": "195225de9ad53f7c6bf764eb6714c9aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c995ca-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686089889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089889, "uuid": "cfe50e7d-0bf3-440d-8d7d-26049064dee2", "comment": "Malware payload", "value": "1a7e8406f4db5a4f0024056b15f5c351", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089889, "uuid": "1d254cdb-0548-4985-92f0-6ffb3687dc10", "comment": "Malware payload", "value": "e6e387e17abda1482fb4fc2fb8124ecf80280a01c401a5fdc8f78007994263cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089889, "uuid": "80954453-bbb2-4db1-a35c-a7305820e3d1", "comment": "Malware payload", "value": "886fb19cb5c6cde2ef32d4c5d9b6615b124f0287", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089889, "uuid": "f568803a-fe52-42de-9ee2-b0940685099f", "comment": "Malware payload", "value": "37fb7fb1be1e70ed60ae888b753340fe2722c2980fc48ca50b25586c703b8b3841f040deb5288e981a1a59144e612e56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089889, "uuid": "28e8ed9f-595c-47b4-b982-9cd779f0b589", "value": "T18E535A21A93A2E27C0E4B87E12F34764B2F2575E35B8CA5E7C720E4EFF2164061136B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089889, "uuid": "b5ab7b14-7cd0-40e2-9160-a3c79f480177", "value": "1536:AfXSQ+fI8Skz1t4Eb9MkhD2ArhvBQRaPf8:iivN+gDRdoaX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089889, "uuid": "0c53eeb4-440b-4249-84c8-344a6f31ba28", "value": 63200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089889, "uuid": "6d3884fa-f6d1-4079-b249-fab7b1921e8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089889, "uuid": "c78bf6f6-e9f1-47c4-b600-08e0492a5cee", "value": "1a7e8406f4db5a4f0024056b15f5c351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d7dcd6-0414-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686019829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686019829, "uuid": "72671088-9051-457b-b1bd-aaa75538dd70", "comment": "Malware payload (RedLineStealer)", "value": "63aff83d91305d59d98f5e251f143456", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686019829, "uuid": "6fcfac32-b6a2-400d-9501-22a5c7a5c575", "comment": "Malware payload (RedLineStealer)", "value": "e788ec61549dfb2a7e09ee105e86cd1fe6e62a514597aee43918c97353b5758b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686019829, "uuid": "c8810ea4-0c79-435f-9863-72c0f6b14537", "comment": "Malware payload (RedLineStealer)", "value": "4b546039570c29e6080345427defead0453cd875", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686019829, "uuid": "7735943f-f693-4910-8cb2-2ed51031a97e", "comment": "Malware payload (RedLineStealer)", "value": "efc0da5cc7863ed55de6b900e65d85a40eb52906dc5e9a81e6992de9ebac65b6faeaadb17b13f00b73a4e8b59a3672fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686019829, "uuid": "ec6c8773-d635-4dfc-bf0d-edb9cec65846", "value": "T115D41202E7D55033E8B467B118FB02D30636BCA2597C426F27826EAF59B2744F5713BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686019829, "uuid": "be5b26e7-37d0-44c7-824b-a6fa3b1501d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686019829, "uuid": "e1ad1274-a2c5-4260-b95a-136f534eef5b", "value": "12288:QMr6y90W1tqx0pfJZmeAmMXI6vpFxwn9F/+1brJIs0x:6y/5vmeAmMXI0pPw9N+brOs0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686019829, "uuid": "b6cf59c6-f473-4268-89c3-23f9e6151c56", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686019829, "uuid": "5c5a8570-100e-461e-9f20-0a15ec9a7a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686019829, "uuid": "5e2aeb42-0781-4972-a171-46403c4ef39a", "value": "63aff83d91305d59d98f5e251f143456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d37205-04b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686087614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087614, "uuid": "958d9205-309b-410a-94eb-4716dc1077a8", "comment": "Malware payload (njrat)", "value": "b701e3585e852755624bc4965e7af509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087614, "uuid": "80c4fe3b-30e1-418c-ba14-d9d110dd7f86", "comment": "Malware payload (njrat)", "value": "e79459dc4c5898824dc2d32d24bcd0156e699fbdafb68ba6e5daa43cce5cbdda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087614, "uuid": "6fc8c665-815f-4bfe-a90b-b44db5c1bbd9", "comment": "Malware payload (njrat)", "value": "38f7bee5480c1f5d0b08d7d072c0980971a9eda9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087614, "uuid": "2a8790ea-c010-4dd6-b91d-226a6239bf9a", "comment": "Malware payload (njrat)", "value": "93e78c303b542c1d9bfdc806c1973b06ff47f75a77aa74dc70b3980d513f9dc825c800954df86363d6e3f51c67883a4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087614, "uuid": "b8266879-87a5-4bdf-9fbe-3639452081a9", "value": "T169033A4D7FE18168C4FD167706B2D0120BBAE14B6D23D90ECEE2649A37736C58B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087614, "uuid": "ab51c6b1-7abf-48c9-9eb7-78053b84217f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087614, "uuid": "e4b0b426-283c-4b79-b580-4c3308b66c3c", "value": "384:IKwCT0i9rdTe/kCOyU7jcnZ8DfmTgrAF+rMRTyN/0L+EcoinblneHQM3epzXKNrW:h1J1CFU7jcC7m8rM+rMRa8NuYot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686087614, "uuid": "f0b1f687-8ebc-49b7-9a15-0a3b283fbc3e", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686087614, "uuid": "b22eceaa-8ffd-4cbc-aeb4-fdbf007bb4df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087614, "uuid": "a5d2a019-bfd7-4be2-8957-9702eda2664e", "value": "b701e3585e852755624bc4965e7af509.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1d5a9e-043f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686037989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037989, "uuid": "496220a7-830a-4d3f-bbd1-c616a4f0b099", "comment": "Malware payload (Loki)", "value": "908cfdbd7db0913e3879582f0a3814c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037989, "uuid": "97b6c5f7-864b-4b73-b362-1361f55e7d17", "comment": "Malware payload (Loki)", "value": "e955fc3741fe1809aa1c2ac006e8a64e9db41e666554e69e426111926c30d3f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037989, "uuid": "1edd9de0-de0a-4a43-ad22-1f9b4b1c34eb", "comment": "Malware payload (Loki)", "value": "c2e0f2f52b4b7c4b9df5999ec4b0920c1d1920c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686037989, "uuid": "93f4e140-a932-42b4-8f4b-24f1020eaf09", "comment": "Malware payload (Loki)", "value": "dd4ab0e4239c01658f35a984961523409419306ca9053432d37bc4410b33fe4cabab86eff3960bfd0ce45f543a00dbf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037989, "uuid": "a38d8459-4710-47a1-9167-36294f5098c0", "value": "T195D40144736C4B13F6BA7BFA1221AAB007F5B92A7034E24F0DD273CB5666F048655B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037989, "uuid": "f1c7ec5f-a6c6-45de-bd02-db51045e8091", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037989, "uuid": "deaca6bf-e00f-4152-90fa-05a6f03d9fba", "value": "12288:oKS7z5GoJiGaq5auNhXpjNsJ17UY6Zs6wMi9IvvEm5/Lp:s5GoR5aEHjNpwMi96vEazp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686037989, "uuid": "f49ef1c4-3a52-47a5-918c-390d254b30ee", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686037989, "uuid": "c839a617-10b6-4051-8a7a-2204f54fa097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686037989, "uuid": "f4d436c6-d384-4d4e-b2ac-9ed822fb11e1", "value": "fund transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462a92c7-0475-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686061222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061222, "uuid": "515f2c73-c5cd-4fdb-a373-b454a8bcb111", "comment": "Malware payload (AsyncRAT)", "value": "5361c749c00af33849c9807d67e91083", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061222, "uuid": "0454661f-4c14-4eb0-a24c-70dee0ad60e5", "comment": "Malware payload (AsyncRAT)", "value": "e96272b73c791ba1159f7752818277eef009b0eb5945bf8405536b4ee399042b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061222, "uuid": "11677439-16b8-4d45-b144-db175b363fb1", "comment": "Malware payload (AsyncRAT)", "value": "12be37b073a142d96e895fdbd5781e6b29a569e3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061222, "uuid": "88625bb7-d725-4a3b-8346-22a0d1847ef6", "comment": "Malware payload (AsyncRAT)", "value": "2d1d051dd790f23549568bfa9dfe10754984d48fc9df691da6074e6dfcb26299bb0ee5a9a0376737a1b2fddab390d993", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061222, "uuid": "b0b4ed10-03bb-4747-b137-76510447d32e", "value": "T1CFB423AAD80D4AE508302440BF660652E4FCEA6C3FF6662BBF761D0945BE85970C7D73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061222, "uuid": "cc42064d-1585-48cb-be90-51d12fea2e66", "value": "12288:gjpLDWkQlDClcxO52x7CNAASbOvD2mHp03Usdq4NBQok2P4:K/sZgfMqHN72o03TgtoJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686061222, "uuid": "fbeeeac8-0e55-44c7-a3da-c01609f70e62", "value": 533444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686061222, "uuid": "99524f9e-f6cf-458c-ade3-571cd0465b92", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061222, "uuid": "b64400d3-becb-4b82-897e-ce27c1d372dd", "value": "New Quotatrion.