{ "Event": { "published": true, "date": "2023-08-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-19", "timestamp": 1692489781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "2ddff066-1c13-4530-b21f-535221d0bc84", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae02489c-3e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692456174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456174, "uuid": "16195249-bf15-4ad1-8929-4966d94f45e7", "comment": "Malware payload (Mirai)", "value": "9b56279f06b2592c903c85b6468e89c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456174, "uuid": "3e1caf61-7cca-4160-a0a5-3d172e58e19e", "comment": "Malware payload (Mirai)", "value": "0000ffc6d5d112acc3f441ccc57119dc7014fe17403cabb7f5a5d91d7625194b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456174, "uuid": "1e8cd4e0-529d-4081-ac23-bef352eb4cf7", "comment": "Malware payload (Mirai)", "value": "95a82bff37da5fc51a93843d8acfb9ca7f3a62a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456174, "uuid": "a7e562b1-c512-44cd-a416-e1e4a3c73e0b", "comment": "Malware payload (Mirai)", "value": "3bc2d3c4b9f2d7107153007ae60c2bb5dc19dbcd8d7a9c9ae438a0ecae3c1aa006e0cd1b250b03129734348b7c1ee3cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456174, "uuid": "7cf3f6d1-0ed3-4be6-9945-e983eef5264b", "value": "T1AC82CF3061AB74E9CBF14431FAEDCEC6971A0BF8D0FC36931758AB78894510251F92DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456174, "uuid": "ca1ea1c7-670a-41ad-a3c3-7ba3e6eb55a8", "value": "384:MnozRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMap/5hymdGUop5h5lF:2sV0P6+kom0tVAoNvm+to1p/5s3Uoznv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692456174, "uuid": "41a67178-b97a-4653-8763-851478aa7341", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692456174, "uuid": "91a69b15-9b6e-4ebb-922d-1fbde26865d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456174, "uuid": "a37da1ca-bb86-4ef7-ab05-b1aa157cf9a2", "value": "9b56279f06b2592c903c85b6468e89c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6a4fb1-3e7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692441680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441680, "uuid": "2242802a-2879-4e20-ac6f-2e1557ea89ad", "comment": "Malware payload (RedLineStealer)", "value": "943726ad37d232a57a503d5b8d29d58c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441680, "uuid": "0cdcc5ac-b9b2-4527-a390-2c2db08913aa", "comment": "Malware payload (RedLineStealer)", "value": "029aef4d018fb0d984a7d241100f2a92fb6813267e87a61344800d09d0b947fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441680, "uuid": "73d4decc-283c-4e7a-8450-d75f52bedb7e", "comment": "Malware payload (RedLineStealer)", "value": "4021308bbdc793eed7a09ad0610895bb324c6cc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441680, "uuid": "8b474726-9a30-4e59-8847-90e0e8e03153", "comment": "Malware payload (RedLineStealer)", "value": "1b18bf7d44482e5ab327f14f3ef3a32c361bfcdcb48ec47f15d67adb70fdfb0a749610025e856994f68c90d3a3d13a20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441680, "uuid": "857bf487-5c4e-4acc-b5a3-6a39bf869b2f", "value": "T132052266BBD991B1DDFA17B019F612A70F32FC2288B0CB6B1385984A1D73644D53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441680, "uuid": "7624369a-56e8-4aef-bd44-44d635c6b2d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441680, "uuid": "3688c854-4aad-4557-8fe5-e7f82613d457", "value": "12288:AMrdy90CHXmaL3gnH6J4Gt4z0teY1JFBx2lDkpwdaApy9V:tyl3m0gnH6J04t/1rBx2JoApi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692441680, "uuid": "a87fe5b2-5546-43b1-aef9-a694c23b61d3", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692441680, "uuid": "3362136d-f897-4fa7-9b3a-6bace4d12331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441680, "uuid": "79044c4d-ceeb-4356-a197-f8322236e60b", "value": "943726ad37d232a57a503d5b8d29d58c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ec774f-3e7e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692442284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442284, "uuid": "4ee188f0-de78-4d61-9b53-ca4ddb9dd847", "comment": "Malware payload (njrat)", "value": "3abfc6292bc8f258ca191672a89850f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442284, "uuid": "0721a79f-db83-4b16-afa8-19fcf88ee352", "comment": "Malware payload (njrat)", "value": "0425c530b0e7b99ed34035e4eba3a33264cd0b589000c1472fd046271d23b117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442284, "uuid": "53a3c757-477b-448f-8492-5cea1a73a150", "comment": "Malware payload (njrat)", "value": "3482c58d7943709b454a30e56a31a3b24715b122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442284, "uuid": "78d323b8-caa8-4d13-a040-72b68feb4cb3", "comment": "Malware payload (njrat)", "value": "609519cc5c2de80031a4947cff22dd24daa12aba6a5feaf4d9139c2cb48c74a162b9aa7abffc75728ec228c8b502bb27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442284, "uuid": "32d9217a-ca5d-43e1-b800-82c3b502a950", "value": "T13F232C4933D99525C5FD9E348565A20207BAB20BAC1FFB0D0CD6DCE91BB77D10D40AEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442284, "uuid": "d5556539-c786-4ad6-ae38-0c776566f731", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442284, "uuid": "e2456eba-b620-4944-9af0-ced1de886285", "value": "768:szO/1pBsLrbHS1rQnn8ODebj0qlY590TRXZ66QDY/X9u0hcb1yU:KS1pBsLrbHSa8kebj0qlbKY/Xg8cb1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692442284, "uuid": "5d874a49-f0b8-4fe9-9e4b-092e6dbcbb96", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692442284, "uuid": "3b75422c-c5c7-4b1c-b636-d44105de86f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442284, "uuid": "b8b027b4-9caa-4f07-83fc-ff4e2d0c61e5", "value": "3abfc6292bc8f258ca191672a89850f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ef4992-3e75-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692438680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438680, "uuid": "9ad69ffd-8a87-41a9-9b72-c58e4fd02b55", "comment": "Malware payload (RedLineStealer)", "value": "a61483df0ef958d987234bbde747e64f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438680, "uuid": "e8ec8383-d390-41d9-be66-5c43f85ab1cb", "comment": "Malware payload (RedLineStealer)", "value": "04d64ae10c0b908413d5249cbab7e5ac255085a6e45b8fe16d3f6bc9cfddb2e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438680, "uuid": "f50afb92-d936-4f27-a594-281ec56f9141", "comment": "Malware payload (RedLineStealer)", "value": "587c8ed47708ec9afc23c4c4d5aad94cd44072a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438680, "uuid": "f39e3822-c4a1-4d35-82aa-2d315d75c9b6", "comment": "Malware payload (RedLineStealer)", "value": "8efde6562e516c45be8afb1abf8bed49725b62b1b2df3d04e770938dcc33a9f2e404324aec5e98bf04fe5fe6bfaebef5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438680, "uuid": "1faefea2-1d48-4675-9b6b-fa16f967162e", "value": "T1C0052392A6D50463EEBC5B7058FA13C70B397CB14878466B3789586A0DF3AA6F031377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438680, "uuid": "e960c797-1a35-41b2-874c-25dd8bfca6bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438680, "uuid": "b17e462b-ebbe-479f-8a74-070ae80f963f", "value": "24576:fyUHKNuMW2XBj2XkvzZzsDKf7NCt3Qp0N8ZpkyR:qUqYMW2xjUkv1YKf7NonN8wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692438680, "uuid": "6d14d180-ab5c-4d0b-a478-1bd15e186f30", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692438680, "uuid": "4074dc76-03ae-4ff3-b53e-ba9190505f85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438680, "uuid": "bd37a13e-e75f-4c80-9e16-1aa16448da1a", "value": "04d64ae10c0b908413d5249cbab7e5ac255085a6e45b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580b32e6-3e70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692436272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692436272, "uuid": "a6b73e06-b043-4185-b4ea-2544560a96a1", "comment": "Malware payload (RedLineStealer)", "value": "cda571ccd2df94e7d2b29330e7546106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692436272, "uuid": "66669819-f99d-4582-9992-f2e5ffdcb7c1", "comment": "Malware payload (RedLineStealer)", "value": "0544dfdf17d7b8fdea45f69e34e0fc06ae651d00311005e7565ca9221a3270eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692436272, "uuid": "80fbfbbf-c400-4546-a051-e9a31911083a", "comment": "Malware payload (RedLineStealer)", "value": "0e7493a880310ee937a41bc4407bb88964240cb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692436272, "uuid": "ba0cf625-afdb-4247-b8b4-e08c02bc3a3d", "comment": "Malware payload (RedLineStealer)", "value": "01dbfd44d5df4d34b0d65b38116645fddbbd9b8dbe8e2501ffe6c37337a90717bc71cc4a0e1074ccb64b2e7dd6fec3d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692436272, "uuid": "1393e858-0f4d-4efb-a4a5-0f0386696e4b", "value": "T13AF41222FBD184B1EDB5637014FA17930B35BCA19CB8936B3681384E5C726D9A972337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692436272, "uuid": "222a1153-bf99-4db4-a293-617ed21fc392", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692436272, "uuid": "ba39a5c9-ef97-44b5-9f1f-ff5c49a76ec6", "value": "12288:nMr9y90LkufWof35iG+pnUHwr5I3VKjEe7fTwKR1uXbp7JBCV0hL5oOs+2GpikDq:iyEBeof5iBFyVAD7fsKfu1cMVoUwMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692436272, "uuid": "276c9b83-d53d-4e3c-9478-d8414d7f468f", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692436272, "uuid": "e5e84a27-f73a-4b7c-a733-4f83c3f4072f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692436272, "uuid": "19ba8b23-a136-4c47-9431-26a99a76df7f", "value": "0544dfdf17d7b8fdea45f69e34e0fc06ae651d0031100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5e9fb5-3e8e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1692449411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692449411, "uuid": "a6b48b08-ef95-413f-868f-98706f561d8e", "comment": "Malware payload (TeamBot)", "value": "d1bab8572a277218547c1aa20d480d29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692449411, "uuid": "0dba96bf-fb88-463c-8a41-8c7a2fcf6fcd", "comment": "Malware payload (TeamBot)", "value": "05682b4015c124fefdafb89880b8b627fbaccae01a6d76f60033f845d891e8af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692449411, "uuid": "c03dedc7-6f82-4b9c-8d6a-0251858f4e4e", "comment": "Malware payload (TeamBot)", "value": "282c82a9fe79d12759b0d939b06b1fabf1b8fc57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692449411, "uuid": "db6efca4-fe7d-42d2-8428-4c7d1e9670d2", "comment": "Malware payload (TeamBot)", "value": "08bb6e4a6b38aa83c84d153b5c3d995195ed921262f6a2be41e33a538f0fab8682d8311bb45453086de4987bcb8e502c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692449411, "uuid": "d5c693a8-3670-408c-834b-c1baaf712225", "value": "T16124DF323AE0C076D54B80305525EFB4AB7EB83153B5854B7B980BBE9F313D2576A31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692449411, "uuid": "5e63aa84-148b-491e-9a59-d483aad99498", "value": "bb100aa787aba6c190b0ee2f89f34d0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692449411, "uuid": "07e6c7af-9d66-45fe-8900-bb8603311b0f", "value": "3072:2yEDTlL5BT3+96T7WtWNHq0iyK20sku8MbR:+L5l+9pW/iH218", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692449411, "uuid": "742c32a6-65bd-48ee-9c72-ca59d08e35c5", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692449411, "uuid": "bcdcf98d-12a9-46a5-b65e-cdecaa7793ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692449411, "uuid": "44a04055-61db-473f-ab61-250b957f6f24", "value": "d1bab8572a277218547c1aa20d480d29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5899cf7-3e5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692427866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427866, "uuid": "3f0517c3-436e-4502-9c62-4b3811523a4e", "comment": "Malware payload (RedLineStealer)", "value": "56daab4f5c3cd154e239369d7dea8986", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427866, "uuid": "1450cb52-cbd3-4d12-a1f1-42f8de856734", "comment": "Malware payload (RedLineStealer)", "value": "05795168f1101d23a3221cc5974ba1e505e0592f6884d47d0e83914a7c9d2522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427866, "uuid": "5bf4dda4-e097-476a-9381-24c611a4afcd", "comment": "Malware payload (RedLineStealer)", "value": "06fe6922dd214a3a78ef3d33407a39b15a7f473c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427866, "uuid": "9f6bc469-a340-4863-af73-a7522c439bc3", "comment": "Malware payload (RedLineStealer)", "value": "a8eea058ff1cdd6e4f040865e57eafc7ca20c1754b934ccb58d36221e8a00ef8749d4646bfca0e8ea226a511ededf5e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427866, "uuid": "20309cdb-98f7-40af-bd4b-087b1a89229a", "value": "T1EF052317BEE9C063D8B6177028FB1B830B39BC61587D83163646A82B1C72199FD76367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427866, "uuid": "6a9e47f2-125d-45ae-8032-86a5860e44a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427866, "uuid": "1fa90afe-cc34-476f-ba63-5c7c5397dae0", "value": "24576:Gy4ZqQTT8FGtyEV+45n7MyKmdDIawHM1YlDfBP:VQqQTTAKx75n4yKmdDIdM1it", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692427866, "uuid": "e117b0d6-e489-479d-90ae-b8f989b0b403", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692427866, "uuid": "898e233a-81aa-4e9c-a724-bd492356bd3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427866, "uuid": "e584e208-8da9-44e7-96af-c320f50a26cf", "value": "56daab4f5c3cd154e239369d7dea8986.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49e7044-3e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692456185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456185, "uuid": "9124df56-b14b-478f-a3c9-2c8771cc839d", "comment": "Malware payload (Mirai)", "value": "b3653224254bb898f0464ed80438b365", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456185, "uuid": "528a7b3d-4c09-4167-983c-eac0e5ea5ad1", "comment": "Malware payload (Mirai)", "value": "064d9da00d5b1d39981242971fe166bc2afaed1a8b781189bc3485ac0cc004d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456185, "uuid": "87e92fe2-012f-4423-b2a3-6363b670e3b2", "comment": "Malware payload (Mirai)", "value": "65a7d221802f950481bbce9430aecbfbb31ec242", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456185, "uuid": "64c02b40-fa0f-4fe4-af53-30e333f47036", "comment": "Malware payload (Mirai)", "value": "06064dba6b88af0e6f75b0927a58195b1df92c8f2f7887e70e970605e851846169e42061b32521df9786154e21448596", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456185, "uuid": "d1e08985-9d82-41a0-a51f-84bbe48f8213", "value": "T1F9A2D015E345AFF5DFEF9DA052C1C3C276E547C7268AC8E240EEAF022906046B788D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456185, "uuid": "826645fa-e10b-4f3c-897e-33d6867e0af5", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5+YVR7M4uVcqgw05VxJk:mRxsSVsMD6xiJJE5zRWN9VRo4uVcqgwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692456185, "uuid": "711745e1-ab45-4034-b358-0811c2d53298", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692456185, "uuid": "879da795-0486-4e08-9043-bdc6f54e7f85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456185, "uuid": "d518188c-fe6c-46ee-9de4-081a27a0a7f5", "value": "b3653224254bb898f0464ed80438b365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382ad298-3e82-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692443950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443950, "uuid": "5a655e14-a293-4dae-9776-d6513d78c137", "comment": "Malware payload", "value": "b09856369f474e4ee2142c2b461c05e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443950, "uuid": "77a28ca8-85af-4f4b-bf66-78bcace796cc", "comment": "Malware payload", "value": "0762a0597307f5f03997d2b06359527db6b14f09967433a3113325e0613c1e7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443950, "uuid": "6daa0cd7-a59f-4a46-8ea9-502ed664b698", "comment": "Malware payload", "value": "c4f710ec5330ba659cb381dee0622a3378ca1483", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443950, "uuid": "2660bf1c-193a-4123-8ba7-b33b558a24f3", "comment": "Malware payload", "value": "49313c28f2ad32d06c47ec220681a9459688454a9a0adfd000c86bcaa97c446f61b450988ec48330bbc3ef03c1129d28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443950, "uuid": "f594ac85-2f4f-4cb6-bacd-d621bab3f804", "value": "T17924E7280F884FABC99EC674B1540D4906FAD3C6F5AEFB669CB565E518E3341FC031A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443950, "uuid": "c45a1340-2c68-455d-be04-9c9dc88463c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443950, "uuid": "2f6db8bd-7ac8-4b58-8f40-95de32f578cf", "value": "6144:LlGv6X2Arg4YjKzGPWaPfJ0ODfaJqSzA:IVAM4GKzGTaXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692443950, "uuid": "371f7fed-1215-44bc-ba15-3abc662cc0e9", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692443950, "uuid": "dda720b7-bd04-41ce-8604-eb11e48661b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443950, "uuid": "190f963b-40a3-4915-b666-23927c222ca1", "value": "Cllpw math.