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa376bda-040f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017716, "uuid": "72c8b2d1-b6bf-4d0a-aa85-900516259aed", "comment": "Malware payload (RedLineStealer)", "value": "412472aef182e10d0ec92e8b2a61c4b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017716, "uuid": "a1b38464-69dc-4749-9a7d-9fbbd54e1678", "comment": "Malware payload (RedLineStealer)", "value": "e9ed09e150516340dbb0d9560b74d72adb900166ecf7fc66aa41215efb7ebc71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017716, "uuid": "5ee3b470-d951-4c1e-9d50-3e6bf429a740", "comment": "Malware payload (RedLineStealer)", "value": "bc931dfc2573dd6dad0d7396680dbe68ceeea148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017716, "uuid": "fc292b1e-c650-4439-9fd6-400328cd5f65", "comment": "Malware payload (RedLineStealer)", "value": "6700cd15adabf6baf80012b00b40e5ffcd59ae9fd1b7f6345f13f576d674e94eb1267b519382a78ca2660b3d6eb0a2f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017716, "uuid": "24193152-d87c-49c0-8cc5-6e41681c5859", "value": "T1D6F41242EBEC4423D9F91B310DB60B831A3ABDA15DB197BF2391589E5DB36D0A434327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017716, "uuid": "3ff463ce-b8ee-48b5-bfb4-2a84ea932c30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017716, "uuid": "e746fb56-8d33-4133-9c85-efa366164b92", "value": "12288:xMrVy90Pj8PeQtP2i87zRpKxn+w4RPGl/xFW2KqyTFP+1pmmp1bf7/:MyQj8mtd/zKxnHltJMP+1pmQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017716, "uuid": "7a6d643c-9110-4388-9931-f5fead5435ca", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017716, "uuid": "211be315-0772-4344-94e7-f97086c8ac06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017716, "uuid": "3bc507d8-7fdf-4dd9-9e12-f228c7762ed9", "value": "412472aef182e10d0ec92e8b2a61c4b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0615997b-0486-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686068416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068416, "uuid": "4e8d5692-9b98-4b11-974a-4a07a81c408b", "comment": "Malware payload (RedLineStealer)", "value": "821823659183e8ca89f7d90cb55cae55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068416, "uuid": "29746f74-9feb-448b-8440-cf95e2fe9b78", "comment": "Malware payload (RedLineStealer)", "value": "ea332205474a1bf7ee9fa0c980e7030b0f099ad295259045b81925c0f5ac44cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068416, "uuid": "d7eed68a-abc5-4eb7-b72c-d304026951d0", "comment": "Malware payload (RedLineStealer)", "value": "d0d09c36773fdb1579bd129d72a5b69b7fc343a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686068416, "uuid": "b99d64fc-754e-48bd-816f-5a5b34c0c3af", "comment": "Malware payload (RedLineStealer)", "value": "70d3c3a783c5c3ab089ef052e2e08d1f6ef63dc41658c90e215b9b070d6ea27df3b7b04c4736c4457f7839209329c28a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686068416, "uuid": "27b9efa1-babb-4d34-b214-1f20060f681d", "value": "T1840407245A8B4932CA7F093DACB00DC127BC9D522593EB5B6DCCB0E53E737542A521FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686068416, "uuid": "28e3dcf0-e33b-479a-8595-970158b91ab2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686068416, "uuid": "bfdc7ebf-0984-4307-8b9b-bbc3cd35924b", "value": "3072:PBFeMy8k0f/F37FIzXjXpinFIODPmWOtO2SPfhq8e8ho:PWMyQF3SXV8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686068416, "uuid": "593a2019-0b0a-45b9-b1fc-64ca8d0e2517", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686068416, "uuid": "a806d312-32a0-4752-b53a-c42cbc400db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686068416, "uuid": "4d6bcd77-e30f-4ae6-868c-1b04096d0962", "value": "821823659183e8ca89f7d90cb55cae55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb39b8ca-040f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017718, "uuid": "d1400490-111d-48b0-be0c-7b0dc674c093", "comment": "Malware payload (RedLineStealer)", "value": "2019e6eedb1e42b206c422cc492edad9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017718, "uuid": "b9652b9b-90e6-402f-9dbd-a2c5d7cd6a47", "comment": "Malware payload (RedLineStealer)", "value": "eab95427a75e5546c0ff525251fb437d684e7ef495ffc7eb9e1ee73619624162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017718, "uuid": "4ddeda04-efa2-4a20-9b56-9a6f71261f94", "comment": "Malware payload (RedLineStealer)", "value": "c7e043f09ea6c3b43e2011b4fc688b886e0e27a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017718, "uuid": "9c0f8ec6-8464-4a11-95ec-fa1750903501", "comment": "Malware payload (RedLineStealer)", "value": "ebdae7ae3ef00f80c708f511e5dd50c86f1683ebcc5a740f78e73eb9e489cd37713cbaeb4fb3b58f342ea893b6b1336f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017718, "uuid": "db3a491a-2841-456d-a609-37b06375dafb", "value": "T13BD41256A7ECC077EEB6177018F603D31F36BC5588B8466B2284A68A0D736C4A47673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017718, "uuid": "aa62a580-7dca-4c6a-8e19-da0e35ed7074", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017718, "uuid": "e7d3bcb3-21db-4196-a10c-043ccfc786c9", "value": "12288:pMryy90fXbcCm0lApxGE5ObfPU2wYPjK:vycxm0lGxGEkKEjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017718, "uuid": "0bc9af99-9aef-4729-ba1d-968099711f33", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017718, "uuid": "1d70408d-5d86-4c61-a4bf-ecd9700c7851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017718, "uuid": "db285a1b-fbcb-4df2-b959-8f746fba7c0e", "value": "2019e6eedb1e42b206c422cc492edad9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d44aa2-0471-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686059747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059747, "uuid": "7f773bbb-bdb8-4391-b0c5-5897aec95bf3", "comment": "Malware payload (RedLineStealer)", "value": "d70e8b5ba45e2cc2a6f2ef5d74937b50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059747, "uuid": "7368e6e5-e788-4552-b4ff-f7dbc67c88fb", "comment": "Malware payload (RedLineStealer)", "value": "eaf2a40ad2893b38c7d38c2ce1fe78e4ce61e58028e31c1aada302988671587e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059747, "uuid": "6deeb950-233b-4589-88cf-6681e2e9e6ac", "comment": "Malware payload (RedLineStealer)", "value": "6684330e014f3ab04e8a03459a86562b0b69c9a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059747, "uuid": "2ff39da8-5d54-4962-a4ec-42e744182952", "comment": "Malware payload (RedLineStealer)", "value": "4e0d48d3792d7d528438f98c10f6ffeca4fb12bee8bfca920fa17a6361e9e310eb87828775e0ae8339d2af6ac5ed7700", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059747, "uuid": "399e62e5-17c6-4ca0-b48f-a34d5a14c251", "value": "T138D41253E6D8C072CCB627B158FA06C31F367CB19D3987662386699A0DB3690B570B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059747, "uuid": "62fa1507-95af-415b-836e-3a6b48903a33", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059747, "uuid": "70772b40-c28e-4ccd-a452-eed263669452", "value": "12288:6Mr4y90wCHimMHTuranF1ggbJpRXM6ZtoqZu/99jwmtu8b4v19:myu0ur8ZvR8Ew/9dwm4V/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059747, "uuid": "561b573e-c976-4bc1-ba34-48afa4c551b1", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059747, "uuid": "231ec50d-39e2-46bd-8ec5-5aacdb164f6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059747, "uuid": "46de2302-e38c-40f8-bfc5-50c43df2da08", "value": "d70e8b5ba45e2cc2a6f2ef5d74937b50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392495a4-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089977, "uuid": "fcdc32d6-87ba-419c-b502-c9ba345f9546", "comment": "Malware payload (Mirai)", "value": "ea0b904819d174ad8f2f0f4447deebf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089977, "uuid": "49fcf22d-ee37-4bfa-be4b-f12e53bb1644", "comment": "Malware payload (Mirai)", "value": "eb446ef511f0d5a923eeca71fcea806136b8a1df300b7300d5fffa101b68223f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089977, "uuid": "3f2ce8f0-6295-4d91-87f2-d43c82b80f12", "comment": "Malware payload (Mirai)", "value": "e6983bdd28d05bedec4f035ec6815a9b041f35d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089977, "uuid": "f5e760ec-38c7-4eec-a4e8-0bd45d531455", "comment": "Malware payload (Mirai)", "value": "86e497dd26c0931d259d5232037c5434e90a5e974b34668ab584ef7113830323efe785b458e7436d30496759718b51d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089977, "uuid": "a2b0ee6c-6bb3-410b-ba01-39433f0407e4", "value": "T1D9336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089977, "uuid": "5f4cabd6-6f85-4a41-aaa7-1903566d3e6e", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089977, "uuid": "5f73eeae-91cd-48ba-8f05-98595e5abc1b", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089977, "uuid": "69f5a3da-621a-4c0c-97a1-4d0bbca051d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089977, "uuid": "51845698-de54-4dce-90fe-fad2dfd0c7d1", "value": "ea0b904819d174ad8f2f0f4447deebf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db09fb70-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036132, "uuid": "2312fa9c-bbd5-4488-ac73-fec455aef875", "comment": "Malware payload (Mirai)", "value": "5ba05fa45140bd8eaab5da98c2ce037c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036132, "uuid": "80b5ef31-2373-4ffe-9642-636a7d08e288", "comment": "Malware payload (Mirai)", "value": "eb4d6e0794d33f7426ac607c9f0e45863b149832e965e260a180988d78c661f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036132, "uuid": "a6b22897-1689-4a68-83eb-ee8b49c9369b", "comment": "Malware payload (Mirai)", "value": "b1fc4ae24a8fe64668008e6bfead549678e16509", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036132, "uuid": "e2047f48-c216-4280-bac5-886447762d24", "comment": "Malware payload (Mirai)", "value": "560e3217b8b29242836e895cfb469eb90de00c9ab14311c1066eeedb43a8b6aa9569cde10a040624dbcf809a545817b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036132, "uuid": "5524ec53-4a00-4e93-98c7-bd06bb16eef4", "value": "T1B2A3D807FB11CEB7C85FCE3306AA8601208EA59716A5676B72B4DA6CF70794F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036132, "uuid": "cd78d20c-72c1-43f9-9453-c6634e5670e6", "value": "1536:M6eTpHeajhYaZAQlcwLHTcRNG8oLpGagRvmWItFBuCQCjn/:MX1fHTaJoLAag9mWItFBuhCjn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036132, "uuid": "4acbc8eb-fb08-4b81-9f02-a58b238336be", "value": 104292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036132, "uuid": "5b25b905-3011-4a81-a49a-fc0c82aa0d7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036132, "uuid": "a4874efc-f012-4a75-9691-b93ae8bfb714", "value": "5ba05fa45140bd8eaab5da98c2ce037c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4697e48-0439-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686035718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035718, "uuid": "636fbcdb-d7c4-4b16-985b-80fbbe115cdf", "comment": "Malware payload (Mirai)", "value": "df663070eb0491348f73aaff0f6bde68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035718, "uuid": "416e1253-cfee-475a-a2e3-a2b0aab25c5c", "comment": "Malware payload (Mirai)", "value": "eb5f9a22f2d0cc4f76998bbe646e0f11ce21f2ebacbb7dd708f5f52339bf5818", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035718, "uuid": "4af3eff9-95ab-48bc-89b3-5dd5e22f6358", "comment": "Malware payload (Mirai)", "value": "dae306f8c9718f93b03876f6f4cfd22d47ed6e38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035718, "uuid": "af519bb7-f355-48a1-b91f-2b7ca27edd0e", "comment": "Malware payload (Mirai)", "value": "12407218b205407ab02ab03e86b84f1c2a9c29fda0c0ae18ee1fe398b1c3af6ccf13382bd9e4f6d50d6b1074e5a0f604", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035718, "uuid": "7b01d744-9a2c-4f4f-9a7f-83bbee9acf73", "value": "T108F2E0228327D532CEB5DBBB997182E4695F43F0F6BF70646790C68D4882B02D5FE146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035718, "uuid": "e76967a0-6e60-47a3-8b7a-b8dd8b39cd93", "value": "768:EYVgAxkU1RHz5poClGL1aMnXha7WBNoWhSxHjqizW9q3UELC3:EYyAxdRH9zILLBBrodjX7Lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686035718, "uuid": "7dd2b383-44a4-44ba-b8ce-a9a68726baba", "value": 34476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686035718, "uuid": "19d57166-a36e-4da9-b8ef-ecef082de6f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035718, "uuid": "c30b93af-65a2-4811-89d1-af5de4794ec5", "value": "df663070eb0491348f73aaff0f6bde68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9672e4a-0499-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1686076958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076958, "uuid": "4a9d2130-cf77-4341-97ba-d509ede02056", "comment": "Malware payload (Gozi)", "value": "0acd60544d3348fa95341f10b1f26123", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "mikehp-com", "colour": "#4D615C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076958, "uuid": "2d999889-89b0-4b6f-897b-5e0c61b265e2", "comment": "Malware payload (Gozi)", "value": "ebd73a3f010aa3cf01059a4c08f9f70d0d7d4d671e76d024e5dfd60b27e92a66", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "mikehp-com", "colour": "#4D615C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076958, "uuid": "fc2e4b5c-71d9-43b8-94d3-ee183915e64c", "comment": "Malware payload (Gozi)", "value": "52443a01d8a4f68b0971e7439e2ce0cc7f0051ff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "mikehp-com", "colour": "#4D615C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076958, "uuid": "e1ae3dee-bee3-4a2a-b091-e122c7c01ba6", "comment": "Malware payload (Gozi)", "value": "95a508628b80225d61af296c1f701cf80a030f479ca8abb8d0c546c818d07aebc47d5e086f2093a2c2498e837c4faf0d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "mikehp-com", "colour": "#4D615C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076958, "uuid": "df12fa6f-8ac6-4bd3-8920-72b1a5210df0", "value": "T165E46A57DDC52F5BC63EC2720AEF89A218B5AA887F424607772CA561306335A7BC374C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076958, "uuid": "6d797d7e-7a80-4f67-9678-6157978cbc56", "value": "4e300a8f3074b0a71c5ff4a85e11a4d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076958, "uuid": "0ceef3c9-7906-4353-aa39-f4dcdefc7e09", "value": "12288:AioSAWNEDdnKh0TmR/Y+O1J5xr35OTal8Gc9RO8p8irjWHhIxF:AiHAWa1bmR/k1J5xr5OTal8GkRL8irjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686076958, "uuid": "7e9d8cd5-f2b4-458f-ac8a-b1ced890e07d", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686076958, "uuid": "aec6cdef-b69a-4973-af44-8874bf4fd7b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076958, "uuid": "4dfa6f14-882a-477f-9737-c621cc39eebe", "value": "gozi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ee1434-043b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686036560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036560, "uuid": "80399163-b775-4604-8aa3-e2b1af45c719", "comment": "Malware payload (GCleaner)", "value": "3fbc6d8c5c9a7546b7c11eece60c8c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036560, "uuid": "55d4ec10-c939-432f-9a25-b7b5ee5b6f7a", "comment": "Malware payload (GCleaner)", "value": "ee76f32a1d5930bf6371eabbf800df0111bd9d8e1768b7793843dfaeb2d6adcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036560, "uuid": "4d089a0f-77e5-4361-96f7-3ebe5506ecca", "comment": "Malware payload (GCleaner)", "value": "c4980e15aa2f3e6e544fc63def6fd532dac70b07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036560, "uuid": "e6da10ef-0337-4be4-990c-2a61032f362b", "comment": "Malware payload (GCleaner)", "value": "0895f584fadbe4f9550a47842f750fd52e2af63e9c0f282f2b473f3b8b5241132c2117363a3ccbb96ca21e32f3f52ad1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036560, "uuid": "9e1df847-9f7b-4dac-85db-d781e9194153", "value": "T1908533C2A5C2D3F1F01AA2B41F61B4971C7F3EB52E74647DB16DC5DC8A46A85C0E8BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036560, "uuid": "1e99592b-bca8-4cd6-a616-410dae8c46d0", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036560, "uuid": "acfcba69-1ddf-48dd-a33b-709ce596a3fc", "value": "49152:56dnhdYYmxUtLYGI5iI/WGPG0HgpxYspJUk7h:MdnQYmGYGI5WGOVPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036560, "uuid": "5009034a-12a2-4a47-b1ed-7cd284c2928d", "value": 1861850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036560, "uuid": "304ad8a8-fce1-4a60-8196-2cd7d75a9f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036560, "uuid": "3aa8f3d7-0abb-4ef3-b434-04db96c2fb83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c73e6e1-04b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686089902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089902, "uuid": "a6db30f3-03b3-47c3-a8aa-4da37cb7295c", "comment": "Malware payload (Mirai)", "value": "fcffb2965bbcfece28b02c6bb57dcb8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089902, "uuid": "74d2d181-f1f7-47cc-b207-f3a889531f37", "comment": "Malware payload (Mirai)", "value": "eee0f729f2dda8662c830c3b66c6d53a2ec19a5492223772d3fdf2413ec1b98f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089902, "uuid": "cd8b4f5f-f063-49a3-8ad5-4e7e2e31de22", "comment": "Malware payload (Mirai)", "value": "ff465534af1220887948e95bece72b6b37f6ee60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686089902, "uuid": "a18f3511-46ff-456b-8fbd-fcd2305d62e9", "comment": "Malware payload (Mirai)", "value": "9c39a940d0c93229cc9e77e33502b3c71294c81e2e72373682536cd0353c7a02b575aeddd4c0691a92906bf1d5de11c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089902, "uuid": "af522b0c-4e6c-423f-85c7-5a77aa9e40dc", "value": "T18EA2D11172632D55E3EC1C3DC96E8367F9670BFC90F632766D405A20C94D24A3E39B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089902, "uuid": "fe5c4936-a0fe-45c2-b0bf-328b38f837b7", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjSnOhymdGUop5hJ:UvQn4j+ZO5fKAlx7s3Uozb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686089902, "uuid": "e28e6bcf-439a-49a1-9981-5c8560602f2c", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686089902, "uuid": "eec3ed94-7844-4c09-8136-ab5590ebe935", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686089902, "uuid": "d6b51dd9-6aa2-408d-8286-23204dd4f79d", "value": "fcffb2965bbcfece28b02c6bb57dcb8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d87627-044f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686045039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045039, "uuid": "b182665a-e3bc-4396-a8eb-407c12cbe2ea", "comment": "Malware