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d6ae71-3e7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692440782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440782, "uuid": "7899200c-1f1f-4c01-9320-9436548f720f", "comment": "Malware payload (RedLineStealer)", "value": "8723f443a85172e2cc6fad3d5cc871f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440782, "uuid": "a2ac0759-03c2-4155-9925-cc58be1c16e9", "comment": "Malware payload (RedLineStealer)", "value": "09d276004abf88f6eefde65d3cf03899b5c6eca6ed1025fb18d8047565a945b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440782, "uuid": "57338eb1-976d-4dc0-b238-69564e1df3f3", "comment": "Malware payload (RedLineStealer)", "value": "1f71c22c4cc79de3eb4519d62497a8991f0f9e3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440782, "uuid": "a6040495-e7a0-471e-84a1-cfb5a88d3495", "comment": "Malware payload (RedLineStealer)", "value": "a76816df9a27f63378315447e47a895e99563c7f5a63dca32b4723368a1bde87b415a70d70c3c52578e5ff53f088937d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440782, "uuid": "00844c17-1559-4252-9493-f1548a4893ef", "value": "T1AF25234666E5D073CCB96B3048F603970A35FEA0EEBC931B7395099B0C72A94E476727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440782, "uuid": "a0b700eb-b02c-45a4-99fb-386ca926410e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440782, "uuid": "2232bdef-ffdc-4b39-a874-7d36e8580fa2", "value": "24576:tyO8w/+aS4AXTA/BM/WR/RrnP77rst9GocYXOyaLipLFw:IO8wmPhGdnjrsgY7ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692440782, "uuid": "9f6ffb9f-a9e4-48c8-be2c-d6b615e4f96e", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692440782, "uuid": "32d3e248-3241-4187-a6c6-eb4de11d1d9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440782, "uuid": "4ff36306-8891-477a-a20c-4facf9bc9ee9", "value": "8723f443a85172e2cc6fad3d5cc871f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0c60d4-3e73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692437787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437787, "uuid": "68f58bd2-ac28-4512-82ab-eadf409ab274", "comment": "Malware payload (RedLineStealer)", "value": "f9d3bc35a2b9474d7caa8fff4b31c661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437787, "uuid": "30d24051-a8fd-4117-af39-904f40c16c90", "comment": "Malware payload (RedLineStealer)", "value": "0ac5e52fe8a176502e895c8581c34e6c3a89b9e06c64ae630196918abcb74bf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437787, "uuid": "c0dfd5a6-1ad2-4a87-9676-67cd60f56238", "comment": "Malware payload (RedLineStealer)", "value": "98c6cfdb627a140f67aac230ee964bacbdaddf8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437787, "uuid": "5c54ed3f-6eab-4e52-9ab7-1e8704fcc5ef", "comment": "Malware payload (RedLineStealer)", "value": "35b6e3b01f1c7640dee1f66a020ae745ff44218dcb485de9a00cbd36682de93bc0b45bc99bee35fcf09bd564e89695cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437787, "uuid": "de15c27c-3a3d-446b-9a93-71a602783a0f", "value": "T16D052357A6E8D172EDB56B7018FB02D31A35BD515D78836B3605BDEA1833390B83232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437787, "uuid": "e73bf490-80c0-4208-8af0-34b8a1542428", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437787, "uuid": "d45954e4-cad4-47e1-b9e5-488e9e1e0b67", "value": "24576:5yJgnuuY89qd3vs5HCN4Y/HzkvWXpQ6GAM:sJzuY89V5iN4XvWXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437787, "uuid": "1f011002-a696-417c-9902-6f0f3fc36233", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437787, "uuid": "88601aad-fda2-475e-a0df-1fa6fba8119b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437787, "uuid": "a5f8dca3-283f-4f21-9a4c-cb0775681179", "value": "f9d3bc35a2b9474d7caa8fff4b31c661.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84cf53d0-3e4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692422174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422174, "uuid": "371b2519-5402-4e68-8dc0-d24918b55cbe", "comment": "Malware payload (Amadey)", "value": "98b0e6f28e65f641f9bc916bfcf2e693", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422174, "uuid": "32081560-24cc-4338-87a9-7480ebaf3c7d", "comment": "Malware payload (Amadey)", "value": "0b427690833bf8772348636a0428202f0712c31f29b4beb8e222a20c117493b3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422174, "uuid": "72cbf861-b719-4594-814d-3230b883b60e", "comment": "Malware payload (Amadey)", "value": "b63a8ebc6b7d2886dc00b3cd1ffe24490545bcae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422174, "uuid": "d94a9af5-ed5d-46f5-a59e-e855e5086ea2", "comment": "Malware payload (Amadey)", "value": "9427f7dd7552fef4cdef213133b8838f9eaf25f77fc8d542594ba3c4b4acad1dc067ae22e99f23036b7e5b1a18a97b7d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422174, "uuid": "7750be8d-b6d5-41cb-a067-31c3c03c5820", "value": "T1B7052257B6E88875DEA41B3059FA07D306357CA00978C75B77C0B86E1E32A98F87532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422174, "uuid": "9e6b30ea-0e86-4260-a359-8eafe8e244a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422174, "uuid": "a0264471-fb18-40a9-8ea1-b44c283fed19", "value": "24576:Kyuph4kmpW2aFXInJrkLCgmBEQnd+f+ekxD2rag:RugkmpiCJASGv+PxD2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422174, "uuid": "ff43d690-7288-40de-ab38-4c22e7584595", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422174, "uuid": "c1da6b81-0de4-4d5d-8a9e-d396393ed198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422174, "uuid": "6205d30f-40d0-4b1d-9643-abee2d20f416", "value": "0b427690833bf8772348636a0428202f0712c31f29b4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f09347-3e4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692422176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422176, "uuid": "00324a6f-d033-49d7-81f7-6f20f05be425", "comment": "Malware payload (Amadey)", "value": "ab3f645d07770300fa15f9ff8569db2f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422176, "uuid": "1a8b1e2c-b008-464f-98db-10e56b895ba6", "comment": "Malware payload (Amadey)", "value": "0c62762676659013d36805ba179c3ed84d999b502e66bb313e37dee5d13ec65f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422176, "uuid": "8ee14ec5-9003-4587-982d-90533ab2aade", "comment": "Malware payload (Amadey)", "value": "f3250b098b12a46b2caf84bf0bebc08aad48b720", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422176, "uuid": "423755ce-27c4-4a00-9ccc-077f3b57b382", "comment": "Malware payload (Amadey)", "value": "6f1851bdda3aaf89a359d4210d9a189af800e9c20d907570bab23d2c33d2a0959ebce2936aaeca7b248d254bc6c6f9fb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422176, "uuid": "c97912ce-ca66-4fed-95c1-0ced9b269b31", "value": "T1D405124263EA5412CEB8273568F707D30B3A7CA25C389767378A684F1C716D2A97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422176, "uuid": "ed8790cf-de60-4b68-9d56-70f731c7bf02", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422176, "uuid": "bc867f9f-12d8-46ba-b998-a2d8f3f9fdc5", "value": "24576:cyhqdyo/L7l+w4C7qQKFF5OZnJ8B/ys0:LhW/L7l+w4CWQKFF5onaB/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422176, "uuid": "5ab2bbd8-7671-470e-9233-8e1b52ea6cf2", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422176, "uuid": "8a243622-b270-487f-88d6-a190fec791d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422176, "uuid": "8b033734-8111-424a-8720-8808e2907b78", "value": "0c62762676659013d36805ba179c3ed84d999b502e66b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7f695a-3e5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692427880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427880, "uuid": "c064ee4e-9a8e-437a-9c7e-5e194e933fd1", "comment": "Malware payload (Amadey)", "value": "7d4b9394e2f4f4fe481c1c92bbe01561", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427880, "uuid": "463f3aaf-33f1-4116-86a7-234a1134d63a", "comment": "Malware payload (Amadey)", "value": "0d1a72aa53a28f4f408c2eac59ccce58d3f9d8e22d57a351b981aab49c23e077", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427880, "uuid": "21aad89c-66ac-4cbb-b149-17a1ab874abe", "comment": "Malware payload (Amadey)", "value": "553ef6eae8ac3ff01fd48620935e05180bed06b3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427880, "uuid": "04d624fb-2b2d-49ed-a507-964db723e69d", "comment": "Malware payload (Amadey)", "value": "9d63178660c6dd943b017eb55afdbcf15a37938af0a70771c434e111e75582175b46187d58aad1f3ad30757d7605185a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427880, "uuid": "3ffb845e-8178-412e-9f82-9cfcccafa778", "value": "T185052216B6CA8463DA742B7018FB07C30F36FDA58A74971B3784541A4C73A96BA3533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427880, "uuid": "b4cf38e6-a5f4-4f66-91db-23601c745a35", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427880, "uuid": "8a630c2d-888b-466b-a9fc-a72d566e3026", "value": "24576:PyZvFOWzdAdPn0722KM55Lqf+mch7Q/HHR:arZz6Pn0i2KM55Lqmmc2/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692427880, "uuid": "d7fd170c-2f76-45e8-8ac2-3ba9caf99aad", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692427880, "uuid": "81cdd3f7-6100-405b-8853-47408045fbc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427880, "uuid": "992c1d02-f9b6-4e18-8310-3c6208f32844", "value": "0d1a72aa53a28f4f408c2eac59ccce58d3f9d8e22d57a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a4c747-3e5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692427868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427868, "uuid": "2b95854f-cbb8-48a5-809a-019605bec5ef", "comment": "Malware payload (RedLineStealer)", "value": "11793c2c03a2e0bd1e07c9632f26ea8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427868, "uuid": "5c834ed8-cd9f-4ed1-83a7-0e7a888938f3", "comment": "Malware payload (RedLineStealer)", "value": "0f8b7ab1e3b9e47242d0498d0bf7b7a4186c0b391d1a73904d0b2abdd114c5eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427868, "uuid": "3a0eb7de-de64-48cc-9799-abffca35a75a", "comment": "Malware payload (RedLineStealer)", "value": "0d12d6e6c3fae1aac0caa019cdef7cd15ae45d58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427868, "uuid": "639afdf7-cda9-49ca-9770-dcb6c88e4d1b", "comment": "Malware payload (RedLineStealer)", "value": "0b2e6a3db07475951a103c9e325dec8fd43466e8649a6a3b5d8333aebbeb77705ccc6f11b9f610c94bfbdfae4245527f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427868, "uuid": "24829fe5-c0c0-4f5f-9f44-c1ac691d30a5", "value": "T1E1052242F7E88133D9B52B3468F703C31B35BC614DA9D3675388A5AA0D3254AB93673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427868, "uuid": "7d0d91aa-590d-44f3-9688-b729adc8f031", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427868, "uuid": "8faf3b95-353c-4b83-acc3-941ecbe6c040", "value": "12288:UMrxy90pcAvcSltVk2dTpdZUTUoUppWiCG5hQmZuUQ+rdDDdLD/BP2YGl5vhhV:1yedTeTJ21CG5um8UQCdDpLD8zhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692427868, "uuid": "08beb262-c921-4655-9517-4d89c8e242c1", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692427868, "uuid": "72ac9dd4-cc37-4276-89b3-2ea65f54d0eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427868, "uuid": "c1d867c3-091d-45ef-af9a-7e66a548171a", "value": "0f8b7ab1e3b9e47242d0498d0bf7b7a4186c0b391d1a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e906ce-3ed1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692478205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692478205, "uuid": "eff78647-8d3c-48bc-8aca-d09ad163179c", "comment": "Malware payload (Mirai)", "value": "b5ae2b284394c0dce3fd60e72dbc802b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692478205, "uuid": "2c761490-2dec-4792-9e25-edc1ad60e08e", "comment": "Malware payload (Mirai)", "value": "10429d5363106d94183ed528850dde4cab8beab86c48c1367a8195a99f1c1efb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692478205, "uuid": "eb843d4a-e419-40dd-91cc-8913d14fdde2", "comment": "Malware payload (Mirai)", "value": "3617bef6ccb0e5366f56c3e0fd9a2f8e850200c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692478205, "uuid": "0bfb9c75-55d9-4a9d-a8f9-a3b353326a57", "comment": "Malware payload (Mirai)", "value": "20b03a6bb9bf3f70626f2288b895806116b568fd7002b19b607f349d74496b28a65eded2ab24266fbacb1b26a1f79f42", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692478205, "uuid": "ca07887d-e3b1-40c4-bff2-566580d689ee", "value": "T144736BC4E1C3E8F5EC111978307AAB729E77F13E7139DE9BD399A1339941202E60625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692478205, "uuid": "3649cbfe-4f5f-4494-bc37-438d0fb6ce49", "value": "1536:b/DYQYs1ZokODichA115UzOHIt09bfsH18ruUGDKVQSi:zDhzUkODichAJUzk4090V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692478205, "uuid": "36ed13fd-30c5-49b7-8d60-f8516abe9a2b", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692478205, "uuid": "23bb5545-dcfd-4ba3-bf9b-f8df281effa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692478205, "uuid": "629abf2f-1409-4fc9-a89f-06c14ffe8c5d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9df8cd0-3e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692456193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456193, "uuid": "d4976292-80de-4c54-a7c4-75d4106f115f", "comment": "Malware payload (Mirai)", "value": "6dd691db6e7ed6298fc632762543faf8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456193, "uuid": "7404114b-9fff-4b15-9466-e1d7be185128", "comment": "Malware payload (Mirai)", "value": "110bef7b81f3d93ba8220d9ad2768e95d6532ca9f54bf86ebf18a53b3144752d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456193, "uuid": "003cef3d-6e5b-4e68-99d1-c7243ebae5e0", "comment": "Malware payload (Mirai)", "value": "7408c563e131d5a51d1ed85e65e0f0158e4a32b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456193, "uuid": "fb709e14-4e3d-4cb8-8070-e6258068b1d9", "comment": "Malware payload (Mirai)", "value": "aa6e171e6139f440e553bdd96b00a7a45f9027aac3616eeff03721ba81c31bf1a1c15da7cb1363e02a29e8d197799093", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456193, "uuid": "36f46faa-df67-47d5-8127-ae4a645c4cbf", "value": "T1A4330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456193, "uuid": "28c96f4b-409f-497c-8ba9-51123d63931e", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGj:r/hqaJMcjeqK806MHdMfQXoHuCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692456193, "uuid": "4c08693c-6a19-4d9c-9564-a0de5f596139", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692456193, "uuid": "9fd7d1eb-e3f1-408a-9f45-7fa07ea76f88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456193, "uuid": "da462a91-8166-4934-9387-2c31d7fba877", "value": "6dd691db6e7ed6298fc632762543faf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe2f639-3e8e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692449405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692449405, "uuid": "24f41289-34b8-45ba-8666-38eb87c28cfb", "comment": "Malware payload (Mirai)", "value": "94ffb374f700998b6aae0f0c600fc4ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692449405, "uuid": "32ae6ec5-b79f-4eb4-a983-73bfbe760cd0", "comment": "Malware payload (Mirai)", "value": "12045b0cb71084420b86b317fea293801e0a290dff8200e2089ba09a3ef687cd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692449405, "uuid": "22200739-b505-4e35-8b6d-95192f0cb5f1", "comment": "Malware payload (Mirai)", "value": "ec237e039da5a1f9f1ea591ca009bb6a1cc37705", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692449405, "uuid": "418fdfd7-de7e-4c57-b311-ee206746be6c", "comment": "Malware payload (Mirai)", "value": "06c79701cb19f01f88cebc9341ae83738e88ad3036c1ebe8763d970367819304e3ef133d680bebcd11dc80a2ce1b1340", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692449405, "uuid": "39f78366-2914-47e6-868c-d4e7af51ea3c", "value": "T19C534BC8A5C3E4F5EC001D79307AABB1AA77F53F2035ED9BE39E25639942203E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692449405, "uuid": "2d69b64c-3ce1-46f4-8b30-c148d8b8a8a5", "value": "1536:b5VYYpXIqVkxmxRvXMFnKia1jGKO18Hq6PW9m1Tb0+j/KUAm9x:diYpROxmxhXMFnKl9GHCHqshb5/eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692449405, "uuid": "1bd18a15-9161-4e19-b6fc-92215aaa602e", "value": 63664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692449405, "uuid": "30f1d715-81b6-4a5d-bc64-f16846bbea69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692449405, "uuid": "e5f6deb0-69a5-408b-99ff-50a7a1956fc9", "value": "Mddos.