payload (RedLineStealer)", "value": "ee9871d7de78ab88febed13644ff9d45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045039, "uuid": "a4817caf-1222-4142-9eda-73c73acf543c", "comment": "Malware payload (RedLineStealer)", "value": "ef32fdb91bb66e640ae6a50917f1f8154b39e998ead71423324cdd3e52cb99e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045039, "uuid": "141343a2-ee66-4327-a36e-4caf252f42cf", "comment": "Malware payload (RedLineStealer)", "value": "d237436f82b8212d086ea831f1a93c5213b2a621", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686045039, "uuid": "c7846bb0-bf60-4a33-83a0-f3ec100b1b40", "comment": "Malware payload (RedLineStealer)", "value": "0e4c8713b34f9981adda32fce5caf505a6c2ec867f228510e9079e0da68a4cc8c2e8f64969c874db92c530dcf7c43baf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045039, "uuid": "8e4b45c2-b394-4147-a607-10400dd66bdb", "value": "T19EF41353A7E84076EDB4037058F712C31A36BCB29E348B6B2669DC891C72784E9B5377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045039, "uuid": "09d876ce-c4cd-4f04-8c97-1853b2e578df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045039, "uuid": "226ac045-d768-4af9-9e59-719039b86273", "value": "12288:hMryy90wiJqEs2QCJETgQPTpJUreokh2HsoOzh63LbEr9tM3uY2x8/OHrxv7SxZo:7yZihs2EEYpquIOzh67bEJt6uRK/aU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686045039, "uuid": "de7d3751-5997-4b34-a859-e1c86617c6a9", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686045039, "uuid": "b6afaeb4-e5cd-44ed-980b-a517c681cb5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686045039, "uuid": "2324b334-0944-4bdf-8883-a0cc0d2094d9", "value": "ee9871d7de78ab88febed13644ff9d45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea65fe82-048e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686072235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686072235, "uuid": "9c57ad80-44ee-49ac-a539-9cfaeb72f1ef", "comment": "Malware payload", "value": "2c3aea1cbca6bfe16762df854cf91630", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686072235, "uuid": "8835e985-11f8-4560-abe0-bd1b3368b15d", "comment": "Malware payload", "value": "efb1024654e86c0c30d2ac5f97d27f5f27b4dd3f7f6ada65d58691f0d703461c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686072235, "uuid": "91c3cef9-dd73-4d68-b320-623bc0fab285", "comment": "Malware payload", "value": "45b2166944df7a73d78b95d2688b57ba633bfebf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686072235, "uuid": "45c32b62-0cf8-4afd-a91b-74226a89e4eb", "comment": "Malware payload", "value": "abc370e4b7e96bfdff4238bd2a48a0e7a44d22d1bbbc325605df981ea84d2dcc5c11872782cb4972d353e7e4fef5e254", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686072235, "uuid": "04538937-54f2-42d5-9733-d21da7fd1df9", "value": "T16E367C03FC9090E9C1EAE234C96692937B717C895B3163D32B90BBB92E76BD45D79304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686072235, "uuid": "0ea87595-b3d1-4e77-a9af-bf8dbae6bddb", "value": "49152:HlrS4cGnrb/TKvO90dL3BmAFd4A64nsfJ25iswwmLaDKNtJDnUuD95EWg0g9Euc0:HlBwYJxXEWPM/bDDKa5UjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686072235, "uuid": "8fa83412-6d93-4846-8137-0f05d63eb805", "value": 5194359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686072235, "uuid": "4649acb1-4fe6-4060-8b20-9f16ff3e2347", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686072235, "uuid": "6493daa7-dbf2-4512-af57-f83d297ac65a", "value": "itssoeasy_compiledv1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4ea82b-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017743, "uuid": "47ff042f-2572-4b7e-aa14-5ed9b90f3d86", "comment": "Malware payload (RedLineStealer)", "value": "96a04f7eb7908d7853adbbd9ce387293", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017743, "uuid": "3b8ef349-50e6-496e-b989-4c54de853735", "comment": "Malware payload (RedLineStealer)", "value": "f01a0840d654fcbc17eb7aa7fa385cc8492141f312126971b4130a328157179b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017743, "uuid": "fdf3fb4d-e9b5-4c56-b84d-bc9aaed7fb69", "comment": "Malware payload (RedLineStealer)", "value": "1ff505e738deaf12a92a8567ed4fcc9b4b268b6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017743, "uuid": "fb886855-f167-4fff-993a-597f85f4f9b3", "comment": "Malware payload (RedLineStealer)", "value": "13c47ebb45a6a1305e1d5991a34d2e81b1e1fff46eca9c57bb4a0cfefa321ab80f253e380635493463ce3ead8d25fff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017743, "uuid": "600ebe52-0cdd-4aa4-9081-5e2602952c87", "value": "T1FFF42255EFE84075D9FA1BB048FA02C31A397CF15DB1936B1386AA4F19F28C5A43532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017743, "uuid": "92e8bfbe-9b19-4645-8aca-22b5365f7224", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017743, "uuid": "17005274-0098-4c87-8afc-fd156ccbc097", "value": "12288:qMray90ZwcHXKOQJrN+praN6b4SkXezlnTLYy+WqsozVwGs:0yAHXKOW5+praUd+SxQBsMGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017743, "uuid": "b8e6a6e3-bbfa-4378-95bb-2be7eb947306", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017743, "uuid": "3d515dd1-eef6-4dc4-807f-6a1e0fa5275c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017743, "uuid": "a6825960-94a2-41b6-b7b6-be42214369a7", "value": "96a04f7eb7908d7853adbbd9ce387293.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48faa5c-0499-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686076896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076896, "uuid": "e141e70c-1005-44ec-8c14-bb2705bd81f7", "comment": "Malware payload", "value": "76e6f6d4174a752388f0bfe407e57add", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "mikehp-com", "colour": "#4D615C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076896, "uuid": "c541640b-4340-4ab7-aec2-5b59acaf19a6", "comment": "Malware payload", "value": "f0f62fb2258e35b1588c8b5c916e79b0102c5ee373a8f65ceb4864d201fceb21", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "mikehp-com", "colour": "#4D615C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076896, "uuid": "16a5310a-2c45-4bf5-9611-2371da5d362b", "comment": "Malware payload", "value": "0aa8bce8b55cf59581dfcfb85314483f0cea9154", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "mikehp-com", "colour": "#4D615C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686076896, "uuid": "aa64767b-040e-4740-8f2b-a3ebcd935e60", "comment": "Malware payload", "value": "585ecc456a35a289603800f0f2a95d7fc6f56eec0592da00531ac74afd1f27f78013c88596057d7fe5311d94d2be49c2", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "mikehp-com", "colour": "#4D615C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076896, "uuid": "16ba6b1b-5457-4f8e-88d9-9ce9090fad4f", "value": "T158130195AF6B9960CED719C11ABFB43F07A462C4CE83AB5AE48818423EF4593F75C443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076896, "uuid": "b75a576d-c5d3-4b02-973a-f52664b8a6cf", "value": "768:BTC3WR77Bc9/TagzBBHH8rNvlf3SUe32bUGi56zN2/y1ZKdP:7PBAr8rNdfSr2I0zN6y6dP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686076896, "uuid": "99da18d6-741f-4e2b-8754-ee4afe0ad3cf", "value": 44080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686076896, "uuid": "7e0ae5ae-d8b1-447c-a0f4-727de566e9d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686076896, "uuid": "40c6c50b-f234-490c-83ce-ce53017dfc67", "value": "printouts of outstanding as of 20230606.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6c1ba6-0439-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686035710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035710, "uuid": "83de65fa-e8d5-4d90-ba33-8c45a658e638", "comment": "Malware payload (Mirai)", "value": "7873083504a875b415cef79ff0e4b141", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035710, "uuid": "7e370e1a-3bfc-4926-b1c2-888b2d398253", "comment": "Malware payload (Mirai)", "value": "f1894a95b062cb316de99c394dd41eaa4a23edb167efd56d0e8dd9037aebf9d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035710, "uuid": "619a875a-988c-428d-b2fa-7f840b8a3261", "comment": "Malware payload (Mirai)", "value": "b0bc7113e1ffaba9b1c0be0299abfe23410ad6be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686035710, "uuid": "562e610d-f7d4-4930-96d2-6d68f54bbd60", "comment": "Malware payload (Mirai)", "value": "224c5b7a9e713b4847a5bc7c702f3fae97fda84d598c3ba055987adda1abde902958d0770633a4f63e2625b6966aad11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035710, "uuid": "a51d71f6-9663-4b99-ab7f-034707b14dd3", "value": "T10C43F79178D15A2AC5E423BAF67E508E3321B3E8D1DF3257CC201B147AD952F0DA7B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035710, "uuid": "460e41f0-98f6-423d-a3d5-3685c0409552", "value": "1536:018ZuVJTQfcnfgyr25Io8wwtx5y5eWhKlz12l1dW:q8ZkqRx885thSRWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686035710, "uuid": "c4d2fafd-cb65-4731-9ebc-9f51173cc246", "value": 55584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686035710, "uuid": "7181fc9b-5d50-49c1-83a4-3aa6bd771165", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686035710, "uuid": "aedeb361-4c13-426b-b087-37b8f268d8ca", "value": "7873083504a875b415cef79ff0e4b141", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f661b65-044e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686044434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044434, "uuid": "f74f7337-1e0c-4c5c-a6b0-831b3835ac0d", "comment": "Malware payload (RedLineStealer)", "value": "378d2f37ba91add7c39df863751c9111", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044434, "uuid": "dac2ea03-5dae-43d3-ae70-03c2f0aeef63", "comment": "Malware payload (RedLineStealer)", "value": "f1f6d08cd095b4bddd85a89974e4e1439b478e2c81086d397e27d2ec08f851c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044434, "uuid": "fafae604-c65d-4433-a55b-661ba5471279", "comment": "Malware payload (RedLineStealer)", "value": "26d63541e156aa7fbfb44dc53f232c17645ad12c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044434, "uuid": "2389047c-82e9-4503-8380-ae4782317e12", "comment": "Malware payload (RedLineStealer)", "value": "86156c8cad5d67b7ea7d4458a49342d88217a70a53a76cadad896f38a848a463b93dafaf2cd0547e5d4fc38b1128e3a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044434, "uuid": "35e75531-5cf9-4da0-a6d3-fe2c18fa1de4", "value": "T1DBD40213B7E84472E9F517B159FF12831A3ABC618978C3772781A8AE0C72594E472737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044434, "uuid": "1057f2fc-7243-4bbd-9024-8bf8e6ba42f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044434, "uuid": "e341fbf0-4d2a-42f0-9ca6-ba0bece93d56", "value": "12288:GMrLy90lEdkxicE3Ne0/TKzynWGC++P8U9QaQOMzRNnybu:xyMEdaa3uzGnBopAiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686044434, "uuid": "83df48b7-f81a-4f0d-8bcb-3ce5f8ebd276", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686044434, "uuid": "b7b70117-9dca-4352-8ca6-49201536309d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044434, "uuid": "821fa75c-4f5d-47a0-8c40-38e52468dfdf", "value": "378d2f37ba91add7c39df863751c9111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ca167f-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036074, "uuid": "1c6989e1-e5c2-4d23-93ec-c494294deb24", "comment": "Malware payload (Mirai)", "value": "9289e87047d7c3237bc94a03e74f83e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036074, "uuid": "d185d2a4-cc95-4e77-ae23-f39a4d0d2fc8", "comment": "Malware payload (Mirai)", "value": "f2e06c625985228d9e441b85229773a23c46a3ee03dc081a5a95de1b301d65d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036074, "uuid": "908a819c-008f-40da-af17-09d897013687", "comment": "Malware payload (Mirai)", "value": "6df53f2a120edd57d74cd898e847978a4cf11b14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036074, "uuid": "d4f01b4f-8989-4dd0-b50b-6a9f522c639b", "comment": "Malware payload (Mirai)", "value": "9e0092da47950b24bb73523435fe7b271e707012e38579693ecf3c63897977904b2bb53e2cf46092dce47c9942a2f48d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036074, "uuid": "e85ee8fb-4f55-4b2e-922d-39eeac8207c3", "value": "T10943AFB6C42DADA8D1084234B8258E741F53F64591B76EFB8AC582924047FBCF71C7E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036074, "uuid": "8a54f34b-e2e7-4fd6-93ea-5a7257905149", "value": "1536:Fydz2nZCfwtNcOzCEg134eDjNCysl1d0:Fy0nZCf+U4eDjNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036074, "uuid": "715e8546-c8fd-4e5e-b343-5c687f8d1710", "value": 56344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036074, "uuid": "f25bd3f5-48c1-4464-9299-f569dca3c0a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036074, "uuid": "9a24ca11-bd8d-41b0-8ea0-65ada92ad89d", "value": "9289e87047d7c3237bc94a03e74f83e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628def90-0441-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686038936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038936, "uuid": "8bb0e740-7ce4-4237-9c12-b36788380239", "comment": "Malware payload", "value": "823b238b9634e9f5cec3e340e55b0831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038936, "uuid": "f19ff0e1-3010-46df-b568-6fc4222c0ded", "comment": "Malware payload", "value": "f32db321d5183fc90c55c6e73314aafa46e94b8b48337068b6840d59aa44927b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038936, "uuid": "64215abb-5245-4d0c-9534-463b67bcd313", "comment": "Malware payload", "value": "90714d64915eb545267282face2a810d81a1c39d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686038936, "uuid": "ae25ce17-be6c-4945-b268-70c73d614e84", "comment": "Malware payload", "value": "401031844b588da259aad8efbbf586199fdcc114cb441e73f8e58ce26079582de5c9af1ee9767dbd72750a69423d87c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038936, "uuid": "dffbe4fe-80c2-4fc2-b47e-9b524a4a259f", "value": "T170045AA55B504A63E2AC4B3BA8EF05004FB1ED01686AE34A59EC71F90E33F75750D78B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038936, "uuid": "1e34d5b7-d3e7-45f3-a913-bd54a376eac6", "value": "3072:TUexiOz3YCn5wUA0TSqCReP91qZYQuemPhABpy9FAeRqNWlc:7IYS8QuxPhA3eRqNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686038936, "uuid": "8f67febe-6e9d-4efb-a089-4f9e216a7926", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686038936, "uuid": "e2248047-d237-44f8-b10e-17298019c9b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686038936, "uuid": "2fae3194-458c-470d-9308-0119661abad8", "value": "STMTCMB100_20230501.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae88018e-046d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686057962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057962, "uuid": "9d346174-d712-4b0b-a73b-4b31586a17d8", "comment": "Malware payload (AgentTesla)", "value": "4678959f46078a01caeffe93ac0d34cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057962, "uuid": "7f332fea-dbd8-4867-99b7-bffc0ad64b9b", "comment": "Malware payload (AgentTesla)", "value": "f367742f47c4393cbf051efb8fee7cd26b9b183ad2ff68d0193fb30ef0e7621c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057962, "uuid": "7e3b9e11-410c-4c4a-b48f-14f48a8f97ab", "comment": "Malware payload (AgentTesla)", "value": "c523ec3eb352c38ec4306143b30fe2a4d11fad98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057962, "uuid": "1b1c43d3-6922-4de8-b20d-bbcda5d90f89", "comment": "Malware payload (AgentTesla)", "value": "8b668adb50c3db50811111f5021a153df104b308936bb788f241beb97796951dbc3f10ab3deec9349ad3bbd131bfc360", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057962, "uuid": "349f0449-ef53-4ec4-b001-02ae97406981", "value": "T1E5B423D62998629806061376506DD32FF09A1FEFF4AA81C65EE77333C308D4D7199AF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057962, "uuid": "72542ed6-ea34-4d56-83c0-49cfc2b9429f", "value": "12288:cGGw8Nu1baban8H4BTAv4QPGJJVpKBUoOQESO7i+ZNb:r/8M1mbeinv+vKezfSEZNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686057962, "uuid": "eae51074-9070-4ca8-bdc7-625d0071cff5", "value": 514939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686057962, "uuid": "3fb12192-10a4-4702-8506-92f0ed4a4bcb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057962, "uuid": "53c175f0-cba3-40df-836b-6cddcc006f30", "value": "Remittance Copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ef55e0-0410-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686017761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017761, "uuid": "8870d4aa-8580-4234-ad46-9bc60d2c0b73", "comment": "Malware payload (RedLineStealer)", "value": "b9bf6710596ae51ba4ebdd8814f9572d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017761, "uuid": "8d27d014-029c-4c10-b6aa-39ebede66eb4", "comment": "Malware payload (RedLineStealer)", "value": "f3a3468f4800ba9854b7a2fdcbc2c3f71bf85461e210c8dfe64899c55d812cf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017761, "uuid": "2a33435a-36dd-4b26-a25a-b9e7d4c6b019", "comment": "Malware payload (RedLineStealer)", "value": "f1b5ad6116d2557f7b0d79e85da46a0e87b998aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686017761, "uuid": "e96461c9-65e6-4018-acd4-700c500558ba", "comment": "Malware payload (RedLineStealer)", "value": "95f780c00741177f7a3060bcfee9ee09d3e1957785bbfb67b3b35111c57505426cec29975dc171a210a38e54ed4c03bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017761, "uuid": "9aa16021-245f-4d15-8411-146c3daf9de8", "value": "T14ED4124AEADC4173ECF52BB068F707830B36BD615D34632B1386699B0CB2695653173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017761, "uuid": "68ee9b9b-680b-4207-ac90-89374af236fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017761, "uuid": "ed1cd050-80ed-4f5e-a90b-472c26ec6b9f", "value": "12288:zMrJy9062NUPD5/oKzmmjx2crQHiyRsfd1VxmBBfp2c6At:6yCNUl5KkkCxfD33cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686017761, "uuid": "66b6ea9e-6aac-4d3b-8f78-57f89dcfdec0", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686017761, "uuid": "29a7f34b-4ec5-4291-a079-b12024e62408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686017761, "uuid": "2734ff8b-68bb-48cb-a73a-1b950bbbea31", "value": "b9bf6710596ae51ba4ebdd8814f9572d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03196dd-0470-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686059307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059307, "uuid": "9221f667-d1c0-4660-8cdd-e2b34aaeb1b6", "comment": "Malware