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a8b88d-3e42-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692416513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692416513, "uuid": "9e2b8ae2-92c8-48df-9d80-60bab27c7677", "comment": "Malware payload", "value": "1c862514b99906b31423fda52012ffca", "object_relation": "md5", "Tag": [ { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692416513, "uuid": "d0b68e7c-d017-483d-a976-0e19eb87a45d", "comment": "Malware payload", "value": "1208725ada1a861469e119838ed62406a53c53c5604a1888fbfe440a9ee3af0b", "object_relation": "sha256", "Tag": [ { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692416513, "uuid": "78ea8742-3d34-40bf-8ed8-f57df2d441ef", "comment": "Malware payload", "value": "9e23e205905340f09c2a326bc77e1ba90d4b4726", "object_relation": "sha1", "Tag": [ { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692416513, "uuid": "999a571b-a91a-4c27-bbe2-627b96bdd4e3", "comment": "Malware payload", "value": "37c3d9145784c9cefd777f3b70f92011ccab8750fc21f20ae72ca21d972a923a93ff4eaafc5fa305179478afcfc84446", "object_relation": "sha3-384", "Tag": [ { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692416513, "uuid": "c11b13eb-daa0-47f2-923d-caeae5682d97", "value": "T19316C6F4B2517AE60FB4190DF38F80B26C27B85BF0BE5ECA22551A5DD5C4284D9E6CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692416513, "uuid": "928f9d33-dbbc-4592-8627-235846c28942", "value": "24576:QkYjISU4NCYkYuEhMml0/WoLScl7ADF+ToUwueEYV+WeEzJooRBADu/E1bpfFUNn:QktRp4xutEmU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692416513, "uuid": "dd7104dc-e213-4326-9a77-b8297be671b6", "value": 4118548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692416513, "uuid": "7cb499b3-f5ec-4585-84e8-9deb06543ea5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692416513, "uuid": "1c3f0ccc-1095-4f70-af50-2b2b028bfc02", "value": "drumcannon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793a8b01-3e5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692428168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428168, "uuid": "9c66cd27-369b-43ce-8c5c-bad508a4c5be", "comment": "Malware payload (RedLineStealer)", "value": "10316e7d291f60ff7eb26200aafaf7d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428168, "uuid": "aed91c7c-3079-4afa-b189-6a6fbca44952", "comment": "Malware payload (RedLineStealer)", "value": "12da01e0dd4183f27ac316d4e8889a249df778610dc574fd624e68e287693146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428168, "uuid": "9014dcdf-31ac-449e-86f5-ff67933b0fe0", "comment": "Malware payload (RedLineStealer)", "value": "ec47ff8a2b8d2724afb44b34b5958d173e03d416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428168, "uuid": "4482c641-2659-4dc0-8407-64f36a8ee361", "comment": "Malware payload (RedLineStealer)", "value": "64f6667318d1231f50889925b1e5f59ef7c4a84b8dae151d71c8514057e87e940cc5d2b0e7abaeae82e68d1a8fe67cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428168, "uuid": "92b794cf-e9a5-41c8-8cf0-0d8d0c50fade", "value": "T1BA052207A7D8D0B2EDF42B7468F71B430731B86149B5836B2342A85A6CB37D5A83177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428168, "uuid": "46063998-8c06-46ac-ae13-3023de3c2717", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428168, "uuid": "e65b81b2-434a-45e0-86db-b3062845858b", "value": "12288:eMrty90fpVqubzySamkVwLyYKzJe7v4tKR6PXwp7myG0Zle/XuIPUVMrDQ6wt:zy+pF+FmkVG0Q7vyKgPYJGoeNUyw7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692428168, "uuid": "84eae3ea-e6b7-4274-98dd-8b46be568fb5", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692428168, "uuid": "2f3602b3-25cc-4f3a-ba5f-e3903f7975a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428168, "uuid": "49d01ad9-de2a-43d6-b7d3-52b011d236c2", "value": "12da01e0dd4183f27ac316d4e8889a249df778610dc57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf3d4a5-3e73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692437784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437784, "uuid": "c9151046-3ab6-4044-81fc-d089385b8659", "comment": "Malware payload (RedLineStealer)", "value": "22db0380879bfda7a4be03882847bda6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437784, "uuid": "795708e2-6b61-49f6-8e11-9629d2e197f3", "comment": "Malware payload (RedLineStealer)", "value": "15848fdeb9827b5fadb22b35f16714760b60f762aeac93c1463736ab073f3d2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437784, "uuid": "9a751d7f-5b85-4a5f-a506-0a2bea377429", "comment": "Malware payload (RedLineStealer)", "value": "06260f63497860052de87edd6d20c6a43ad74c1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437784, "uuid": "2ff13c63-1ae6-4596-a654-82fc5fa663f7", "comment": "Malware payload (RedLineStealer)", "value": "8f59344ea437f101aa6fbedbf8d662974da92fa38bb70ca9f39fd354e2aa41cd67dedb2d85187c727c8ec5a971b92864", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437784, "uuid": "cb95fc45-6588-4b85-b6ea-a30bda853c78", "value": "T125252393E1E8A127CD7517B049F612831A38BC915E39432B1652BBCF4E73768613637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437784, "uuid": "b0bdd80d-30f1-41fa-b938-ff949ad6ae3d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437784, "uuid": "7b335c22-e380-4219-a3a3-780c5a7407d9", "value": "24576:CyyF+EYqnQcyXNNr9HlnoITITR1OFZnNvobR:phZqQcG995auFZnWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437784, "uuid": "c63b11aa-f528-4827-91e5-9ec2fde1a90a", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437784, "uuid": "038b7035-f564-46a0-9a5d-3f7ff8d614a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437784, "uuid": "c9a94249-36d6-4624-ac73-cd57867f6b3c", "value": "22db0380879bfda7a4be03882847bda6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f748c2fc-3e60-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692429668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692429668, "uuid": "14cd6731-70f8-4b36-83e9-404480ebfe80", "comment": "Malware payload (RedLineStealer)", "value": "884df47b50e27ffb865be2279b308009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692429668, "uuid": "cd033fb7-3686-43b5-a845-de99967245c6", "comment": "Malware payload (RedLineStealer)", "value": "18dea00935d2f1c5b3cf7666db20965d5d9e6af4a7efe119ac3a99fed2ecf059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692429668, "uuid": "85cf0322-2941-4c58-b6c6-8e0664e9a7e0", "comment": "Malware payload (RedLineStealer)", "value": "f93431d03b07cd3e563e04b088188e335eeff41f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692429668, "uuid": "59655bdc-1a0c-402f-a728-5eecc647a5b7", "comment": "Malware payload (RedLineStealer)", "value": "9c2c204230bbbee06e7003953348a2c7c05c1b57e9d58d275880d668b6601f22186e243f8b34787b90aa7ac435b5e48c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692429668, "uuid": "abeff00e-c0c1-443f-aa34-3a2031846a28", "value": "T187052396ABF14233D9B4373128FA03D30A36BDA05C75976A27C4A85E0C729C5E47973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692429668, "uuid": "5e1fb9bc-3ee9-45dd-ad24-caa843a4aa18", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692429668, "uuid": "88a39b1a-0ea5-4ab6-9b10-de0dea98dda6", "value": "24576:Pylxx0GLMSemvCsMyiAIkm7XQHd+yo9Jdk0Kdey:al9JemvzMI8jxkR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692429668, "uuid": "e2b301ef-7527-454c-ade2-8b72ccb8ccd1", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692429668, "uuid": "6ba880a7-f550-4b90-b0c6-8d90af164eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692429668, "uuid": "32862779-3bc5-4d32-a28d-1601c294bd1e", "value": "884df47b50e27ffb865be2279b308009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32243d61-3ed4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692479159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479159, "uuid": "ba72175d-4dfa-4577-b855-e571d3a4c5ec", "comment": "Malware payload (Mirai)", "value": "147ff0d1cc4c29106edb0038d88debdd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479159, "uuid": "a527d7c3-6f27-4ad7-a317-020641d7c627", "comment": "Malware payload (Mirai)", "value": "1990c464b4e1c1bc7f1d638e47d723b39a74d66ab11a60e4b705a20e477b4605", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479159, "uuid": "a03eed32-a2cc-4d90-9060-3a94971a0bc2", "comment": "Malware payload (Mirai)", "value": "5c8d3b6585c245e4f809fef010542b927068b992", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479159, "uuid": "fb7c905b-afb5-4cae-961f-6b2d9ede8229", "comment": "Malware payload (Mirai)", "value": "d992bb4ad0f190b59258fd746a06b10cbc34c7fe7ef04e97f3db9fe467ac7a12b644703ddd9bf91d42b6c8dcfe459173", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479159, "uuid": "b71d2df2-bf97-4d3f-b60f-f3c0410d6219", "value": "T1A973B70A7E329FACFBA9523447F78E11AA5833D527E1C585D19CD6011E7024E381FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479159, "uuid": "e9a9a714-46d5-4598-b972-41fafe343fcb", "value": "1536:3IHb8FMv77EKQHly1R1Fa6yBm3froxvdeEOPFal:Y78ivnEKMyZFa6yBmProxvUPFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692479159, "uuid": "2e3ee5b1-58f8-4dfd-89e3-6366f5e723cc", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692479159, "uuid": "cfb5ed33-8e7e-4ecc-add0-c95cf58d93ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479159, "uuid": "8f712d74-b459-436e-a6c6-cee6dce94940", "value": "147ff0d1cc4c29106edb0038d88debdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040ac2cc-3e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692445580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445580, "uuid": "f80e7bea-80bf-446f-8ea3-7de14f78e4c3", "comment": "Malware payload (RedLineStealer)", "value": "b3d6aa2dbf077f6f31b0211ea8efdafd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445580, "uuid": "c700b909-4d03-42a0-956d-861987ae5b91", "comment": "Malware payload (RedLineStealer)", "value": "1b4d67523602523fb1ae985471afd79a19e21c87143c9b2535c635bb7d8e0611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445580, "uuid": "c8e08ca6-ab40-46ad-8613-96f0ff6db49e", "comment": "Malware payload (RedLineStealer)", "value": "9b9a005fbcf49e634c414ab7b02833849d6d2a40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445580, "uuid": "943bb0fa-7bfe-4b28-b83f-177c52e6e926", "comment": "Malware payload (RedLineStealer)", "value": "0f434a0b408ebceda6c6964186e2427c1a0f5b160e213c1ae89c45ae9dd3ff32bba1527c9cc7d95ee44c0cc49337f0a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445580, "uuid": "ced77054-4d39-4416-83d8-59d8f429b87e", "value": "T11B05231677E88133EDF52BB064FB07D71A353DA1197893E723424A5A2CB26C09972B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445580, "uuid": "dcf732ca-857e-4c69-9b4a-7cbc31b7ddea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445580, "uuid": "a28076ce-29f9-45c7-a74d-f1f19de015e5", "value": "12288:MMrry90eW8U0cWbBG0NA8xdFvDz+BwCP0iIYgJnydFtt88DQVLR5VCV4UPJv:Hyw8JcW40O871um4jfgdqy9uht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692445580, "uuid": "a0c29218-e47a-4694-83bf-191ca4052d7b", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692445580, "uuid": "e4a356ad-0ed2-46a2-93ab-1981c320a5a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445580, "uuid": "885eed86-2b6c-44c7-9bb7-d612cbcce10f", "value": "b3d6aa2dbf077f6f31b0211ea8efdafd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bc297b-3e73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692437775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437775, "uuid": "0b63e7f0-adab-43af-a514-d8aea610eb2b", "comment": "Malware payload (RedLineStealer)", "value": "a184491994d9a886fe008bea77b29db9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437775, "uuid": "79992df6-4080-454a-b34f-f00f643f349f", "comment": "Malware payload (RedLineStealer)", "value": "1b8bf5089ce09c69479f00d6e2c8f380354ce8644c72de1ee06dca3f219d5fdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437775, "uuid": "1a289463-138d-47ee-83bc-5a3516b59d06", "comment": "Malware payload (RedLineStealer)", "value": "4b896d03ad1c1fb70c85c27d828f368fe3defdc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437775, "uuid": "d7444c49-db5c-4034-9a51-02e4fdcfddd2", "comment": "Malware payload (RedLineStealer)", "value": "42f235636089a65405f9f7fa696502f4f8b55c61200d20e9d25ab22e0d130194673f17a8803bbf7d2f0d4c20f3da9bb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437775, "uuid": "9e9a21b3-5840-4005-9476-8126a0ea197a", "value": "T167051292AAD940A3DEF117745CF512830A38BC924D79973E3781696F0EB3280A5753BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437775, "uuid": "270f84bc-8434-4077-b001-92e8ba57e255", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437775, "uuid": "2d4001d4-ebae-492b-b06c-dda1a000849b", "value": "12288:kMrly90I14G5ZM7nT2eYGQEMQKtZl9DzyxHvWjsbiWXNXwr9Dvxc5ydX:JyP5G7nTdYGQESthuWj+NXwhDvxKydX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437775, "uuid": "13cc0425-0236-423c-85fb-d3963a042450", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437775, "uuid": "cf541412-c3f8-4939-a13b-2bd8e3e4f5d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437775, "uuid": "02e7116b-6881-40d7-a9f5-f473d43eb870", "value": "a184491994d9a886fe008bea77b29db9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec4980b-3e50-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692422486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422486, "uuid": "87927d4c-4443-472c-81fb-3772622e3ae0", "comment": "Malware payload (Mirai)", "value": "ecea66655e404dd851b2612d1e95ae39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422486, "uuid": "b30e2e04-3032-4160-8971-1c80ad5167de", "comment": "Malware payload (Mirai)", "value": "1d0140b4e9a83025b2af3af85a5da1ebaf1e7f486bce85687af76360724f3c24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422486, "uuid": "2aec9095-c93d-4a91-9c5b-ed67a0d44a6b", "comment": "Malware payload (Mirai)", "value": "05967fa61835a81ab69a6dab231e77f4b2b2bc5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422486, "uuid": "d7ebc74a-0f52-408b-8cbe-235f3299778e", "comment": "Malware payload (Mirai)", "value": "ac58def90e020da9ae9a08af08ec7167e69ccdb09bdd82d0e23d59f47fe364a5d67f8f5964b022cb34676602330c728e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422486, "uuid": "e4c3143c-9ecb-466d-b487-4dfd38c39600", "value": "T1E7C2D152F1111DDACAF7FC71EAA2FBA4B7B0CA0C71A3E93121193F5038571252A458D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422486, "uuid": "27723f79-4626-4190-8aa1-8c374d3e8c61", "value": "768:IeaVJy2XMVSLSemoWuC9XctINh2dZS4uVcqgw09y:faVJy28+hWvpctfY4u+qgw09y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422486, "uuid": "2404b4f0-f259-42e8-ae12-bd63d4289e7c", "value": 26016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422486, "uuid": "88d61921-7ec8-4ca3-b448-55b5bf921359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422486, "uuid": "4dec53ab-92dd-4ecc-973c-3b5dc44c5cbc", "value": "ecea66655e404dd851b2612d1e95ae39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120657d1-3ed5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692479534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479534, "uuid": "3279b6fe-0d9f-497b-bfa3-9e7f87bc463a", "comment": "Malware payload", "value": "cb2c2c19a98fd1a5097fb7d23157e4e4", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479534, "uuid": "1ce313f3-6dcb-4451-be89-df07022a32f4", "comment": "Malware payload", "value": "1d6b30eff3edd95e36b8b2b7be0da4cc571a8d36ad88a727e150fdb6a342e20c", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479534, "uuid": "3fb31de2-fd38-4528-89f7-8ff31440ddbe", "comment": "Malware payload", "value": "e79a36dd0817843f2d5455b8389caac18241c8de", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479534, "uuid": "50a0027b-a416-4a8a-9e04-94fc82873748", "comment": "Malware payload", "value": "0db34b29e9d1457a9d89ff89f620904b1922a0f70b9f3efdbb3e3a60e02a23f336782e387e9bdf369841adbeb9f0b7f7", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479534, "uuid": "919c677e-643d-4920-bd1b-4ecba095b9b9", "value": "T1FE16236A3F5987EE54D2F5149A72E81C6A713F7E8A1CF1DAB3D21BCF46C8905B802470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479534, "uuid": "d2ac7f96-b3d5-4c13-bfaf-41971ecc6bac", "value": "98304:YSnsh2RnwamWroXvnkcD1tTWkYIbggxVO6/w/RoY1jTrFR:YAK18roXvNHvbBVj0LFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692479534, "uuid": "8a0e9f61-a814-461b-a96c-31d4684c5e64", "value": 4192279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692479534, "uuid": "75b9814d-d735-42da-b72d-a5685a5bb140", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479534, "uuid": "150eb116-2925-44e7-923f-840156368903", "value": "Eulen_gen_private.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcc2e6d-3ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692469837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469837, "uuid": "ded365d3-a2ef-45e9-9321-fba4d6296d63", "comment": "Malware payload (Mirai)", "value": "601956cd7173c3d7379e1f09c075b2ec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469837, "uuid": "5bedab0b-2e1c-455c-8505-784c8dae81b1", "comment": "Malware payload (Mirai)", "value": "1d824a361cdd0863009a27c2db5aeef63edcc72e36c758ffb0c10c83c136d19c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469837, "uuid": "50c6eb24-906b-4ea1-9017-9378e22049fa", "comment": "Malware payload (Mirai)", "value": "a38aa797152e90ae964de5f7cb86a376257247e8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469837, "uuid": "948ebc58-2342-4fee-aa64-41a9a8d59551", "comment": "Malware payload (Mirai)", "value": "e49da93deeb1f20014a52c04f01f85a01a38c51fa72cbabe54263995f09d2f3a862868a1290c6936dbbcd2a06f1914d6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469837, "uuid": "a702876d-e616-4f71-8d74-221eb2ce3968", "value": "T1D2C32945FC508B27C6C252B7FB4E428D7B2A1758D2EE72039D256F61378B86B0E3B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469837, "uuid": "98e5b297-56fe-4410-8deb-492e621fb82f", "value": "1536:4hEOKD5da4A0F0AC7M4VeWJ/TZN8KCJ2hbk8nBBOlb2iwyweFnp8j4w3tglcKbO6:4hildF0y41llN8KCLqBb9xx3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692469837, "uuid": "29f1322c-cb2c-4fe5-9aef-a02b81767564", "value": 121600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692469837, "uuid": "c2455ab0-6aac-4c54-9009-28adc97080f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469837, "uuid": "d369e513-d370-40c6-97a6-5f270cf296e5", "value": "cundi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1ee419-3e5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692428282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428282, "uuid": "de5e1cdd-44dd-4b68-baa8-3b8da5f9dd7a", "comment": "Malware payload (Mirai)", "value": "015775947e856f04782451cdf039bde6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428282, "uuid": "47c33dcf-9912-425f-8c24-3021089d733b", "comment": "Malware payload (Mirai)", "value": "1dcb50bebd55a96982ac4622c43ba8c2a6820f39073b0d5d46fbebf6b465fb5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428282, "uuid": "ca4b53e8-49ca-48a9-97f8-d6eec1f5f883", "comment": "Malware payload (Mirai)", "value": "b043b04c89343d63a742fcde6e6c446add2f80df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428282, "uuid": "58ced676-138a-4de8-82c7-5399f3bb16b3", "comment": "Malware payload (Mirai)", "value": "f5a7a012925e4a1e2071094e4d1df8647cdcb7a9e0f77c1a76dc03959e79198078fda06a01200f71e97e643d8aed6224", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428282, "uuid": "dcc040db-8254-4631-af8b-1afcff657e0d", "value": "T144533B99F4029E3DF88FE9BA84160E05B93023D212931B2767ABFDE37D321659D12D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428282, "uuid": "403e3a0c-f48e-42fa-9bd9-f52271ebf687", "value": "768:me4gpsM204GEkRbj3eXf/nQi122EQtBa3gFHn1eu48B8vB6J7EzNfXQuJpoz4y3+:mo3EkRbrQoizRFn1X48B2SEzNfAuJAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692428282, "uuid": "be794436-a401-45d9-a684-272dc67c183a", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692428282, "uuid": "be2a779a-e7b9-475a-84c8-0be9ac15c6ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428282, "uuid": "840bbc2b-74c0-4f46-8a7e-25aa90cc2152", "value": "015775947e856f04782451cdf039bde6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fafff2-3e61-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692430070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692430070, "uuid": "e7800b94-4a2a-403d-9512-dd4e3dcb5a0f", "comment": "Malware