payload", "value": "e2c4c4dd8c6a357eca164955a8fe040c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059307, "uuid": "5a8200b4-3b3f-4818-aeb1-1a551618ad79", "comment": "Malware payload", "value": "f3efe3b57a0f5cc46963dbd8832ceecd5768117685b4cee684b1235d9e74ebe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059307, "uuid": "ed7c926e-63ba-45d1-9098-392f4784ffc7", "comment": "Malware payload", "value": "f4114815bce62efbc78c79f9a83ccf74a4ea075c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686059307, "uuid": "4bbd10ba-ba1f-40db-b144-f3cd05f7100c", "comment": "Malware payload", "value": "4947eaf2d6ccee70688b1a050418d23eb0e0bedbcbb3d2fa0c44095ab380a11c9c3dc0f267f3c2249b7e7d6b7e6acd79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059307, "uuid": "3e86557a-2b6d-4a10-b1fa-3f01dccf67c5", "value": "T1A326338694B17BDBFA050133A1793EA9796BFCE7D54A040A14DEB4E13DF3983026BC91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059307, "uuid": "d3101878-05a6-4d53-8206-48d9c6115c7d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059307, "uuid": "4da510d1-6375-4a58-ad27-dbf74b160670", "value": "98304:3c9jNgez/S9bL+M0QVtYD0JCqfZlVcc9uNSwfrNaSQHbfU0qC:s95zk0mtyTqj6W4SGYSQ/qC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686059307, "uuid": "5bb0b270-860e-477e-8669-35d428d7f068", "value": 4444053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686059307, "uuid": "65b996dd-4fb3-4a3e-994a-63ce4b226078", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686059307, "uuid": "f37130b9-554f-4b58-9d62-54c988922c8b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e4f774-044a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686042698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042698, "uuid": "a5a50a93-63b7-4b6d-8692-63fd5059db00", "comment": "Malware payload (njrat)", "value": "850c00a9a4f884920bf998e784deb5ff", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042698, "uuid": "dd7e3ca6-cb51-4860-907e-a7087c1d6188", "comment": "Malware payload (njrat)", "value": "f4eb6874def6fb59224dac5a6b164d297540d40f1b52f6d33ebf654320865ab3", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042698, "uuid": "55424572-de02-4690-ab9b-82f45363584b", "comment": "Malware payload (njrat)", "value": "dbc0cbdee0323392f7e1e40bdc2af681cdb7730b", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686042698, "uuid": "eb29a198-1cc3-4d77-8c3b-cedf2c24cea9", "comment": "Malware payload (njrat)", "value": "821974f1b91fd3b6be430cf3a6b95eb509b8b575ef077b5667dcd84c10fe0b8ef46bd0491a03f1c33e231d7be1748a27", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042698, "uuid": "e4a87f0b-9cf2-466d-8a5d-7123a48fb233", "value": "T11CD4A05196EE1088F3F32B016BBD42757B27B9DA8979C94D058C896F27EB900CC61B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042698, "uuid": "dcea3616-b66d-45cc-b918-8708a365f369", "value": "3072:TpG1wfkYFEhNe4VTdRnTT8w4TWQNDJ4alTvPfkTk5G7ZqsmgYcp++og0S7wQzS1y:IwfkYF18ZqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686042698, "uuid": "cd85dc78-bcce-4a20-936d-8bd018b01728", "value": 598658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686042698, "uuid": "e6707dbd-ed0e-444a-9b40-b5476fc3e61b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686042698, "uuid": "255b52f3-d405-4b67-aa7f-224254cb24f2", "value": "pum.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2f6ec0-046e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686058196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058196, "uuid": "95688192-e508-4a44-b77b-e558631aa0c3", "comment": "Malware payload (AgentTesla)", "value": "9446dc6fcd3e8560a987f2144c542d82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058196, "uuid": "77a86144-7f92-4c94-831b-730b2431ecd7", "comment": "Malware payload (AgentTesla)", "value": "f5f52328fde0d3b15c23f866f8b88352a341f58644c6e65ccdbd03d888ffdbb6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058196, "uuid": "8fe107da-c0b0-46a8-9cf8-d9c8711bf2d0", "comment": "Malware payload (AgentTesla)", "value": "949f43d1016c287426b1f12c3fa0bc9c9975dae8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686058196, "uuid": "cbcf3d4d-36f7-40d9-8b9c-c72c55552053", "comment": "Malware payload (AgentTesla)", "value": "523db6d68cf7383cf3f6d5d4c59efdb62212823f101e4b8a8501a28c91a100bb7ec2485c600f7b2ec17f71e56e2483c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058196, "uuid": "f15e61d1-bbef-46c1-baed-b40fad171b77", "value": "T110E433AB19AA7B381E03377AF013391E4ED5F7D4A245538D71AE38308C6DD70FA66028", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058196, "uuid": "a413e0d4-da21-43de-9143-731234f7de00", "value": "12288:/tXo20NOFKfSROT9Mi7BkVCshGGmKskWkuIP2iQwaxE9/jC1bbxfyOMl/KsU94in:/tf0UFzEhRuhGGmKAkuvrxEObbxaOasT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686058196, "uuid": "743e7524-63cd-4f78-a07b-c553fe92238d", "value": 676603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686058196, "uuid": "14c15459-801f-444c-97fd-f968023a197e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686058196, "uuid": "27305fbe-1dff-4533-ae4f-3ac1fbd9944c", "value": "PRE-ALERT SKLZ2112352 SHANGHAI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985636cd-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036020, "uuid": "6b15dcb6-d550-4063-aa78-ea506880af4f", "comment": "Malware payload (Mirai)", "value": "d17a197acf0c64d41b47ccea6b4d9bac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036020, "uuid": "2fa8f974-8a4d-4880-a458-b7e94e5a5326", "comment": "Malware payload (Mirai)", "value": "f731e93f83a029bc94724ad13127d1b3a854d7ec45bbf003f625341acf4ded2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036020, "uuid": "11093cd9-bf68-47c1-98e1-1bcafa99dc06", "comment": "Malware payload (Mirai)", "value": "ebbb28281fb5094fe487f455f2ac49f67219aeba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036020, "uuid": "2eb72e10-a390-4148-8df7-80cfe4df521c", "comment": "Malware payload (Mirai)", "value": "e746bbf324433d0406be7e6e211375b206c33bc40f0eb9e85dad1121e4cd77998596c14136841c21bc9f6807da959dd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036020, "uuid": "5deda7fb-1047-48cb-91e8-ff41b3b31260", "value": "T177D2D0A953401379C97E90FD135607E43D7A4F2560D3AEAA65C1FEC1ED404F479A3AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036020, "uuid": "831c333a-3cef-4725-93e0-695dc3b437bf", "value": "768:myvYLznDEB2iC+sDqC6NtxsfzxPnNsGbMbXmJgGlzDpbuR1J2:BYnnDEBI+smATfM+VJuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036020, "uuid": "6cbe3e26-badc-4b57-91f1-590760c730e0", "value": 30840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036020, "uuid": "e6742f41-8a6c-4e0a-b34b-993cb4358ecc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036020, "uuid": "42ee966b-a10c-4196-9cb6-4416b503054f", "value": "d17a197acf0c64d41b47ccea6b4d9bac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f06a03-04a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686083397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686083397, "uuid": "fc129b7f-681c-459a-93e4-50d73eb31649", "comment": "Malware payload", "value": "7c8f14a1470b820548ca0285d50fe422", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686083397, "uuid": "948c94e4-176a-4cef-9598-c605ba9c8602", "comment": "Malware payload", "value": "f7c7b066e5f174333dfbb5197ec02bc68e55473a0ac38b8cf7989a38be0d514b", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686083397, "uuid": "14733cd6-0fc1-4b89-81f5-428f096eb3dc", "comment": "Malware payload", "value": "ca7856954a326ee730984d9efec80fd5a1e008ea", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686083397, "uuid": "0dc38ea8-daa7-40db-b505-18e5b2f7c138", "comment": "Malware payload", "value": "b715a686f4cda1f8a789cfd3721de37a3ba20ad33084a30d5905928c68244a9871fb2a30132f9948da3ea4c3b4700fde", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686083397, "uuid": "8c66a47a-bb4c-4260-b586-eb0b4ed49840", "value": "T1AC414018EA0EF19896B1525A8BD7D731FF2A001E75905548B2ECC25E0F21C0A67BCF8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686083397, "uuid": "1140220d-f047-45d9-a833-459dca8e064d", "value": "48:7TtNAiqDwm4XW4jVuKmc4TQ4zvfxVIR1k2m1ml3fOPuN7VLhn:dNAio3b41r4LMDnm1ml3Outn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686083397, "uuid": "e3d77103-d61f-4e6e-83ea-d7de0087412f", "value": 2284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686083397, "uuid": "d09db260-8c31-40ab-b828-ae1c9c98c52c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686083397, "uuid": "006d9321-3f8c-4084-af93-988591ce27f6", "value": "HiMjYeU2.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f47856a-045b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686049963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049963, "uuid": "d10bfcae-ae7d-4a47-af76-c669e10690f8", "comment": "Malware payload (Mirai)", "value": "4d88088cbf52ab4fcf7bcdb434a7cc8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049963, "uuid": "2122316e-f1d4-4d4d-a548-01bccf32cedb", "comment": "Malware payload (Mirai)", "value": "f8ddff7fc2073fa415c0c80b5ae0fa4c53c402245b7d11e33aa80a1729581da5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049963, "uuid": "c7d97a66-195e-4290-9e01-65b9cd67f860", "comment": "Malware payload (Mirai)", "value": "6d118342a5917c8ae308791778a4010a3856b2ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686049963, "uuid": "9059b4e1-733d-4218-83ab-55d577b7fc45", "comment": "Malware payload (Mirai)", "value": "cc79408daa0f375abbf0293bf8218c14a7739b06d37bfd35c21e62c17b1f345e1618f8344e088cb995d0ea71799d40db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049963, "uuid": "e9504ab9-9e4c-4673-840d-27fa131fbe7c", "value": "T19DB2D119C0AE2E74FEDB7D355941E2817B619BDF7A61CDC026C157110622D781F8CAEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049963, "uuid": "be98f311-1a84-4370-9447-a0b5db276762", "value": "384:EA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoHM4uVcqgw05VxJb:KApCdvwJr69VJoA8FZtxCo814uVcqgwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686049963, "uuid": "5e44017b-f93a-4e57-b16b-4bec2800c333", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686049963, "uuid": "d1623cad-a673-41fb-8bf0-dce57896e69e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686049963, "uuid": "23f0aa6a-f7af-49c0-802a-73dd31856751", "value": "4d88088cbf52ab4fcf7bcdb434a7cc8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e429ecc1-044e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686044737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044737, "uuid": "4d0fb9c4-62b2-4376-a749-8bbfb4026e35", "comment": "Malware payload (RedLineStealer)", "value": "57e9a2f139811a7d7c681a5f6498bdc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044737, "uuid": "7beadee8-1c11-43ee-8809-a430cfbab6a9", "comment": "Malware payload (RedLineStealer)", "value": "f979c3ad640974fa3e5b64bcb9cb9c02d61476b8b1855930dfdea45f879059c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044737, "uuid": "8850aae8-d1a9-4c50-bc73-dd5f39522de9", "comment": "Malware payload (RedLineStealer)", "value": "db8f3271f5d9d7b762c1ccd9621c46e40c7c8be3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686044737, "uuid": "147c813b-e464-438d-968e-50a14e96b364", "comment": "Malware payload (RedLineStealer)", "value": "6bb76c86c50cc467ab37fbb296ed6550ab09b00a74efaf8c9e9e24895f4843a9f3cafcd85c4a925d2127184fd3111e96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044737, "uuid": "60485d9e-484b-4a3c-9a1c-644050c6e0c9", "value": "T111F41212B3D84473CCB927B0A9F643C305367CB19C7D926B2659B84B48722C4B979B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044737, "uuid": "f40a24b0-51c7-48c3-8fc5-263551b8abd6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044737, "uuid": "fb5bc546-c5a0-451d-b5b7-f52d99616918", "value": "12288:nMrgy905eUFEETWFOh6njyM7VTNYd4I8tHP2znIRyX3c9zg0G1IVN6KI:vy+i3WMxTNYSjlUTX3ce0LTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686044737, "uuid": "492456ad-ed46-4ee6-8bf9-c3ebe164b3b9", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686044737, "uuid": "0270cf76-f835-4ae8-93bc-702cd46e32dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686044737, "uuid": "eb654467-f234-4564-a342-6840f26d2d24", "value": "57e9a2f139811a7d7c681a5f6498bdc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a3a0f3-0466-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686054866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054866, "uuid": "9f950fc2-fdb4-4980-9447-1c2994783724", "comment": "Malware payload (AveMariaRAT)", "value": "05efc8a7264b54d7536a560d7907330b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054866, "uuid": "837f21b9-7c52-4b4f-9898-c100392cadee", "comment": "Malware payload (AveMariaRAT)", "value": "f9bd56af2fbb15320aeeb58e04c08b7bb42db5542507efe24d5f3f83cba9f65d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054866, "uuid": "477da83b-de36-4bb8-a809-85f61afd2189", "comment": "Malware payload (AveMariaRAT)", "value": "cc41d8ad1d02efea6d61d9379b5eb9d004d6e4c4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054866, "uuid": "e3cda562-16f3-4593-a808-ae3c6cad08ce", "comment": "Malware payload (AveMariaRAT)", "value": "03ab5abc030808df981d655cae5a63c3fc28d2e3c2d76f72ae6a000ec89f3cc789a0d3ece08233bd3363e3a18088b0ae", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054866, "uuid": "30251f44-7adc-49fe-9e1e-38f377b8b364", "value": "T10C62C01659710B2B873D053EC9C64DA4D62EF9C68FC2566AC4361C8768AA333C9DEC1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054866, "uuid": "abb2eedd-d782-4e43-a1f3-73b38044247f", "value": "384:KY3bov3slaMpY5Z5pBVvHrTReC5ZPys/CQId+KbAuxG5e+utGCRXYdg:zb08li5ZdpTJPaQS+KbPI5gNyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054866, "uuid": "da380a8f-7c1e-4d5e-89cb-d9625313c217", "value": 15024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054866, "uuid": "0df39671-d23f-4719-96db-cb9db1ca54cd", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054866, "uuid": "faef1f80-9e8e-4bb9-90d0-ef06db51a9c7", "value": "278857944198(2).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3822cf95-0475-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686061199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061199, "uuid": "efab77d5-bf1e-4eb0-ae2c-da6af027d28b", "comment": "Malware payload (AgentTesla)", "value": "98ba7df8f3bc23dcb84db646326701c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061199, "uuid": "603382be-d016-465b-8b3e-ed0c7970e2f4", "comment": "Malware payload (AgentTesla)", "value": "fa725f4ec11183732eeb9f27f9a845932496540a3e35acc810d1619586ecdde8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061199, "uuid": "d90dc252-e75e-41da-affd-050a2cb92235", "comment": "Malware payload (AgentTesla)", "value": "4ecdccd221195e84a81adbf119bb19413a362289", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686061199, "uuid": "35533732-9121-46f2-a8d5-bbfecd27e425", "comment": "Malware payload (AgentTesla)", "value": "bd6d28381528a69feb426c733f9fd1ae8dcd3d7c17ef96067cbb54cf6d6d52314b76dc1c0ec9959129cc481e9cc92c67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061199, "uuid": "08f5fb04-4151-4878-8630-f71881617063", "value": "T1FAE42391451348B07F3A4B8CABDAF5FB2B6152F1B404959C22355FEAE93BD64B8C4383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061199, "uuid": "ba123444-2530-47c1-a7ef-ed5ad8bc3675", "value": "12288:0BoGomOmhv8o7bMDCcYrrqS6i0nnnYVu81Dn0IfkBlrnc6LS1cYHeUihOy7KGTTt:0smq2colOYVXDn18DLc6LocYOQy7Lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686061199, "uuid": "ae9bb9f6-af54-495a-aea4-e7d905266d89", "value": 660600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686061199, "uuid": "784fd7b3-aebe-48d0-b546-d22eb0248219", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686061199, "uuid": "12e628f4-3487-4fa6-836d-01bc03882fc1", "value": "Quotation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca02df2-0466-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686054710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054710, "uuid": "8ccf4306-ff19-468e-98e3-931049267868", "comment": "Malware payload (SnakeKeylogger)", "value": "1c4cc85e63aef44062de90c698ad8b52", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054710, "uuid": "bb62f6b7-bf0d-4172-bb0e-9768e5e7f62f", "comment": "Malware payload (SnakeKeylogger)", "value": "fac93de25c552a2dad517f0434b6a4f4929c3a914864b165efa173bc70e63621", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054710, "uuid": "d6cc2bf0-f31b-4b9f-9f52-47621ede392d", "comment": "Malware payload (SnakeKeylogger)", "value": "f9b5d00ca4442e8447089a8fe20f790f0fefdb7b", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686054710, "uuid": "c4a121e7-62fc-425f-a401-1738756236ab", "comment": "Malware payload (SnakeKeylogger)", "value": "8fa09b4e0284a1a7f838db66c2aceb150dc36040cf9e81d7afc55aaaf28a840cfa9ba53f3562a80e3d1f9b6b6c480e68", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054710, "uuid": "8b1fd5e8-40db-4abd-875a-8ed8f2db85fd", "value": "T1A81533AF6E1E6AF81F38A18A3B4356F208CB480967DDF7DF1D4EA9484B483579358C41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054710, "uuid": "cb718df9-d10a-4f91-98bc-b77394fc943a", "value": "24576:G5Fo0gx3ZdNKkFpU68GDmFFmQytIAaXNWHxb20:EozxJdLpDYPQImM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686054710, "uuid": "09b7cd5c-c43a-48b2-9ffb-128f2087656a", "value": 959598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686054710, "uuid": "d1ea8bd4-814d-4259-804a-7a3620aecbed", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686054710, "uuid": "9797a5d6-7f68-4c6c-bbe4-bb4cdf091122", "value": "New