payload", "value": "f34f28ee7729235e6a0185270e46ed87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692430070, "uuid": "d6019220-d528-400d-86ea-c65e48057daf", "comment": "Malware payload", "value": "203682e7932027a8f56a1810ddc98632853d73070a0afa28f608dc50813a0180", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692430070, "uuid": "993546c4-f3bc-4d0e-998e-7f6b7c2bd22e", "comment": "Malware payload", "value": "39eebddf3a56eeba45397a8cafb35dc722130b5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692430070, "uuid": "bbaba666-f6af-49f0-a9a0-b8b3b2c19929", "comment": "Malware payload", "value": "b2e5a99a3881d0c8cb4005be226ecc8dcac5a17ae3e9e7b9e17e07615de58c35db165de5379552d134467efa19ad2de8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692430070, "uuid": "ed160a35-7df0-4478-9ca0-00fc49f93348", "value": "T1A6C2F2E013532646D752CEB93969341EC42C715732AA1D802CD1A58FEE1FB2458BAEFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692430070, "uuid": "87dff7ac-5779-463b-969e-953cb3b622dc", "value": "384:yb2eX3zAKuiNPZRwwqdvrrduMXbCAk6Y5VvCYxy0kJXPav63BNjbI:/kAKuobq1rduMGAXSEYEYv6DjbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692430070, "uuid": "e1fb45b8-7263-4da2-845d-bd4c4eee8cb6", "value": 27600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692430070, "uuid": "f824c4dc-4ad7-487a-99a8-88f3abfaba2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692430070, "uuid": "9e98d3b2-5f24-4d36-add4-066fac01a982", "value": "SecuriteInfo.com.Linux.Mirai.6522.2470.31265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d56bb0-3e5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692428269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428269, "uuid": "07fbd874-6737-474d-8a96-f03a4e77f389", "comment": "Malware payload (Mirai)", "value": "0fc1bf64eacab2f57ba17759ce864345", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428269, "uuid": "bc8217e7-faa3-4604-8824-233d7a570e0f", "comment": "Malware payload (Mirai)", "value": "218ad3959a1f921ba061ab11528f8f198ecbccc0415d3719b20c9c6235f5ad01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428269, "uuid": "4b9d79e6-4caf-42a7-a5f2-96d885039ebb", "comment": "Malware payload (Mirai)", "value": "39ae1733630c97c9cae9fa88e8097542eb680069", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428269, "uuid": "1537ec16-a0d5-49e4-b49f-4ac83c7dead2", "comment": "Malware payload (Mirai)", "value": "3249394a5aaa3dd85fab20f720dc118e8e53748e071807dad687b5c801cfcc6ed2eb220ef7dd1180bc8de0056c5c4b26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428269, "uuid": "e005b734-c7cb-4c4d-a6a9-69a579dbee99", "value": "T10EE2F1E242E0ED6CC7B059769C7BC81B0F0967FC9AFB27561AA8379868E14440B37257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428269, "uuid": "9a3a0552-db94-4453-91cd-f0c2cbb35ceb", "value": "768:g8Lm6CTaRKzL4UlL9k0nnLywGEkEsO9q3UELd/:dLJCTagzL4SlnL+Ed0L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692428269, "uuid": "2ae4a3e2-1cb4-4902-adc2-11ebf10aaf91", "value": 31864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692428269, "uuid": "f6f7d3c5-42af-4851-9760-6a600821c3f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428269, "uuid": "be5fdcc5-9d5c-4168-bf5f-93925af509ce", "value": "0fc1bf64eacab2f57ba17759ce864345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42f7b41-3e38-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1692412429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692412429, "uuid": "bde28ec1-31da-4a84-b778-4096e1b593b1", "comment": "Malware payload (Cobalt Strike)", "value": "3cc16a429904016796a03923315cdb50", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692412429, "uuid": "43b74317-ba73-4e68-8db9-dcb19353b236", "comment": "Malware payload (Cobalt Strike)", "value": "220f6b9f96106f637b339e2c6aee7259e76a9fd8a7237bc69ca7c1412bb8f992", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692412429, "uuid": "99abb3a7-299a-4022-b6ba-a0382c4de0eb", "comment": "Malware payload (Cobalt Strike)", "value": "32ceddf549c30161214d09ee1297b7a557be701c", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692412429, "uuid": "17e3649f-3df6-49a5-af3a-a941422fec43", "comment": "Malware payload (Cobalt Strike)", "value": "878c544dcf7ff7340e1d581e320b0a9b7489c33ca783f80d4d35f7510ec68cee398975558d348e7216652beba185e401", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692412429, "uuid": "2f610408-0c65-410a-b5b6-fc6efabe9fd6", "value": "T14684BF77865AC139C39FC0B67FE6C9BAA536F0E216A0741242B01B367AB7DF015993C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692412429, "uuid": "7beb7325-a808-43c9-a260-02fc8cd35696", "value": "d217b70ac26fdee6627e4030390fd9f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692412429, "uuid": "87f3c89c-fc35-4a23-8ab2-66e651af1504", "value": "6144:wa2jyqh7PHHbdsV8G4anH0+4/8GBV+L8c1HI1GgvAvzhxuRzx2NUSH:wa2jyqNHRs3vU+4UKbc1HIc8MzTOENU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692412429, "uuid": "2c5eb278-9a23-415a-b374-f7be69200154", "value": 381728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692412429, "uuid": "9dea2c0d-06ca-49fd-8514-ecc099f97032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692412429, "uuid": "d9124c78-b176-47cd-be79-581d980befa5", "value": "huorong.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4060bc8f-3e75-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692438380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438380, "uuid": "46177b8a-8268-48e8-b5e0-0fe4fe35ebc3", "comment": "Malware payload (RedLineStealer)", "value": "9d3e02c20e3095ab5241f2a56822fccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438380, "uuid": "2bdc42ac-1590-4791-b27d-895925a9eba1", "comment": "Malware payload (RedLineStealer)", "value": "24cacc7423d42f0f6df8ca4ff0ee8735ea426cb5cb907be064a5447090a95c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438380, "uuid": "a3d7ef8f-e641-4fd1-988e-b004b68bddbf", "comment": "Malware payload (RedLineStealer)", "value": "ee88e3831580a9a564a0de6a8c473032585fa68f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438380, "uuid": "b49578fc-5566-4497-b6ba-904998f5ade3", "comment": "Malware payload (RedLineStealer)", "value": "bb0b2b11655ad066457b6a5698182cbc46ca61a191a9168fc2c5424bff364e934e6ff7b6cc520406b61620e72df0e975", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438380, "uuid": "dab174b4-1f91-42f3-807b-0c1f654f827e", "value": "T16605238BD7E84073D9B82B7055F612930A327CB28DB9935B37459C1E14726DAE87233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438380, "uuid": "658b59cf-60b7-4f30-a76b-001cec0dca3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438380, "uuid": "22a16d68-65cb-4d23-ab2b-1519cbd18d12", "value": "12288:RMrjy90OfxEHpW/h1/+hhFPElOSkIfPU356k7R3ybBzpJ8q7P+DspygZLYaB:yyTEHw56nmkIfPU3gRZlKDsp3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692438380, "uuid": "935a2a7f-bbbe-45f6-aa2b-3206f13093e3", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692438380, "uuid": "ffc2ff47-a4df-464c-94e5-dfa36d5abd57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438380, "uuid": "3027b731-703e-478c-b366-ae763bfd10dc", "value": "24cacc7423d42f0f6df8ca4ff0ee8735ea426cb5cb907.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ead5e1d-3ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692469838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469838, "uuid": "7887fc52-eb0a-421d-a035-1164ff3ab4c1", "comment": "Malware payload (Mirai)", "value": "fce3e1f3c7792f26753f3020dc60a05d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469838, "uuid": "562eda32-b92d-40aa-a7b2-0ec37cf4cc93", "comment": "Malware payload (Mirai)", "value": "258d73ae3008fda720aa456ff05e3a7d45f453ebbba613fd64cbd30a089c658b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469838, "uuid": "a3531649-bb2f-4c10-8548-495faa1e0d92", "comment": "Malware payload (Mirai)", "value": "efaabfd4a6d4542578affdf7313461f5ddfab5c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469838, "uuid": "dc6dc16b-8fe1-4cc9-ab29-96635a1c30dc", "comment": "Malware payload (Mirai)", "value": "0de63044b64af626a9635f347d2721ff90f5089fae9fb0a1438f812e5787cdda08edcb5027759e44c60c5f8edd909b09", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469838, "uuid": "8c07af5c-fca0-4972-85c4-19095998edc8", "value": "T177F3A91E6F338F6EF668873147B74925975923DA22E1D684E2ACC1105F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469838, "uuid": "1ac2586c-9fb4-499d-a212-282aa0e4f664", "value": "1536:9MHVOCdq9edSAZTZtZdNKGd7sUeN8IlPBjmTfNYoDFQT7Gv+qQK:9MYCThZtvNK+7sR8IfMYo5QTKv+qQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692469838, "uuid": "b29e64d2-7e6f-4447-97b9-0e7a78be3104", "value": 161416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692469838, "uuid": "2f939f1b-1ee7-4b43-a337-ffc98b6b50fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469838, "uuid": "509fcf26-55f7-458d-b685-db2b688eb7bb", "value": "cundi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d744d00-3e97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692453005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692453005, "uuid": "76c61c03-f52c-4f55-9487-005a6cbe0465", "comment": "Malware payload (Mirai)", "value": "9ff0cd11b2acfdf164fdb2234d3893f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692453005, "uuid": "e3c90de2-e6cf-48ff-9e23-ee165e15ae4c", "comment": "Malware payload (Mirai)", "value": "25d3cbf95d3633266d70a8a3fb9d7d71de7a0c13c5ee565fdf41140283a3e7e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692453005, "uuid": "0fc06310-9c4c-435b-b9a2-f1ed58354fc9", "comment": "Malware payload (Mirai)", "value": "db04d4c2171be268ad1e93f27affffbae4ab10a8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692453005, "uuid": "6f36a008-7464-4050-bd7b-3e8c2d3929e6", "comment": "Malware payload (Mirai)", "value": "dba522c7fce1bbd9a07c87aa4f0b6293a33bc8c919088c1a1ce556ac5369e51162ea3e4ad55817d524d229b11a268f70", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692453005, "uuid": "40492ad9-8fcc-4b63-83ce-7c3acca9912f", "value": "T1AB230261880E8EB125303C76DAD5D79376F12AB2C6673013D6290E3C2FB97531E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692453005, "uuid": "a4ab284b-52e9-4d5b-9e86-d4346d593e21", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b39p9q3UELbUXfi6nVMQHI4vcGpvP:DECFd+A6YHAxmLRQZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692453005, "uuid": "bd9ba06b-6099-4a05-9e98-8fdd67a697ca", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692453005, "uuid": "924ba187-1f1b-4e7c-9338-abb3867abedb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692453005, "uuid": "e9e243f4-a90b-4b43-a3ca-a692533a4ce7", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d4226b-3e3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692413375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413375, "uuid": "a724398e-737e-4a4d-8512-d238ff051cd0", "comment": "Malware payload (Mirai)", "value": "1c479709956625a6b990f7f7d140e695", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413375, "uuid": "1d48285d-c928-43a8-a9e5-762d08f42b69", "comment": "Malware payload (Mirai)", "value": "263effad07ab0bd967bd976f99ea1a911f6eb190a03d846eb2d6ae27627c4700", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413375, "uuid": "0043b4c7-7a59-4557-8b56-97aacc4ba197", "comment": "Malware payload (Mirai)", "value": "012760c9d4602e5f1120cc5f8a1673ec0e0558c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413375, "uuid": "79844eeb-3972-4c7e-bb2f-6524f2ac5049", "comment": "Malware payload (Mirai)", "value": "1132d9d834fa5bce60bc64617fc57f48e5ab780844f4cd7588a6c7f533154f7ca1e196c51b80d11420f4a27c2c105663", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413375, "uuid": "4760bc44-7194-4127-bf05-7e976d8bcf86", "value": "T143C2D03096ED1CB1C7540672F7B866C6BE530FBDE6FA2890114047BA3C81D4A69ED9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413375, "uuid": "9eec8262-054e-4264-be92-37d146787d91", "value": "384:A/t/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE8QG9aJhymdGUop5h5:AFsoTAZ3alkXLvFh8nNE8QGYs3UozP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692413375, "uuid": "3a9f6d07-0c04-4473-8ab4-af2cfce45e0f", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692413375, "uuid": "d164492d-89d7-44e9-9dac-dd197e58de52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413375, "uuid": "7b1098d4-5599-4d5c-870b-1532b65e2232", "value": "1c479709956625a6b990f7f7d140e695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad6aee8-3e73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692437780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437780, "uuid": "b16cfd6a-7ddf-4cb4-9b0c-9c67a881e8ae", "comment": "Malware payload (RedLineStealer)", "value": "0ca25289b15e865c39d76f5bd85956e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437780, "uuid": "20afc41f-fc6f-4f84-9796-4b0ca40495b4", "comment": "Malware payload (RedLineStealer)", "value": "266a10f0d5adc12157cbae20174e4de7204040f3635e19e79a8a84145b482049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437780, "uuid": "8afdebc5-b474-44a2-806a-7c50d75672d9", "comment": "Malware payload (RedLineStealer)", "value": "bcd0af5ea1c115c74e4aa7128d736e32fbf5c37d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437780, "uuid": "64c41644-d677-4fd3-989e-294e738e6cf8", "comment": "Malware payload (RedLineStealer)", "value": "1f974c7a22600b736aae98bd5133b048b4ede3bd7c5e3743b6ae2066ee08c9ff6d87fefc780b1b4e1362271af3a37e0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437780, "uuid": "14be0f57-99cf-453f-b50e-280e1a3bf8c5", "value": "T121052293E6EC9062ECF957742CF617E71B30BCA4A870639A6712AC1B5CA3108E535377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437780, "uuid": "2fdd38b0-4e8c-4c11-a916-5e46a8a9a752", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437780, "uuid": "f3168f5b-3d03-474f-9e37-04445afd434f", "value": "24576:Gy19cOf6dB1dmqiDo9iUTyI6AOjmWnM7:V19cJ7AqiMIH9tjm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437780, "uuid": "587ffa45-983f-4e96-9dcb-571053b7e583", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437780, "uuid": "0b94c218-6c8f-4233-a53c-a026deb13f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437780, "uuid": "ccc0b4c3-7b27-4c68-ab26-3bf3bf279915", "value": "0ca25289b15e865c39d76f5bd85956e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbe3801-3e71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692436871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692436871, "uuid": "2843acfd-d70e-4ca8-a553-8ca7346c565c", "comment": "Malware payload (RedLineStealer)", "value": "75bef14f14930d7f5638ac7a6638e7ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692436871, "uuid": "de2f9cb1-5dec-4696-b869-839b2d63b152", "comment": "Malware payload (RedLineStealer)", "value": "27b81615ae48be70fd70e2b8318aac210637f2b4e43c427b60044788a9918932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692436871, "uuid": "8596398b-2d71-498e-a54c-3d452f4dd03f", "comment": "Malware payload (RedLineStealer)", "value": "51fc8ad634ec3646570d43e667620bead9596067", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692436871, "uuid": "42d05085-88e1-47b0-83d9-777694c477cd", "comment": "Malware payload (RedLineStealer)", "value": "c1f82b87d92ee795f437b64443cbee3956943886ca2ade8ca5b024db20132c342a9d9c0295fa9a0584397b507c160283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692436871, "uuid": "5f9d2ee2-0364-4aee-a361-9cdd37e8f3c0", "value": "T109252245A2EC867BCAF023B529F313970A71BDAA5C39E75B13906D0E5C73944A93132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692436871, "uuid": "d239abe1-1a02-4277-a75d-b55b5b138ca8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692436871, "uuid": "96ebbb28-a5c4-4b3f-9d6d-ea270ea2be66", "value": "24576:1y7YsEGi0s4gFmYZua0murkf7mIylOFYW73KyrqkS:QEsa0vgQYJkI4OFYsjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692436871, "uuid": "8d0fddfe-0226-4870-8b59-66f816bc8253", "value": 978432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692436871, "uuid": "5d061b64-cc82-45a8-a9b0-98d75f4e9094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692436871, "uuid": "19069724-1ce8-4d78-8679-deae4a5d0e39", "value": "75bef14f14930d7f5638ac7a6638e7ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de0f3ca-3e72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692437168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437168, "uuid": "3459b9ea-3e2e-42b1-ae35-84e83e54cefd", "comment": "Malware payload (RedLineStealer)", "value": "4e1ca4c3e41e4fbf354d0dd742f1429e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437168, "uuid": "64d2e04a-e85f-4e61-a729-9f0f19f62bf4", "comment": "Malware payload (RedLineStealer)", "value": "2a90756de8cd9c4efb2118621a6c9c94851d518b4bca29b9d0e961a4ca1157fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437168, "uuid": "0877283f-8897-4db3-930a-3fd1c53c8aa1", "comment": "Malware payload (RedLineStealer)", "value": "b3b8b264a57c00e82f1fc0023ee86423d3306fd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437168, "uuid": "c276f3a9-4852-4f07-9920-780f5514abd7", "comment": "Malware payload (RedLineStealer)", "value": "16743cad6919cad69bd232e1e1c390585bf5c78b76cafec25fac4536898f4ed00bca15d5c76ec2b8fdd49aff4ba0763f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437168, "uuid": "4c291d85-b5f1-46fc-8496-c219456a04cd", "value": "T1A3051207E3F84066DEB5177018F613932F36BCA249A9972A63861D4D0D72D88E47673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437168, "uuid": "78540f5c-2c6f-429b-936f-32b7ae341d77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437168, "uuid": "97617f50-e791-492d-b409-c5e7f9938c3c", "value": "24576:9yjMfjvD4MNGf9PVH/K6ct1myg9WzeMoXQ:YjM7vD4MNG3ncmQzeMoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437168, "uuid": "ca4e7a87-842a-4544-ba6d-852f42ad869c", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437168, "uuid": "adc7ae83-32de-40fe-b414-83ae2c7644ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437168, "uuid": "b1e6160c-d4a9-4cc0-9fda-8a895d2e8829", "value": "4e1ca4c3e41e4fbf354d0dd742f1429e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8076b75-3e81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692443789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443789, "uuid": "b54f518f-297a-471c-9fee-af1a7c3ecce5", "comment": "Malware payload (RedLineStealer)", "value": "1c76706643695bfd003d768b2c14f925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443789, "uuid": "b3e1db29-2eac-4891-bb3e-21c4d797ad55", "comment": "Malware payload (RedLineStealer)", "value": "2d3677816bdf79a83288fae8cecfdc95691d36a931a8cd66646d6391f3faddb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443789, "uuid": "886d337b-2810-44b7-8424-1d1bdc0e8bcd", "comment": "Malware payload (RedLineStealer)", "value": "6e232285359a0c65e6c3ae09691d712aaf64adc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443789, "uuid": "2b5caf2d-1685-4a21-b8a1-683e1bbc3609", "comment": "Malware payload (RedLineStealer)", "value": "44049a003cc4b19f08ef58aa686c6b620a63ca614bad20c7d30954735ce8fdc3ceb9f260709cc1da3a5f676ff9d560ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443789, "uuid": "ed74f238-4a9f-4285-bf60-57feb832e060", "value": "T1039539D03E4B0EA2FFD92331409614169ED7FAE313F3E61F2F59159A331168A889DD29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443789, "uuid": "fe6a7d00-860c-45eb-84b3-18977d0b2345", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443789, "uuid": "5bc1b648-ee37-4af3-8c7d-1d822914a030", "value": "49152:1D1YiIKBrxg/CSLu2G17SaeJb6KW97qaeVOmdXvQxYBDat/zfDuL/4CsD3BOn/Nu:d1YiIKB/Tklkmow/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692443789, "uuid": "5c2a010e-3c78-4281-a95a-3d5d68742ee5", "value": 1884160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692443789, "uuid": "1cdfc761-a2a7-44d8-a845-e54e73bb765b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443789, "uuid": "219d5b9f-e3f5-4385-94bd-027e4ac9333f", "value": "2d3677816bdf79a83288fae8cecfdc95691d36a931a8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bef46b9-3e44-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692417354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417354, "uuid": "be60727f-b388-47b6-99c1-3beaf5fa952b", "comment": "Malware payload (RedLineStealer)", "value": "4b2dced642f0f09f5b24068dd5650edf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417354, "uuid": "a470df19-76a7-4002-8c54-b5a4138f23c6", "comment": "Malware payload (RedLineStealer)", "value": "2f585b8e45d9bda9766146061c3591aba5009942a83cf657c61e393e22656885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417354, "uuid": "9a9ed82d-79e4-4402-ae80-2b2dca180dc8", "comment": "Malware payload (RedLineStealer)", "value": "749597ebb62d40d0358c09ba3eebb8bda4a10ae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417354, "uuid": "ad89e485-37ca-4442-a797-9467720d2588", "comment": "Malware payload (RedLineStealer)", "value": "2e2040d0c818b9c545413194c9de59bfc9283678b37b59d57725bfa09d06f337533e89fcf9612465c4641a07d89fdb92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417354, "uuid": "ba9da54f-ff83-4515-8188-d7b131676c80", "value": "T1F5F4125297EC8072CDF127B058F613D30F3ABD6099388727279668194DB3AD5A87173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417354, "uuid": "2646a464-47af-4274-9bb6-24a3d8e53700", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417354, "uuid": "910a9bed-1f7d-4870-a7f1-e82e536cc80a", "value": "12288:pMrJy90XEHkIGh7RGl0VNbixaO7PwK/ke7gaIKRNEXvp7f8Bqwso8/8LXtsQ:sy8EuBNCJoAj7gRKvExl9/IXCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692417354, "uuid": "706fc60f-9abc-4425-9ee8-2963bce78498", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692417354, "uuid": "1dbb1c0e-4fbf-4323-8051-73e6859685b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417354, "uuid": "4e92f407-44b7-4bc8-9044-68efb53bbaf0", "value": "4b2dced642f0f09f5b24068dd5650edf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2980c6f-3e44-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692417607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417607, "uuid": "93a04504-ed5a-4f53-8473-6dd7d1fea115", "comment": "Malware payload (Mirai)", "value": "4f5558162d0d7a1014f3c5e141a3dce4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417607, "uuid": "e4713996-027b-4cec-ac6f-66cca5211487", "comment": "Malware payload (Mirai)", "value": "30fbe42430d74a7c3312001db0b95d26b08863694b741dbe1dc3ac0b69159db1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417607, "uuid": "a7daaa71-de1a-4bd5-a14d-6b6bb47093b0", "comment": "Malware payload (Mirai)", "value": "4ffeb651299dfbf542942a2fdc315db00c13b9d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417607, "uuid": "a69d0d93-3365-49d1-8f14-f54aef578f7e", "comment": "Malware payload (Mirai)", "value": "e1fca56aca81d920b8715ee725368043c23e4c66b01abd602eb842e93bb57cce4deb02aba90315c67674bd49ce033be1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417607, "uuid": "7c80a867-772f-4cc0-a23e-4b720a71d724", "value": "T1F3C2E176045BEC5083610D31FA2DC001AF7A367841E772FD193C973855CB4A9ADFA9CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417607, "uuid": "14f05e69-d96d-49f6-a928-34e42bfc6fdc", "value": "768:yRkLQtsN1OpBlKZuMWpXgPfZ8LZV8wVLVxs3Uoz/X:WkEtuuJgPfqZWwBVczP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692417607, "uuid": "5b435d1c-0014-4c90-ac5b-1709d3a2fd8a", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692417607, "uuid": "a68c6b23-6c54-4920-acd5-24bf725dcf93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417607, "uuid": "7bd4b0d5-e1ef-479d-b3d9-5950ff6533a5", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70ee790-3e5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692428245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428245, "uuid": "0a4673e3-e2db-4cc5-84cd-50be6614fcee", "comment": "Malware payload (Mirai)", "value": "c8ddcf99c91c84e109fdc856ae51a94f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428245, "uuid": "34fdbe67-f2f7-4757-b000-ee38c506ed49", "comment": "Malware payload (Mirai)", "value": "338c90961e952a1d6393af569df5d61ae1ccd0e847400fcd8519e9521d533378", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428245, "uuid": "89f12852-8ccb-4864-abf9-1243f47903ef", "comment": "Malware payload (Mirai)", "value": "030e270032321834b2c0e90ecbc64baf8535fe3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428245, "uuid": "99bfcffe-539a-4c60-a4ce-3d60898d5e54", "comment": "Malware payload (Mirai)", "value": "30c0ec670f6341801fc1a0f2fbf021aa4b5cedf066d8797d1e7167e40d24d41df0c0b20cfc9478334e612f3bb89ae89e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428245, "uuid": "4061cb5a-1fe3-465c-af76-e27dc990a727", "value": "T186C2D020D9488DF4EFFD5A788E25CAD577953F9D1AA1CFA0D0C9DF2008223662F5C698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428245, "uuid": "3cf3d328-401b-4779-b35a-301865ef68e6", "value": "768:5KnqLiChP7gehg2alcZjn3LW6vq8/CxHbI4uVcqgw09J:5KqL1hq2alUjy6y8/CxHbI4u+qgw09J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692428245, "uuid": "c704eb30-00c0-477f-a045-0e4ce3478b55", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692428245, "uuid": "1c996d88-6b7c-43c3-a7b8-a33668c41e10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428245, "uuid": "f84b2ab5-31bc-49a5-a376-2dc9e56a8b31", "value": "c8ddcf99c91c84e109fdc856ae51a94f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82446698-3ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692469844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469844, "uuid": "e362396d-b65f-4375-ac58-4f16ac4b5161", "comment": "Malware payload (Mirai)", "value": "32c28e1c30d189e8ca4ef037993f3421", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469844, "uuid": "712acc2b-0c0f-4e4b-a0ae-6e646c5c6832", "comment": "Malware payload (Mirai)", "value": "345b45867161db1009d07c58a615aa78cd076c8883813241f6e3886b1820cf79", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469844, "uuid": "0f0d130d-6f0a-4471-8ccb-6124f13510d2", "comment": "Malware payload (Mirai)", "value": "8190c68e5df45c6964dcec19c862b1c4a1070b27", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469844, "uuid": "65f9dfe5-1707-4900-8468-6eb735ac48ef", "comment": "Malware payload (Mirai)", "value": "6eb3b02cabc9cb52b8a9d12523bcc285c83f3cee0bd654aaba92030223150b039de005667f1f8fed4077916d6a2be96c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469844, "uuid": "59754e75-d438-4ebc-8280-ee26f9ba10ba", "value": "T165D3291775D1D4FDC8E9D5B44F9AA13AEA72B02C1238B16B27C4AE272E4EE305F1D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469844, "uuid": "ffdc8341-2af4-48c5-8b53-b4702aec22ff", "value": "3072:PntXfNc6wQ4McuaogvXpmQ3xZJMcm3AK:PntXcpXZ/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692469844, "uuid": "2994d655-52ea-48f5-a039-5976d95fd87e", "value": 131384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692469844, "uuid": "1329a774-a048-4051-8a89-1bc75376df00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469844, "uuid": "c7eecce1-d1c0-4237-83fc-1bfe65ff8a1e", "value": "cundi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2079f59c-3e39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692412557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692412557, "uuid": "ef20c668-8a9f-440d-abf1-ed6860690313", "comment": "Malware payload (njrat)", "value": "1ead7491653af26553b4ef5b98927b4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692412557, "uuid": "8d64c378-b763-4291-b6b9-643acd1991fd", "comment": "Malware payload (njrat)", "value": "3510b8077be532163ad76a93b6043e8490893df56123a36804c2dd856a8d385c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692412557, "uuid": "07c08906-5378-4e6f-a25e-f0d6221c6325", "comment": "Malware payload (njrat)", "value": "fa6bc1ae12de623bda6e751cd2da66c8f69a70ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692412557, "uuid": "3c808c4b-af7a-494a-9408-e58282468480", "comment": "Malware payload (njrat)", "value": "15ca3a65ff5bd2c4deee67a8295bdb27e14454e4d1d0502a2bbceab52fdfb419508110b7d442d4a494e728ddb992776c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692412557, "uuid": "f3e66f85-ec8f-4636-8c33-f10888933006", "value": "T172E21A467BB54216C6BC1AFC8CB313114772E3838472EB6F5CDC48CA4BA76E04645EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692412557, "uuid": "28e44cdd-7287-4b13-afc5-44b0273bddf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692412557, "uuid": "dd6a5e27-08c4-438e-bed9-99eef6452cdc", "value": "384:L0bUe5XB4e0X7OxBIQgYbr9pLWTUtTUFQqz9+Obby:oT9BuCPIQVbJ/cby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692412557, "uuid": "32d8ca2f-2973-45a3-917e-3584ef8f9937", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692412557, "uuid": "1e5d0235-537c-4ce0-a796-b9a0a9b43330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692412557, "uuid": "60c3f014-8e41-4811-b25d-d6cbbbaac458", "value": "1ead7491653af26553b4ef5b98927b4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5981480-3ec6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692473473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692473473, "uuid": "4fbe0999-013d-41c5-94d1-e2242777389d", "comment": "Malware payload (Mirai)", "value": "8365604e3185575bd5601003ba8e1382", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692473473, "uuid": "1d872532-9d90-4cf7-ac76-5c454ab7f2a4", "comment": "Malware payload (Mirai)", "value": "3676a05ae72cc5fcd9a5f30e6906ac9fec905738698509bf8b35da4c49dd4f9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692473473, "uuid": "2a563b21-9dc5-4976-be00-f1db99949d28", "comment": "Malware payload (Mirai)", "value": "6ca2487ef1016f8db97ce11b3c857d1259f4ebd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692473473, "uuid": "21929bd6-a36f-4b1c-a58d-8caf877ea835", "comment": "Malware payload (Mirai)", "value": "2a09acd478ead9ff3f0a68da7949e3023ec48c84e24823d516465da11e53d437bcc23cfe45770f2700dc5a5ec9177004", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692473473, "uuid": "89a1877c-8b1e-468a-9dcd-bc7115ad6c7e", "value": "T1DAC32A05B30C0947D2633EF43B3B27E1D3EF9A8121E4F644255FAA8A92B1E325546DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692473473, "uuid": "b8146096-d059-45a8-bb6d-2f87ab800e03", "value": "1536:cM/ayHD4H3wccxpZvT1N6SGLp1igI/dbMVhvArIG+tWDP8XqQfNkS3/Rg6:qLgccxH71Z6igIFbMIrlrS3/RJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692473473, "uuid": "745724ab-ae6c-44a9-8211-a9757da22c03", "value": 121720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692473473, "uuid": "3f812f37-dcf1-48b8-b546-293a41fdf774", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692473473, "uuid": "a781b0c2-3733-488a-9abe-b72ea03cc875", "value": "8365604e3185575bd5601003ba8e1382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a128cd-3ee5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692486682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486682, "uuid": "536c50c4-259b-4b08-9cf5-c3acde175ead", "comment": "Malware payload", "value": "8b0909661c0bc5e93ac4404879901b9e", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486682, "uuid": "a79e8be8-5c8f-4fac-97a4-54a31475934b", "comment": "Malware payload", "value": "38669dd5ccced3c29f3eb6bad7a04fbdc2cc81ea6f7c76b03cf1c4fee6c5f3f0", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486682, "uuid": "13c2fa1a-de62-49c6-af7a-7aa447b3ca53", "comment": "Malware payload", "value": "966433ae87c6110d7eb828cf2f02e80e600f4331", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486682, "uuid": "67019a81-ec08-4bde-804f-431f02e0a808", "comment": "Malware payload", "value": "41ab8e60b5ed93a195f3c2dfe2a11338b175818faac6c73c6ed340133f858e39f79d2f60a5fec9ad8b40563b1c29fb82", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692486682, "uuid": "c0915fad-1c23-4070-8768-d4107254cf89", "value": "T17445DB34397A7C2443DBDA1334F14B961CE9164FD1703A3B299AD8239A356C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692486682, "uuid": "28a8daee-635e-4f3a-8088-c9f6a7c24133", "value": "3072:76/FuxrATOYDTFWqTn7wlrl4y8tiwrs/L3S5F7+I8:76/FuCCYDZFTn7wl5J8M2AL3S5Fj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692486682, "uuid": "05750fc0-6595-4fc9-8046-c6c112480564", "value": 1251040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692486682, "uuid": "517687cb-d3f3-49d5-acc5-39da8d14050b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692486682, "uuid": "058159cf-57df-4e5e-b2e9-608af28fa7c5", "value": "careabout.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf65974-3e5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692426966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426966, "uuid": "af901189-84ec-459a-b2ec-2608e5d2ca14", "comment": "Malware payload (Amadey)", "value": "a5be1fddb167e40e5bc924a6f2d52d6d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426966, "uuid": "842b544f-393f-4033-84d1-dae51b742d0f", "comment": "Malware payload (Amadey)", "value": "39974f6796095f842c2a6f254aaa50447c9dea3c16ccb24c7fc86afe0b9d8df9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426966, "uuid": "62f18fef-d3b5-45aa-8362-9760a684daa4", "comment": "Malware payload (Amadey)", "value": "70f8bc3d2773766bad9bc03f4832c8d47e14cd9d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426966, "uuid": "ff1e66fe-859c-4c01-8b9b-434f9c9af2e3", "comment": "Malware payload (Amadey)", "value": "882623ddaad7c9354c0cff075ef8242d0fcb8c750805cf41cb4b07ab2e60ef380afb94eeba72b48f0a32a23447910918", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426966, "uuid": "228db12d-59c0-44f3-b715-47f8ec00b0e2", "value": "T184051203D7DC8463DCB927B058F713C70E397CA68C7597261698A9AF49F3A80A13671E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426966, "uuid": "80c59f5c-6932-4068-ad24-c9c4e25d0e1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426966, "uuid": "3d8bcc31-10c3-45f2-90b3-b736583eca23", "value": "24576:ayBfCX9CDTsU/Y11JF9fnAmH+MEcy0/I:hB1DT9/YP9/ACQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692426966, "uuid": "0b201b7c-c06c-4000-a5f5-113fac929a0f", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692426966, "uuid": "3cbf3eb6-fa45-4dc4-ae3e-f3cadeb62756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426966, "uuid": "5c0133ad-9be5-41c7-be15-0e55bd0a16e3", "value": "a5be1fddb167e40e5bc924a6f2d52d6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d257210-3e57-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692425463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692425463, "uuid": "1875856f-84f9-4386-be75-0b0f82147194", "comment": "Malware payload (RedLineStealer)", "value": "dfa8ba8112a6f93ec5ab7ff4e52745b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692425463, "uuid": "81eef649-aa47-4748-a6d6-1cab32db4b61", "comment": "Malware payload (RedLineStealer)", "value": "3a7eef62095145f6d36318bf6822f235f4d901af7b1d1bc792a6ccb02138baf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692425463, "uuid": "d5ccf47e-a446-49c2-8f1e-32f63d5f58cd", "comment": "Malware payload (RedLineStealer)", "value": "6370f655e4affbe8b85f659142f504b66113c522", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692425463, "uuid": "496c835a-5e53-4e0c-a151-2bc7f1c1fef6", "comment": "Malware payload (RedLineStealer)", "value": "db2052b4373df7037b7257f8ae87705a8d06b464ab4a9c4a58ce63145ec133fcb38fe0f668cb30c476b7799de42e2bd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692425463, "uuid": "17dc1f35-1637-4add-bac0-8e8a78a8cf37", "value": "T130052353B5EC4523C8F21BB068FF13870736BC615C74966B2B89641A0D73AD8A93637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692425463, "uuid": "d95e0bd7-aa3a-479b-af52-6377ab160285", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692425463, "uuid": "b43d74ee-64b3-4fce-9f49-2ee31552fb49", "value": "24576:UyRNjjStC/m4C57lIKaBWIqAGc6x7Ljuyjm:jRNjWtsdC5JIKaBWIqAGVde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692425463, "uuid": "5684d273-a117-495b-88db-6385d9c8fc41", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692425463, "uuid": "97829199-d968-42f1-ba85-28b9ebf608e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692425463, "uuid": "d8771e1a-b4d0-4d3b-9364-50736aec3303", "value": "dfa8ba8112a6f93ec5ab7ff4e52745b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca77e7bd-3e4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692421862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692421862, "uuid": "98386dea-ae48-49c4-be4d-91316e832930", "comment": "Malware payload (RedLineStealer)", "value": "fd34b84b5d46d5a5472b1800a83aea94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692421862, "uuid": "19b5642f-65d1-4c4b-bf46-a86f06fc872d", "comment": "Malware payload (RedLineStealer)", "value": "3aa5934060f19145dd50a91d04437e11b5e44ded1934ab6b51d4b38221652e4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692421862, "uuid": "9b64ddfb-972e-45da-baad-f98ee95bfb92", "comment": "Malware payload (RedLineStealer)", "value": "a0d6d1521fb72d73c6f1ebb246994294734332e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692421862, "uuid": "6e42e760-a3b2-4ea3-bfcc-b969841daae5", "comment": "Malware payload (RedLineStealer)", "value": "6c6d2df671112cb4cd64462b3a04f4cea1f3cf76ee2b3228f8747ac470a4d8d5ba1c6a5f06a124f4ca63c8ce0bd1676f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692421862, "uuid": "9ff022f8-bc96-44fb-9cc3-f70c4b222c64", "value": "T19505228AB3C88077D9F91B7058FA02970F367CA29D39C35A2745A8DE1C222D5E572737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692421862, "uuid": "a029c4f0-1c07-4c93-beb4-38b721803ec1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692421862, "uuid": "f61565c4-e3ca-42bb-885b-2f8e4d97108e", "value": "12288:FMrfy90OBC25JM+pcJkwupa3On4FhOQQkoG4Wre8XYgu/MotwXlMINyod:GyLB1rTi+mhFhON8zTuRs5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692421862, "uuid": "d702547a-982e-4bad-ac05-be9b648120b0", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692421862, "uuid": "764df6cd-484b-4afe-8c98-35bf3d61f033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692421862, "uuid": "2d49e4fd-8667-4e03-8e43-05cef5ada27f", "value": "3aa5934060f19145dd50a91d04437e11b5e44ded1934a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a886d2b-3e4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692422157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422157, "uuid": "771dc5e4-0432-4074-87c2-4d2147f6af42", "comment": "Malware payload (RedLineStealer)", "value": "7effa0d14408565b1b35f99f0297bca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422157, "uuid": "9a480ac5-86b8-4c43-a774-d81ca11e64d7", "comment": "Malware payload (RedLineStealer)", "value": "3afa04e2d1e96dc8577e1aa91c29cabe1bd277b087a909523d97a207780a76f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422157, "uuid": "092baf59-79d3-4fb7-a625-c51ca57baf1f", "comment": "Malware payload (RedLineStealer)", "value": "48b4009f6428a354b00ff0b12ddd4ad5a99d22d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422157, "uuid": "55f034b3-813e-4636-bbd9-7547aa775b49", "comment": "Malware payload (RedLineStealer)", "value": "4cfaa3be641110cc2ac4827ba493b004cc94e54c2112df82d48af09e2f0b08a63e8971a18f9dfa9dbe8978c7315d69a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422157, "uuid": "2e35a830-f970-4426-8152-2679f7dae878", "value": "T11A051203BACC40B6DEA51B3224F617D307367CB18D78936B6784699E4D63786A43273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422157, "uuid": "9bdd38ea-e4c1-4c29-9de1-8471c0bf76a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422157, "uuid": "0bf2b331-8413-44d9-8228-35c28a545574", "value": "12288:TMriy90Hrh9qyT8A8ArVcOe7zhnDcoi9/ne5EIIvf3H+k2ZgYtNTbYNu3lSY:1yurhFZzrV6hQk5TIvf3escTbYa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422157, "uuid": "ec2532a9-d964-4376-b5bb-be90b4a57d6c", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422157, "uuid": "c6ac381f-17f1-4054-b480-31cebf65c457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422157, "uuid": "3de04559-6d5b-41d1-9d1b-349b23e79764", "value": "7effa0d14408565b1b35f99f0297bca8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6d1b4d-3e5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692428257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428257, "uuid": "a9c505aa-7624-4182-8cfb-f2592fa8c201", "comment": "Malware payload (Mirai)", "value": "a03a764116bf4d3e9d3f79f92bb4218c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428257, "uuid": "d061287d-20a7-434b-8baf-964d587838b2", "comment": "Malware payload (Mirai)", "value": "3c5973a86dbd5a75ee12d8ef83f79b9160bca132330cc47780e0d5c81c8437f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428257, "uuid": "3b7166fc-62f8-4803-b600-6308e0c5c0c7", "comment": "Malware payload (Mirai)", "value": "d952383fd1b2388aed000c3df31afb4854e6f039", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428257, "uuid": "dfc0784a-47a4-4c03-8e24-e5b3fb999c24", "comment": "Malware payload (Mirai)", "value": "e3b74089e1ec482931ddad6a89244a183b3a3c5fabb4b98018775d7b5e458b72a34fe29d91e45df9d803912fbc37c1f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428257, "uuid": "2d81707c-0838-443b-bdef-bd2ca35ceeb8", "value": "T1D033E11257049C23E6F5F9FA6FD6088DBCCC1FBC8B6F692222B4986451931C647F8E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428257, "uuid": "15d78ea1-f348-40bb-927e-de9af6492c04", "value": "1536:NP+rGKDZN103JdOSB8RorRL15J6RN2y3hcWtH:4rLvICDaRL1z6RfFtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692428257, "uuid": "57d7e735-5cf3-43fa-b3a2-d013ace4a97c", "value": 51424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692428257, "uuid": "521945b2-fd68-43c0-9087-9933bb43bee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428257, "uuid": "7d9db007-ecd5-4871-8f06-4489e2d2ffed", "value": "a03a764116bf4d3e9d3f79f92bb4218c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22f663e-3e5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692428263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428263, "uuid": "25c5fed3-dfb9-41db-bcca-1e201fd8415c", "comment": "Malware payload (Mirai)", "value": "26b3f509e652a4326651ef7dc1316e30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428263, "uuid": "ab26d29f-bc5d-42da-a464-ac7e9c9f8c16", "comment": "Malware payload (Mirai)", "value": "3d42ea7c317f48244733d84f6153591afcaab3ba94d3056be082211705ce8f14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428263, "uuid": "2153900d-e877-44f4-a333-6d96c4af449b", "comment": "Malware payload (Mirai)", "value": "497322442fce5390814c052a8acbebc81d1ba332", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428263, "uuid": "1fa3d662-9f30-4dc3-9fe6-0a026cdb5a12", "comment": "Malware payload (Mirai)", "value": "1d00b448d472314f5d049ecd76789c1b9493d204e59a91b8c9839de33e1165baa4c14f0882581513fbaab30199d711f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428263, "uuid": "60c4c0bf-0be5-44d6-b065-3e0ad39fbccc", "value": "T147B2E1AE0281E4B2CD70E53CE629C142E36E4A7DC0FD7772128B96641E4B589787D3DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428263, "uuid": "8c28b228-ca82-4602-88b7-2b92ae9bcbed", "value": "384:oeoBE5aNSS75BOI+ypZ5vTlYIwcvsdwU2LdUfy1oH7M9pGBl2VOSs8ONhymdGUo8:oaaNSq5sOHpTqncvsdwTR+XWEBItys3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692428263, "uuid": "830cbad5-c062-471d-b732-880b1b9407b2", "value": 23736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692428263, "uuid": "5f5f4007-a71f-47a9-867f-f16eaa049fbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428263, "uuid": "c5db0cfb-c4b9-4727-a10c-bd15915b610e", "value": "26b3f509e652a4326651ef7dc1316e30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea8f716-3e5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692427882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427882, "uuid": "5dd98dbb-595b-4a19-9325-f1cf288353b0", "comment": "Malware payload (Amadey)", "value": "968afca9b97600c81e0b0268d0da681c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427882, "uuid": "796260fb-72b8-48b6-99c8-4c11e3c7784f", "comment": "Malware payload (Amadey)", "value": "3db0900a1dcfc32d3f63745c99b928f9527b9ec23a76391936327c33d4be8316", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427882, "uuid": "b1b468f0-01ba-464c-8b72-e432c5edb1a1", "comment": "Malware payload (Amadey)", "value": "0add8d106a89dad1fd084631de2b365fa7b90452", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427882, "uuid": "bd61439c-722d-4758-9444-c33382b47d32", "comment": "Malware payload (Amadey)", "value": "22c30adc483a84bede0f4b83ef043bc8bdf834eb91a0075e25f7c9198724c21d4a2961e7980c9d1e920900d4211d81b1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427882, "uuid": "f762ded8-6b56-42e6-a288-4de03bf1869e", "value": "T162252212B7E88076DCF113B444FB67831A377C605D78971A238AAA6F5873AC0E1B1367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427882, "uuid": "aa94d4de-dd37-4675-ae72-9f5a77f4cab4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427882, "uuid": "23c41b86-5dad-4d57-891a-4041c77453e7", "value": "24576:fy5FM0rIRHVpFBZoZLuZLQ1uWioUOzF0BZsmxyRQ2t:qPM0sR1zBuL62HEOzF0vD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692427882, "uuid": "9c2c9587-f33e-4807-aad5-9de7176569e4", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692427882, "uuid": "a80aa038-b4d2-4858-ac3f-4633532d24e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427882, "uuid": "d4632614-fc70-4716-a30f-037ef67d0211", "value": "968afca9b97600c81e0b0268d0da681c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d067c850-3e8d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692448930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692448930, "uuid": "ac3eaec4-9f20-4fd0-bec5-f4a49d765d61", "comment": "Malware payload", "value": "aff34648e1d3a11083eb74b70017f67d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692448930, "uuid": "2a1dbf08-60d9-4e9e-8a64-fb587f0d24c8", "comment": "Malware payload", "value": "3e153f5c6940931378c1c5e52ac175348cb42e02c8cc845a45ba3f7c24d29f22", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692448930, "uuid": "ef928302-d858-40b5-9d67-6d74e176b47e", "comment": "Malware payload", "value": "2f80bd7a2d96653f639774bf4744685b54576d59", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692448930, "uuid": "97ccb4ff-e878-4ea2-b9c7-a18cdf941305", "comment": "Malware payload", "value": "25b50744fe81785568b5ee5b69e66d5faa9661e2ed964cb4d04b02de3c953613589796beef38813db54285ae3c6bd89a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692448930, "uuid": "9612aad8-b27d-412d-8119-110094a314ad", "value": "T15407F146F608C92EC477D076969F4273A635AC581712D3E76A14BB287EB3AC08F397C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692448930, "uuid": "17fb1833-7517-4a49-8f7a-95015b75c38b", "value": "196608:sQ2Jq/geR6QCRmVomHGfX8gTFeqalhODkSIjYm1VUbHlNZxEDCOzcmQiqZclR9SG:B2JqFJCRLmHGfX8umggrZuTotljAAUGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692448930, "uuid": "6dfbcb3b-b63c-4a99-852f-88cd521c4ebd", "value": 17241300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692448930, "uuid": "fbf9fa7e-b6a8-4b97-ad3a-c5ad2a1a840e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692448930, "uuid": "b5c956ec-22bb-4c81-a954-7f4ed0cfc012", "value": "NX File Master_1.0.2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5a6e58-3e29-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692405952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692405952, "uuid": "808eb17d-6f6b-4275-8089-1b4cd684bcba", "comment": "Malware payload (RedLineStealer)", "value": "98d935c6f75ba3f5f7c5916c3a64d3b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692405952, "uuid": "5e62adac-0286-4292-ae80-330edb27c6f4", "comment": "Malware payload (RedLineStealer)", "value": "3fcc6830fb99b359dce15bf876b4d279d8750c82d643548c29fcfc45184cdc5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692405952, "uuid": "b7659116-0269-4ef9-be12-9032fa9c19f0", "comment": "Malware payload (RedLineStealer)", "value": "5ff586567d6627b81cb95c3f20f136826ded8f8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692405952, "uuid": "aedecc14-420d-43e3-b019-0e0b44602f1f", "comment": "Malware payload (RedLineStealer)", "value": "25a1d116f4fb8af5325d6c0d72b20cb116168fcb1f0214923c3b32c080ae32b90c914448c2e9555ff78d6cf3621f6079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692405952, "uuid": "d7745a1d-8a2c-4762-836b-2c9ebea9f45b", "value": "T19C052353EBE49436DCF027705CF5029B1E36BCB3486893B723929A1E4C72694E57632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692405952, "uuid": "afce569e-e5d9-4375-aa5b-23c30d879314", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692405952, "uuid": "b2f389f1-1ca3-4102-bac1-9da938c4ec3b", "value": "12288:+Mrzy90RTUNipa0P8q/wzweixJu0CIGq51XhOJMLGtsGASd6zha9:1yITKyLwzweixJujq2CPZha9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692405952, "uuid": "9deb5194-8836-4d57-a6a0-43ee4b7b71de", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692405952, "uuid": "ee701a9c-bb48-4fe5-a0ad-4e31a24e067e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692405952, "uuid": "f1ad37fc-4858-4a7c-b28d-573d890e8458", "value": "98d935c6f75ba3f5f7c5916c3a64d3b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba32d78-3e4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692422159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422159, "uuid": "d0c1a01d-4a03-4006-b407-21c0bce117f4", "comment": "Malware payload (RedLineStealer)", "value": "285bdd12ac1d138546f0ce1ecfa1bf2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422159, "uuid": "b55b6a01-a336-449f-adc8-7173fb205439", "comment": "Malware payload (RedLineStealer)", "value": "43c2ee1c1d612af08e1bc3c1535bdebd213d59cdd653d346afc13b70da757876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422159, "uuid": "9fd21830-4d4d-4167-a790-1c80315872e4", "comment": "Malware payload (RedLineStealer)", "value": "b1816105b8fe60f8c4460d05f30006d1331bf835", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422159, "uuid": "19eefd77-1949-48af-8aaa-136f9971fab8", "comment": "Malware payload (RedLineStealer)", "value": "0d1a671dd19ed61f08a09821e812e1c7b6e5bdf18661d0ddd18ee2237e0231e6838f8ee026269428282a7c95b52168f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422159, "uuid": "dc694727-37f3-4f4f-aaa5-f517450a3040", "value": "T17725235352C88431D8B42B7464F717A30F367E929CB8D327729BE8961873A95B872337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422159, "uuid": "47ca2a2e-d961-4ae4-93b7-c70f3743dd44", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422159, "uuid": "6dc1325a-3b65-4bc0-85f3-a1795b3686b3", "value": "24576:My5ehSJURJSbofcWzDceUu6IjWXdOsKeqxXuDZ:75fJO8odceXpWXdPOJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422159, "uuid": "70f1dabf-d8b2-4af9-8c48-0fe3af3b301b", "value": 979456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422159, "uuid": "52086c37-10b2-40b4-a99e-8d56a0a576d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422159, "uuid": "d7fb5009-d10f-41bb-a5a4-33b2b28b9ab8", "value": "285bdd12ac1d138546f0ce1ecfa1bf2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc816c9f-3e65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692431770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692431770, "uuid": "8c118c37-12cd-459d-959c-3714606b5b85", "comment": "Malware payload (Amadey)", "value": "56eda9d07d67795106a89aef8ec2470b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692431770, "uuid": "f593f8d5-bce2-4814-b9e4-6186f947db46", "comment": "Malware payload (Amadey)", "value": "43ebad7b690eed2164234bd2dcba6646388b446cfa1d33f96eb2df0856be493c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692431770, "uuid": "33da48db-a234-4f7b-8f3a-796592d61ed3", "comment": "Malware payload (Amadey)", "value": "939d7c0fe93e1008d6d05905d04a85665c9c2f92", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692431770, "uuid": "e1ebd1eb-832e-4340-b516-cde168536f8c", "comment": "Malware payload (Amadey)", "value": "c8fe3c612b98429df71f79c1a651406bf1528fedf18b37b17a0c8d1ba6f32fb801e5291bf1e7956480ae51528409cab5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692431770, "uuid": "443bf3c3-76c5-433b-b161-f5c0f540d5d7", "value": "T1AA051223A7D48173DCF127B014FB03631736BDA26EB9827B2605695E1C73698A17633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692431770, "uuid": "b4bf4696-73e6-4fb1-bf14-e8b7708b1dad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692431770, "uuid": "d08e30ce-6b74-4f18-baa2-5171dec827e2", "value": "12288:tMrNy90BcnxY+BiiSQZ9AuWq7TnvDObjbDE5Ya9eRVp/Jx66Cwv81ZX:4yNNPSQDPWOnvDOb3I599cHrvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692431770, "uuid": "0da70582-ef1c-473e-857f-be7cf7be5c02", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692431770, "uuid": "6c70528d-20fc-4c64-9b39-6c0e61428d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692431770, "uuid": "ef0b7f26-68e5-4f1a-a96d-3b3113fe5e3a", "value": "56eda9d07d67795106a89aef8ec2470b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73406a3-3e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692456189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456189, "uuid": "abc6ffc4-7913-4c3b-b440-7a9a96f6fbb3", "comment": "Malware payload (Mirai)", "value": "d3b060e5a7f8e493e569b4b1cfb39ba3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456189, "uuid": "378dba97-5a0e-45af-b22f-d162505172fb", "comment": "Malware payload (Mirai)", "value": "450a132e8091f5fc8c040b8822398ec398b110e63512c9f0988b6114b2d65914", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456189, "uuid": "506a8e1e-baa8-4397-98bb-d23263130921", "comment": "Malware payload (Mirai)", "value": "cb453e0ee200dcd1c1d2e026005f44a61054544e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456189, "uuid": "4e14af50-d0f0-44da-af5f-6b030729037a", "comment": "Malware payload (Mirai)", "value": "fd2d6a018ced12d4033b17452c6c293d678461ae46f61af7f7d6e704bfa3a404b09164b129fcf8813ddbb84d78a91426", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456189, "uuid": "768f59d2-b7fe-4428-a31a-8ebbd11b6321", "value": "T19AB2C0CD61943084C98D7C7C278D4A664F6CA1D0BAED9B16E354CDD8B3BDA4B345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456189, "uuid": "78156ba0-7ffe-4751-9668-6a94a294ed53", "value": "768:c4rQlS07dEv0UXqUhvQE+CXQKMQKCXBpUGfZq8Wvp:BQlS07FUXqIYSXQKquvqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692456189, "uuid": "5da06bca-6e09-4be2-96bd-077b457513b1", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692456189, "uuid": "376ef90f-2aa9-449b-a1b2-9e3389d4bd23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456189, "uuid": "163662fc-75dc-4b9d-badb-f9855316d7dd", "value": "d3b060e5a7f8e493e569b4b1cfb39ba3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fcd33f-3e69-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692433507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433507, "uuid": "f05b74b2-d5a7-4802-b777-cd3a7c104c2b", "comment": "Malware payload", "value": "244a4079070f6d48cea385f18ac4db92", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433507, "uuid": "d88f1ffc-e040-4e6e-ba28-68b6d7339963", "comment": "Malware payload", "value": "494296e18b900e0a639f9fe39e8cdaa00eabd302d37fe5091df539b567f2c310", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433507, "uuid": "3026c7e4-dcfd-4e48-87ea-be891c8619d6", "comment": "Malware payload", "value": "21402ebb72258ca20513f144fec20441970f5368", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433507, "uuid": "50536ab5-1206-44b0-9819-596abd30822b", "comment": "Malware payload", "value": "399825036a7a7816b8877b05e61188575d605414e031a31ce7f104cf5ca53141519c36cd1ec6c0f062bcd019a52fd98e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692433507, "uuid": "b13f0792-373e-45e1-aac1-b05f0bc3dd8c", "value": "T1B1B6CF03FA09CBC2D56D83F47F538FA82A671F1896516AF700643A6E3E722D249C95DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692433507, "uuid": "e7c827d2-2e3c-449c-a5de-e87d9985c79a", "value": "49152:3oilthgmQO5Jo0LmzUzdGGJQTOV0UsYqX0cgJtP+OgGYvc7:4Aumh5BmzUzBGTt0tJwOgVE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692433507, "uuid": "4b69157d-bd5e-4f0f-8cf1-8a013a733fb9", "value": 10882986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692433507, "uuid": "cc897727-f76f-4924-997c-814c2b1c5b9e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692433507, "uuid": "6bc0bf68-d05b-42ad-97a1-f52090581910", "value": "Tetefruit.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0772249-3e44-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692417603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417603, "uuid": "75a0cae0-86cd-4a72-9d1a-f0bb806762bc", "comment": "Malware payload (Mirai)", "value": "f7b475b69af5c8d49436f1d1ee5f0520", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417603, "uuid": "b0ff361d-6b8f-4c54-836a-2c860a12ef77", "comment": "Malware payload (Mirai)", "value": "4a74505cd4ee702acc14904aa331eac849e64d09a580cd27577a576833f160f0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417603, "uuid": "32abca1a-27e5-4fba-a361-4138468c1f48", "comment": "Malware payload (Mirai)", "value": "078e479b3eb58c4417bdb069dfc9f448c357fb3d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417603, "uuid": "9a1556ea-a95e-4e9f-9a1d-a73aeeb7cc48", "comment": "Malware payload (Mirai)", "value": "2b31816fd0c91d58440eaf5cef2f8396bc1eb3a672b6d7ff4fd0785bc456371e1bbde89414edbda0cbe3eb4521406b60", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417603, "uuid": "986d675f-5110-4dc3-bb1f-f6a266a3a15d", "value": "T1C8C2D00B6769886AC96171FD0EE2987378BB3A3272B555DD73C6C84F709B318D0248F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417603, "uuid": "e2440552-34be-4755-8af5-bf25dfff512d", "value": "768:UNJV5pIA2KJbAugPrYNBmmY/wYZLo8rNP:QJVqKu5PruyZLFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692417603, "uuid": "83f05450-be4d-417f-a103-89c4e964909b", "value": 26712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692417603, "uuid": "bf0b6b6f-a590-4580-b564-8e0cf4d30452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417603, "uuid": "113f18c3-f2c9-4ee9-a3de-67c61b02066b", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33821a6-3e6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692435969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692435969, "uuid": "be966aac-a10d-453d-bd71-abca5e3f63bb", "comment": "Malware payload (RedLineStealer)", "value": "761ca3347ea80183315f9748dbf222cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692435969, "uuid": "46122b87-4251-45c9-a20d-b68aa60ec98e", "comment": "Malware payload (RedLineStealer)", "value": "4ca40cddd6ea900649d618152c777946efda6d889aa743fd7ffb67eb31d7ef5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692435969, "uuid": "851d9e5b-a6d8-43be-a5c3-9d6019c4a5d0", "comment": "Malware payload (RedLineStealer)", "value": "c10b5c0f5e6dbecf8146954fee419236d8258d1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692435969, "uuid": "b0199cf0-8076-4b6e-a2af-2d0123561ebb", "comment": "Malware payload (RedLineStealer)", "value": "85c057fd93f3940e6c399ab5064f5e7af220d0ae4bce8afb4eeb41457bfc42040904537a3a92fee913f70de0f8675967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692435969, "uuid": "c994bf93-95a6-4b52-a60f-8e2f45dc5b07", "value": "T18F052303A3D540A7DCF1177008F703631B36BC969EB5967B67846A6E0C73985A93A32F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692435969, "uuid": "2e9dd667-c4d7-4e72-a56a-f02534a203ee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692435969, "uuid": "6b4ef972-2ade-45e4-a2e7-1c1582f73ddd", "value": "12288:ZMrry90LqGtDwPqWyhsp/MEkZikhm28GuVJrc6Fk8wf1DYWtnz7O9u+S2G5II/n:iy6r6Dp/mil2puDt+f1XHO9u+S2III", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692435969, "uuid": "18d796ce-74a0-4509-ac58-41de9b375554", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692435969, "uuid": "34c9d7c2-70ea-4f07-b643-78f9f683b31e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692435969, "uuid": "704bd781-2fba-4d06-9236-408f80d02b2c", "value": "761ca3347ea80183315f9748dbf222cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1a776b-3e5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692427874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427874, "uuid": "275d3183-fc91-42d4-b9b3-e07ccfc1baa5", "comment": "Malware payload (RedLineStealer)", "value": "995601a76cee2b82298426cd1b9f6826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427874, "uuid": "baf222bb-23a7-42d1-81d7-02961cccc411", "comment": "Malware payload (RedLineStealer)", "value": "4dfe98ddc170b840c7adec0a75f26c82ff6a4721b07d0c9eca258cc9ae14851b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427874, "uuid": "3c947846-e010-46ac-a3f1-877c6834e6a5", "comment": "Malware payload (RedLineStealer)", "value": "dccc745f797461f511a352a14baf33ec280544bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427874, "uuid": "d505ba6c-89eb-4fef-af41-e56a116c134d", "comment": "Malware payload (RedLineStealer)", "value": "780128f6f1cd562d32dc8e2b08cd0cf0ad43b99695f4801223c858aca87651b6f70fcfeb340ef36d4d19350c5fbe9b47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427874, "uuid": "b6795ae5-b805-4377-b907-a1beb899d08c", "value": "T165051216AAF58073DDB52B7548F703831732BCE06878976B679C68574872AE4ED3033A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427874, "uuid": "0f9825ed-e489-4ef5-b4c3-abeaa411b169", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427874, "uuid": "0c5c230e-6f9b-4f8c-85bc-3477ce73a589", "value": "24576:wyjWDZGCi+/duJSy1N7LkKkVE6f5FPjSeGX3TMai3K:3uuJSy1NPkKkVE6fnPjSe+83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692427874, "uuid": "b6690186-9a89-4daf-80ca-d967a547cc0f", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692427874, "uuid": "d827edb3-6d2c-4856-a5a6-f8b9ba3cabbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427874, "uuid": "0e1fe896-7224-408f-9dda-4e7a0f4249a0", "value": "4dfe98ddc170b840c7adec0a75f26c82ff6a4721b07d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42f7d07-3e3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692413664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413664, "uuid": "c370a64c-3c8c-49e8-9e02-d0f83267422a", "comment": "Malware payload (Mirai)", "value": "ac224040aed3f52e33e4a9f3741beae5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413664, "uuid": "9512245e-3a88-4b96-b31d-4110f6fb5139", "comment": "Malware payload (Mirai)", "value": "510e3e83dc062ceba91fd958201321eb6531935178d7c60e0a87471587d50ac9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413664, "uuid": "ff649035-6e47-49f2-84be-ad17f062b333", "comment": "Malware payload (Mirai)", "value": "038a161452664bc3d9033f1a4f80e13e847c3ebe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413664, "uuid": "64cc034b-e055-47b9-866a-1b6078421a1e", "comment": "Malware payload (Mirai)", "value": "cf1eee0677e548b187329eac6c45d891ebf628d29545dac71f709a1800911eeaed04aeda9a977d2283d7cf3123839f05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413664, "uuid": "8b0b2fd3-41c6-41e2-895f-2a32002a298f", "value": "T199536EC6B4119E7DF5CBE7BE84224D0EB821722150531B27BB6FFD83BD721A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413664, "uuid": "938dd62e-67ac-4eec-afb2-3598b2e03e2a", "value": "1536:kPqRg0FGTbSX5xpLepSGorsF7QhOx2X/ZOqc/yA8Y:p5VHV8I9cK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692413664, "uuid": "583bbaba-b4af-465d-9823-4c6bde3e6c00", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692413664, "uuid": "5eeabb0a-20d6-4e53-b342-33a1f642830c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413664, "uuid": "267cf755-83fe-42db-9e9d-a6a918c7c51a", "value": "ac224040aed3f52e33e4a9f3741beae5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8082a915-3ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692469841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469841, "uuid": "ae92e8b4-2fc8-4a68-a440-face10928d75", "comment": "Malware payload (Mirai)", "value": "56d6c9f4831a8a8ea29976608594de8b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469841, "uuid": "79b63ace-efa1-4f3b-84ee-a14f60449550", "comment": "Malware payload (Mirai)", "value": "511c23eb8c10f1040b0bd42e378287ae75bf46b7016689d0206d26469177259c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469841, "uuid": "508967f7-f5e1-4685-ab7a-23373cb4d19c", "comment": "Malware payload (Mirai)", "value": "bf9b135835fd2df9abba5e667f6c431273761d3f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469841, "uuid": "1f313d0b-2ad9-4ac9-85bb-f842c326bb99", "comment": "Malware payload (Mirai)", "value": "28f93bb80227b71a275ca364357cad7545128f144d1f38b53efbc29f82fa9b49ef2a743dfaa6ee323851f68a04d20bd4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469841, "uuid": "71b80c85-e9b7-46c1-96fc-2b21b1c49ef4", "value": "T1B8F3C80AAF610FBBDCAFDD3706E9060139CCA51722A93B753674D528F50E54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469841, "uuid": "c413874e-d4c0-4302-aede-d35482993f36", "value": "1536:2tcHI3hEWWqFQPmsp0zndTHy6UCXbWdYMLP2GfHXqZgBBTDYSLIE2SkEb8nN9s3O:2tcoKWn0uhTEb24H6SrLIF/E+NkdBfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692469841, "uuid": "36b48df9-f20d-4ad6-b597-7467fb7aea75", "value": 161480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692469841, "uuid": "8fab6ec5-39fa-4bd2-be2f-9b4476b2422e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469841, "uuid": "cfac60a5-ad69-4d32-88ee-135b5cb1d3b9", "value": "cundi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a03379c-3e40-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692415553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692415553, "uuid": "6dd64244-8f3a-420e-b40b-0db8aa4a690e", "comment": "Malware payload (RedLineStealer)", "value": "df5e0ab8b7fae7ad63ad0234f9192c94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692415553, "uuid": "0225b9e8-0e51-4412-8d39-ff6601410edb", "comment": "Malware payload (RedLineStealer)", "value": "511dc622ac89d315a7fc8ceb415c301e78b40e224930bc4b944446c153dec119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692415553, "uuid": "6150b999-8b55-4335-a07d-9ea366127adc", "comment": "Malware payload (RedLineStealer)", "value": "50ba35991d7ef3f71f3670500585c9c00a17812d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692415553, "uuid": "ddc87d9a-9a0a-449a-ad24-837ae8049554", "comment": "Malware payload (RedLineStealer)", "value": "e4599d36dfcfddbe689da90fe5ccd4a1272a7802c0890d74138d8359a22cbe6f8829b9f8b081d5abe41f0c660b5c7ae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692415553, "uuid": "11f51761-cb14-4c81-a9e9-087302a940d6", "value": "T1A4F41243AAE89472DCF417B028FB12831B35BC91597C976A2387745E1CB2AC1B93573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692415553, "uuid": "df51d1b1-a087-4de8-bb42-747075d03863", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692415553, "uuid": "af47509c-8485-48d0-a198-a2ff394a91b0", "value": "12288:GMrVy90PRcb6aL0cA9S7ppIeo4p/KX6e7t+1KRNgXXp7kYcOYQFZsGQ7Wa7nGdcC:ryUcb64A9wppIZ4ZUR7twK/gZhQQF+G1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692415553, "uuid": "1122a4d7-be65-4aae-b702-a8151f05862a", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692415553, "uuid": "c2881c16-9f38-4b4c-a8c3-be72c2eb9c53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692415553, "uuid": "3001440d-0641-4706-b385-3fff1c405a5a", "value": "511dc622ac89d315a7fc8ceb415c301e78b40e224930b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d53654-3e9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692456484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456484, "uuid": "2c1439b6-42e4-4eb9-9b29-d01c806ffca7", "comment": "Malware payload (Mirai)", "value": "6cdd0ccb3610e3c3ba36994ae74e9138", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456484, "uuid": "aba9a518-ed6e-4657-b8ce-474dc8edf5e5", "comment": "Malware payload (Mirai)", "value": "51c8326b9fe21553a40ade7f788262c44afd4a4085bbf638e3a725ea3e9348d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456484, "uuid": "db4d28e6-a0ed-494d-9d3d-4a08294bc10e", "comment": "Malware payload (Mirai)", "value": "f6c7be944d6549c33cf6b3a2715d6da5dca123f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456484, "uuid": "4a8e858e-0c18-40c0-9c40-164618d8e854", "comment": "Malware payload (Mirai)", "value": "a0aac73de4a49a2f0de6548e07b0e1840d9ca07ba1ada15c8457e2a0ee2e0857f5bff545e283dc9faf01a72d3b138ec1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456484, "uuid": "efdde50c-9acc-4023-aa69-1e69d0d544b1", "value": "T12C431921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456484, "uuid": "f7b42118-a7b7-4b8d-9733-3ce895f03215", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwz:RqtmZPuutfbltZFBSJsBcfDSTFI+BEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692456484, "uuid": "3db70c23-313a-42cd-a7ca-96c9fea1e05c", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692456484, "uuid": "00a8c24a-d732-444f-9fc9-70c1283966ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456484, "uuid": "0f746d2c-ae04-499d-9c62-7d7501870815", "value": "6cdd0ccb3610e3c3ba36994ae74e9138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598afdcd-3e42-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1692416518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692416518, "uuid": "058bb4c9-03fb-4bfd-82ab-78b43723ee1d", "comment": "Malware payload (StrelaStealer)", "value": "ae1aa4fc8f4ca32ecfefc600206828ea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692416518, "uuid": "f9e50cc1-2c81-48d3-8749-d12fc6631aa9", "comment": "Malware payload (StrelaStealer)", "value": "5247b5fa5f5539aa7eb0838a5589ec13f9e434263de47973fdad26fc28a3698e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692416518, "uuid": "c8e2e1d4-47ed-4b9b-9163-cbbcc329d6cd", "comment": "Malware payload (StrelaStealer)", "value": "5dfe6e3921a0a2d1c21971e15ad06b6af35570d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692416518, "uuid": "cb441077-f3d0-4981-94b2-4f02f346e4c5", "comment": "Malware payload (StrelaStealer)", "value": "d3dd49ed3e8a89a1c16ac5f7e9be65fbe1eacd9336bade8d45c0a3b6a2199b4f7a659f06dc9f9713fbc281a4d912730c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692416518, "uuid": "b2d0db08-d32a-466e-b8dc-e6f1d7e9da68", "value": "T110E5D8BF3497A548ED225C207FDCF6B1C7A718BACA6BEAF1059550301E66193FC4281B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692416518, "uuid": "e8c13b5d-6ae1-462b-9248-90ba9513600b", "value": "fcfbe5457e76d2ac347d7db113c0ca3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692416518, "uuid": "f015e9c6-6b03-4c39-a574-cb957f64780e", "value": "49152:BO+VHl9mC9UD5L9tg9lX+37FTYHHfWPrD5+j:BO+VHl9mC9Uuz+3uezD5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692416518, "uuid": "06dea258-01aa-4d0c-ae10-5861f8728155", "value": 3081767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692416518, "uuid": "f0546d2e-89b1-4b59-b5b6-a9e65bdb8bc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692416518, "uuid": "93fb2932-e010-4c71-b0bd-781d4c766764", "value": "orangesterrific.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "addb5c2d-3e53-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692423961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692423961, "uuid": "29d28cbe-ed2e-4322-9adb-0ac365661777", "comment": "Malware payload (RedLineStealer)", "value": "1b8ba035b690b7f8ddf9f88931b398f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692423961, "uuid": "85aae00e-5381-4cd6-a506-a1cf231327db", "comment": "Malware payload (RedLineStealer)", "value": "52ca25f716f9ababb913425f71566b83757a486c716c62515802de2c003d5e85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692423961, "uuid": "cc38b5cb-3dc1-4206-b80b-f002092c849e", "comment": "Malware payload (RedLineStealer)", "value": "16b1eb7af2866be0a38b6304f8e0c28770e7624d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692423961, "uuid": "2b930c80-9725-4e70-8b1b-189b330b6b2d", "comment": "Malware payload (RedLineStealer)", "value": "40bb52cb0b3811b971d146fa44a142249ea53da309798ee92734d1c173cf4aaa35d00f7cfc95f776f5b4d68bb256da09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692423961, "uuid": "98088be2-8e79-48ff-be68-0a267645b8bb", "value": "T16E052353A7DA8473CEB427714CF613D30B3ABC624968E61B17DA5C4B0873A955A3232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692423961, "uuid": "82ed11ff-52af-4c45-b1ed-98a81225646f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692423961, "uuid": "b6728e8c-66a5-408f-9152-c9c93eea04ad", "value": "12288:yMrXy90c2+TGGZW3PFnWLqXfzF9E5WKlze79ckKRRlXKp7BmvwuTKAV09D2pIqdG:Nyn9WrF9E5Wqa791KXlSZ2hsqzwefk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692423961, "uuid": "ba95916f-927f-48b9-b971-284692eb6791", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692423961, "uuid": "44aaa85b-892c-432f-adf5-7604ca404b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692423961, "uuid": "a7d56edf-45b9-4745-8334-98e65a941828", "value": "52ca25f716f9ababb913425f71566b83757a486c716c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc603925-3e5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692427878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427878, "uuid": "70a406af-a1fe-4043-a0f6-5f0905fe7a48", "comment": "Malware payload (RedLineStealer)", "value": "ae63e279743593b89f8dc05a220ec7e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427878, "uuid": "e279bbd0-8673-487a-bdf8-32fb8b253847", "comment": "Malware payload (RedLineStealer)", "value": "54e61680dd56e5d59666c5b507b988b14ae03f4ecdb945343971f3f481564a34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427878, "uuid": "c8691d4c-9fba-4f7f-8786-ffd6fb1d4417", "comment": "Malware payload (RedLineStealer)", "value": "7bd0a7fb081ad33d9739fdbb9b85c6b8bcabb3eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427878, "uuid": "7280327b-2b17-4493-a9e5-446c81f95034", "comment": "Malware payload (RedLineStealer)", "value": "6de84f094ac688e2bb8b855ec35dd5a75a4b2aa0e4e3ac61257da4dfeba3c99a393ae33b2d536f91721a7512323a1d4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427878, "uuid": "9e361c88-25fa-400a-8361-d73bbb255f4e", "value": "T101052217BADD8473E874277158FB06C71B3A7CA1997457232396E82F0C32AD4A93137A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427878, "uuid": "30b17432-4d73-4c9b-84af-dad79a136065", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427878, "uuid": "827685c9-b50f-4a6d-b213-4c71e7d03c48", "value": "12288:4MrXy90mWbZ+XwhNxZR2N/z8yoi9wKRL0Xap7FhJakrSAOygxjAnUGfNX2YY2:fy7WZ4whN4ToGwKx0iROzygqnPB2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692427878, "uuid": "b6b1fc9f-dda2-4930-8080-df3a638de71a", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692427878, "uuid": "bd8dd3e0-64c7-4fb0-bf3a-cb52d84db3ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427878, "uuid": "da520462-b151-40c2-b0e9-08f24cefa84f", "value": "ae63e279743593b89f8dc05a220ec7e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923aeaf8-3e66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692432075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432075, "uuid": "dfa3fc13-f050-4407-8537-ae44fabb7fc4", "comment": "Malware payload (RedLineStealer)", "value": "261909b8a84876dbbf919fbb5fa53cfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432075, "uuid": "d408a765-c9ea-4f5e-bd15-6f6a81ada30b", "comment": "Malware payload (RedLineStealer)", "value": "55403f38cda5f3922eb753cb33ad68dfd71455153cdd4925bc084cc95e3b3171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432075, "uuid": "12b8328a-cd4a-49ea-baeb-708a9a1ec57b", "comment": "Malware payload (RedLineStealer)", "value": "5932666a3c41259f1bb5d1e2163f4962511cd284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432075, "uuid": "53da85e4-d2cf-45b3-9956-380080b3cf0a", "comment": "Malware payload (RedLineStealer)", "value": "851265b954a970619da1f2b79e926dcb96c0f4e43b83a36859601c55dc7bafa699d4a0fb5a3926f47e55407d97dbf439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432075, "uuid": "f5217cd3-abae-4027-8be1-ce94555c2203", "value": "T152F41213A3D88071EABA237425FB03931B75BC705DB8D36E2394A55A5DB36D0A97033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432075, "uuid": "85b65636-83cd-4ea3-9bdd-166ed72f4639", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432075, "uuid": "afa5549a-8f02-4635-bf7b-633164d90fd8", "value": "12288:2Mrhy90+uWEFF7uGCiqAZtfVIu8x+L1fHkBtf+tN7kn58u7URt4vv73:/yRBEFYGCutIQJPkBktN7OGuq+v7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692432075, "uuid": "8b38bb62-72e3-460a-a094-c74cc3ee8057", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692432075, "uuid": "623b4378-66bd-4c73-b426-a43804119212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432075, "uuid": "b258527d-18ef-4610-ae63-256f7ff78761", "value": "261909b8a84876dbbf919fbb5fa53cfa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0514ca2d-3e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692445582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445582, "uuid": "dfdb16b6-b6f1-4edd-9077-12d023cb7462", "comment": "Malware payload (RedLineStealer)", "value": "a8456f7ebe2783853854ff2570ad33a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445582, "uuid": "71a10279-e300-4f90-a34b-4c0d0800a930", "comment": "Malware payload (RedLineStealer)", "value": "5673fb28502eb9a5adc869e2b188ee6fcc9d23362dea118dc2f3b085dbad937f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445582, "uuid": "a2e74ad4-b736-4e57-94fe-5f863e44d55e", "comment": "Malware payload (RedLineStealer)", "value": "df8f9882102fadb73183733aa80280e7b023c356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445582, "uuid": "78d4378e-365d-4bee-9dc8-ef3564b1e54f", "comment": "Malware payload (RedLineStealer)", "value": "cf70b1de74292e83380fea6f3ef9cf79b37146ec6dc41a7ed01381f38a2e8ca723cd0b7c7829659364fce58134f1f318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445582, "uuid": "2371aaaa-7d5f-4e04-b2e0-3472414c0da1", "value": "T15D0523469BEC8077D5EA037074F712C32B367CA2097463372711F85A49A2AD5E836B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445582, "uuid": "75c3ce89-5e69-4d15-9203-258be5b98cda", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445582, "uuid": "9d589cc2-c9cd-4f4f-b6d7-249595ca0616", "value": "12288:sMrly908vk8BpoVGVFLbeueLZ0Q6tRzyvnUq4I5V8LCAikP6SiVCM4Uyh3:RyZvvzoWe5ZjAyvnUqF78LCXCZTeyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692445582, "uuid": "7f37dbba-2043-446b-9f90-d952a8a1122f", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692445582, "uuid": "ad49c3cb-049a-431e-9367-8f248b995493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445582, "uuid": "3bfd129a-83a9-486f-a993-e64f2ab61daf", "value": "a8456f7ebe2783853854ff2570ad33a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1de01e-3e74-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692438076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438076, "uuid": "11bd2b73-c49f-44c2-a6bf-7a6f7ffbf765", "comment": "Malware payload (RedLineStealer)", "value": "1325fa7002ac46efc360311e27c9b0ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438076, "uuid": "41ccd198-ec61-46e2-8b1e-eef9aa519abc", "comment": "Malware payload (RedLineStealer)", "value": "57619168bdec3650cc8c311a8292402069f770daaeb3af4be154903c35dce49e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438076, "uuid": "12c4b25c-f747-4299-86b8-4d179d0a856e", "comment": "Malware payload (RedLineStealer)", "value": "0ef254afae34a4bdc7388a858a30e974c5bd4b2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438076, "uuid": "40dac32b-283e-48b2-8b09-baf6a21ccb4b", "comment": "Malware payload (RedLineStealer)", "value": "dcd467fa2880b50b93aa85fd3f79b3601ae9bf73b9ec547df457704a1da39fdf5e32740a7e550e27741dab9d2f3b9310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438076, "uuid": "aec9ce8f-8e1b-4ee4-b540-0917fcb3aa06", "value": "T1B10522A7A7E65071EA76173029F616D30F35BCF04CB4875B3286985D5CB2AD4A43233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438076, "uuid": "3cc7f70e-606b-4645-8ec0-e98cdd291997", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438076, "uuid": "3c89f635-62ee-49b2-98d7-01ee0258a4df", "value": "12288:GMrry90uDm1mBWJmbC7HhmS6QgPLH2XkXuzroJu+NOx/MSXpyQJKqP:NyMmBDIz6QgPLHoZzroJvE/FXp7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692438076, "uuid": "54be93c8-dd6f-4cbe-a5c6-02e53831ad0b", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692438076, "uuid": "7313da88-48b5-4162-8c8d-ab2006806028", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438076, "uuid": "12be6f15-7ac0-4491-aa72-9f2a5063565f", "value": "57619168bdec3650cc8c311a8292402069f770daaeb3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492eaa99-3e59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692426369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426369, "uuid": "f8ecdc82-3b81-4715-ae65-3da9c78c6234", "comment": "Malware payload (Loki)", "value": "32d676b561543d748666e0483cf0f745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426369, "uuid": "6a7393c5-bff6-4fe1-9bdb-f838843fe06a", "comment": "Malware payload (Loki)", "value": "5a3543029c99dfcdcbf9689b7a7a019b636ecd11d8fd9ea0ec10410e24070e76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426369, "uuid": "f3aceaca-dc40-4319-a2ee-17009a1e7b23", "comment": "Malware payload (Loki)", "value": "2d8ed3b422d51e5a65727bfa45f25fa2e5b6e439", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426369, "uuid": "140b790f-7c93-40cb-9b80-b4c0560bc776", "comment": "Malware payload (Loki)", "value": "b84fc1402bd0681130017bff2985f9f3a5471e90589037e717703a83360502f62cdd7daa19b7a40eb44a98cb88fa1231", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426369, "uuid": "a286d145-4daa-40f0-98d8-cbd36ed5a4c0", "value": "T1ADA32942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426369, "uuid": "64af607b-db8c-4da8-ad11-0697bd48c52d", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426369, "uuid": "dba1bae7-3eb2-410e-823d-5c0cb10a92d0", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqKIzmd:nSHIG6mQwGmfOQd8YhY0/EvUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692426369, "uuid": "7ebabeb1-788a-4e23-b80b-414d7d590682", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692426369, "uuid": "7e4bd98a-04f8-47b5-952a-55f261975976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426369, "uuid": "94cff426-a65d-4e0c-af40-14c0df602de8", "value": "32d676b561543d748666e0483cf0f745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82ab655-3e4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692421858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692421858, "uuid": "c1591073-ae7a-4ab6-b6de-4cf80d9195a6", "comment": "Malware payload (Amadey)", "value": "33460218c5422eb7de3bc0c961649931", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692421858, "uuid": "72faf535-360b-44c6-9246-4d199d8ca583", "comment": "Malware payload (Amadey)", "value": "5c0501d7eed6a65ff666c5b83683189de2036e0b9ae1faef802075352582a702", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692421858, "uuid": "cc1484b1-f13c-4a8f-abeb-ae9baa6157e5", "comment": "Malware payload (Amadey)", "value": "e116c06b81df9259c9ea353be2b235affc3739bc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692421858, "uuid": "6d4d2393-fcf7-41f0-8285-2ae3b30e3880", "comment": "Malware payload (Amadey)", "value": "a0f264cac4bbafbb427ca6a82952c0870277dfbd16940adb6619ee8f5ff72a69439674ad65a5b8dd4689df03eb03ca58", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692421858, "uuid": "0bcb9588-5e35-4e5d-a146-18e44d34e9dd", "value": "T151052226A7E8C067DEF40B3028F713831636BDE09478579B2745A41F0D315A6B97A73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692421858, "uuid": "6d9106d9-3b76-4ba5-ab03-89d3374b05e4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692421858, "uuid": "d590ef71-fe84-43ca-909e-c6bba26c6be3", "value": "12288:vMrJy90/MhQ95mcVNqtYW2eeFYKLFe7ffjKRpVXQp7dosTMUl1tqllBcRz86IlvM:SyAtPVlgeFYgM7frKTVYz4WRwoYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692421858, "uuid": "ac929afd-3169-4337-8bfb-b8bbd811c0db", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692421858, "uuid": "6332a588-04a0-462c-b83e-7c70d8e343e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692421858, "uuid": "fcea44fe-e5fb-4634-a15d-54019b36891e", "value": "33460218c5422eb7de3bc0c961649931.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83304e59-3ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692469846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469846, "uuid": "b2051358-2fc7-46ca-8da1-40411cb55055", "comment": "Malware payload (Mirai)", "value": "a8a0f83062412af14ef497bfbab023e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469846, "uuid": "3a22859f-449f-4254-a68a-e53b10292072", "comment": "Malware payload (Mirai)", "value": "5c47d15d3c620c7478be2a293217937d8872d973186ad8823ccec21af35b46ae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469846, "uuid": "2e2e1cbc-1fcb-4dd9-b193-06fc45a9615c", "comment": "Malware payload (Mirai)", "value": "6f6822e7171e7b30acb9e4e3e52d22af6553cc01", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469846, "uuid": "019c2081-ef47-4e57-b9a4-5cb8e05e81d4", "comment": "Malware payload (Mirai)", "value": "d2a8f11d2f7f7bef95047f29d9ab838809146dd672a8d78c29e4ebec60156c902568fc3cb002c93537b6c38b3d0f70ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469846, "uuid": "cb6298e6-ec1f-480f-a14e-2ddeafce3508", "value": "T1E3B3F845FC509B17C6C212B7FB4E428D7B2A1768D3EE72039D256F65378B89B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469846, "uuid": "a4b9d937-035d-461a-a78d-b8c3868bb2a6", "value": "1536:EhEOKwMZpFi19AJVm4VemhTTrBQRUyYw1b9t4LUlcnwywqFWi9iJhHgnW3Ozaa:EhqnQ19l4Fh/rBQRVb96Z8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692469846, "uuid": "c466865b-f683-468a-b927-94bc1d52bf9b", "value": 117504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692469846, "uuid": "0760f23f-9943-4491-b797-28cda80c23fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469846, "uuid": "a9811486-77ee-4c78-821f-091eb16fe2b8", "value": "cundi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe4c50c-3e73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692437782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437782, "uuid": "0fbc4f87-11ec-47a2-a9d1-79da125c6364", "comment": "Malware payload (RedLineStealer)", "value": "8c97482e061a13c787dcafa2ecb690f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437782, "uuid": "744c19f8-3c31-41e5-8137-1de222cf4029", "comment": "Malware payload (RedLineStealer)", "value": "5fa3a45d39a16a617d2c0b7658e7ca53ad73294ace5d7f293518ad3d54049377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437782, "uuid": "bea117ae-bfbb-4f11-b831-cd4389952a80", "comment": "Malware payload (RedLineStealer)", "value": "573542dd97c1b50bae32de968f8a9d9caef4abea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437782, "uuid": "5ec55175-f592-4918-bb93-79032e1739ee", "comment": "Malware payload (RedLineStealer)", "value": "785712db186e0f1af235cd3137bb1e758e31d1dce6905cbf39544a7fbe748af999a7262d733d929c6bd6004fb4c5a446", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437782, "uuid": "2dae8c76-86b1-4433-b08b-f1d5c7bbf6b1", "value": "T111052293F7E445B7FDB527B02CF313830A353DA49E74871A2792989A0D32A84A935737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437782, "uuid": "2da44865-d4f1-42c5-9802-454dac83569c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437782, "uuid": "70923d5a-5ec1-4aff-b8fc-9a602f00c438", "value": "24576:Jyq3mO9YrnFYSOouKH+gOIGPfC7d+PlOpnNz:8q0rSnPKH+gdsC78PoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437782, "uuid": "5e7b6f76-5ef8-47b9-b486-60e2006d7ad9", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437782, "uuid": "000a9d82-ceef-429b-836a-c89450268cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437782, "uuid": "d0006a96-d589-4de4-9acc-6b5917c0037a", "value": "8c97482e061a13c787dcafa2ecb690f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7fa0fb-3e59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692426667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426667, "uuid": "17462682-ad03-48ac-ac93-ceeaf7264533", "comment": "Malware payload (Amadey)", "value": "06d57592ca7fbe3590d14439fb0965f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426667, "uuid": "1ecf0210-0543-40be-8054-517b661970ae", "comment": "Malware payload (Amadey)", "value": "6038649f4827e624afc2701c4f4bddd54513ead2bcee54fb37f6bd8ce85ccc22", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426667, "uuid": "ef41588b-8c8d-4e57-b97c-bb95e60b5b1d", "