order_letter.Pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df13a1b3-0430-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686031844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031844, "uuid": "99b65d5d-aa1c-4885-ab19-61226df050e4", "comment": "Malware payload (Loki)", "value": "c93061ff1ed7edb56691fde0836de1b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031844, "uuid": "f277cc1e-e3d9-43c4-805b-0355b62bc2c8", "comment": "Malware payload (Loki)", "value": "fc4e8b16874c86e3d8ad3ce052b15421cd95d6c6f194587f2f5e08fa79e54172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031844, "uuid": "55b79d6d-62d8-4a1d-ad83-ab9c3a322b55", "comment": "Malware payload (Loki)", "value": "4fc7adc5c40d68c941253c78d30cfee2d0a9542d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686031844, "uuid": "d9cab8d1-27eb-4f50-b8af-318540a74204", "comment": "Malware payload (Loki)", "value": "70546553a3fa420ee186fd8d55ac84bab55769567ba01c8e49817b76b78b260f50e6c5df8332f8a5f86b5bd2df40c255", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031844, "uuid": "3a7057e8-5613-4b84-a9bf-34f9e750416a", "value": "T119E4016D2AB3461ED0AB3FBD0D005675C3EA9E497823C1271FA7B8CCDD18F190D949A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031844, "uuid": "ad2be01d-d37f-492f-b8c5-b3d69c994ab3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031844, "uuid": "a689b1d1-a785-4a0e-ad57-1b6fa7700840", "value": "12288:Re+J/M+Jhewx/NscEQ+vgXK1HsaPR26SRK2cXxMuipKzkLG4+o/gt8ffs+J:RH/thewlqB6p2hS4XxMxQk5gtkfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686031844, "uuid": "8ff030eb-25ee-4c35-a717-e55c03f75620", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686031844, "uuid": "eaff99b7-b0b7-4aa2-a3e8-f5f3f2fa42a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686031844, "uuid": "52c804da-d118-4da6-b8d1-c29b25f642bc", "value": "Maersk Line Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629a0ad4-04b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686087040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087040, "uuid": "fdf821ba-65f0-4cce-8cfc-4d22ed5831b6", "comment": "Malware payload (Mirai)", "value": "87655de774f9e4f8bfcbc5222157fc8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087040, "uuid": "28f611ae-1ad7-4a37-87b8-467dae0c9a93", "comment": "Malware payload (Mirai)", "value": "fcd5b6bf6a2c9c63d7df7f94dba43e54423699d694270c30a5fdace2c05c949c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087040, "uuid": "0cfaacdf-f9ed-4005-934b-c2496796afb5", "comment": "Malware payload (Mirai)", "value": "c41323144423661432d40d541fb584ab620e2cc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686087040, "uuid": "9ad958d3-884d-4e16-9b22-d5faec294a92", "comment": "Malware payload (Mirai)", "value": "86ebc9065552c5ab183acace151c13a16d6ddf516ff917664c682d2961662368bad8b983e59ff3e3ba322b3ae53a439c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087040, "uuid": "95c234c6-4792-4c3b-9f46-300fb13f594e", "value": "T149C3F945FC515B13C6C652BBFB5E428D7B2A17A8D3EE720399256F20378785B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087040, "uuid": "20e6da15-99d6-40f5-9296-1acc467d2e6b", "value": "1536:U1HQPRnS+c6tSFlA1CA4ViaSrTXN5Lfqt4DKTr+aKrllxxwywJOl1TwPnBW1BuLS:U1GZoFl84dSDN5LfAvRlphq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686087040, "uuid": "25566273-1b47-471d-9571-8faaddf56f0c", "value": 129420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686087040, "uuid": "ffefc7cc-c783-49a1-89c9-2554efaa4c66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686087040, "uuid": "cdfcd3b9-164c-4882-865d-0400173040b2", "value": "87655de774f9e4f8bfcbc5222157fc8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f531c4e-046c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686057292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057292, "uuid": "cd92628a-0a4b-4ac7-8c58-286cfa1b6fba", "comment": "Malware payload (Loki)", "value": "f971bc4c1d9a5d7fa408a41bb1dd7922", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057292, "uuid": "c3227436-50a2-41ef-9008-a60be5360757", "comment": "Malware payload (Loki)", "value": "fd072398dd3278431f57bb0649361b34006fe3a803d8c39549f30913a71f121a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057292, "uuid": "64a0a5dd-a016-4b76-90af-dfa489f92c44", "comment": "Malware payload (Loki)", "value": "e5bb119e3d3200a64ecb5fdf653f769be850747b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686057292, "uuid": "c66870f8-e839-4e41-9bcb-b253191982f7", "comment": "Malware payload (Loki)", "value": "3aa566b1e2321f24ba718cbf4e9a1a52aa28531283025ab416fa7611525590092fe0c2aef49cd0d3bcadbd8b45acfd3c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057292, "uuid": "b0c6acd1-0c9b-4044-848d-e313d793572f", "value": "T126C4233B294E473F8D33D6531AE4160BE6FD899991E04CD71AEFC5AC48DEE80931119B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057292, "uuid": "edbc0c41-49ab-48fe-99bc-9acc6d7db0f5", "value": "12288:N3B2iSnpd6lw/9qGU5hi2eM8IO9Wc6E52a9CfqdoiYpkElskMINcJwlNr:ZB1SnpN9qnh+ToKaS6N/NcGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686057292, "uuid": "3d1a83fa-ead2-4096-9cdc-64f768d02db6", "value": 555542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686057292, "uuid": "d2c78b5e-0e31-402d-9c83-35a34cc3bb11", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686057292, "uuid": "5ce10e99-019a-489a-9094-f091de19ca17", "value": "-BL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc320192-043a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686036107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036107, "uuid": "f123741a-d7f6-4200-845e-6dca00055ba4", "comment": "Malware payload (Mirai)", "value": "0c6eec719bf9e079fe44eb28e3f03129", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036107, "uuid": "c728cdf7-a340-4b13-a595-11fbcba2738d", "comment": "Malware payload (Mirai)", "value": "ff2f7ae1bdf29f690907e5dce5dcbfdd40df8c20eef30c0c50cd1c61eedbc898", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036107, "uuid": "cde89758-a6d4-4e5d-b468-ff90055eacc3", "comment": "Malware payload (Mirai)", "value": "463930544d04a87135911fae70e813adc6ead072", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686036107, "uuid": "053531c7-8241-40e3-8f7b-2d045a5f8ba6", "comment": "Malware payload (Mirai)", "value": "79f5b663ed14ebc39cd36a022018392b22db3db97d87e168b9ee6993a0d4458b00c9af729142b55e33a0f2f3355b7f3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036107, "uuid": "7a28ecc7-8394-4dd8-983b-53935eeaefdb", "value": "T126D35C46EA818E13C4D5177ABAAF41493332E754D3DB730689186FB43F867AE0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036107, "uuid": "ba7076f8-4c2c-4057-a069-5c11d02b29da", "value": "3072:wN9IgjSha3tJLs/HLLrXQ6qYTpYxom1XPHHlOM/9waLYj:y9IgGha3t9sDXQ6qYTSomHHcM/9wsYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686036107, "uuid": "205c3bcc-ed03-43dd-8a44-f13f2345f241", "value": 136315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686036107, "uuid": "9022502c-cd10-42af-9509-5aa7bf00fdd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686036107, "uuid": "57a66b2c-1d79-4338-9ea8-b48b42d61dcb", "value": "0c6eec719bf9e079fe44eb28e3f03129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2c3715-0431-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686032109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686032109, "uuid": "c6d11207-870f-4ff5-a578-0260222b65fe", "comment": "Malware payload (Loki)", "value": "bbee204641bcf840a1491871f4463839", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686032109, "uuid": "90e70434-90a7-4283-a02c-8c1e06f9a434", "comment": "Malware payload (Loki)", "value": "ffe5ffe1fb95944dcd243b63962313ce8c8855f8d10fcde9b5598cf8835fefc5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686032109, "uuid": "47cba30f-027b-4529-a507-398cda6d354b", "comment": "Malware payload (Loki)", "value": "59066453999288443c947cdb13c9b64003eca36a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686032109, "uuid": "43829959-35d0-435d-a58b-2cda3411758c", "comment": "Malware payload (Loki)", "value": "c10d3154f8cbe0d5e4233ab2e6acc50990777b91ddf482ed618fa0c66ad269817c86ec7d91be819853aa9e4a02c3985c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686032109, "uuid": "de1e61ac-215f-4feb-b20b-727acfebbb0b", "value": "T196C423FE2FDBB0F84BDC5666645E30EE464D6C1A367A6AC7ED227A061F3190C784D042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686032109, "uuid": "f476969e-77a4-4672-bb2f-3a42c720ced3", "value": "12288:vjgYYvHyghA11JJF5TPZXScQHzkLz3UHquvBDm:vcjH7m1J5TPcdTEzkHlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686032109, "uuid": "ed3f260c-fb85-4033-8bc8-04fa1529545d", "value": 545032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686032109, "uuid": "52d74e4c-c9e5-43a5-ba55-b5809a792ccf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686032109, "uuid": "bf7ff26d-7644-4d24-8a0c-31eed1e78862", "value": "-BL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }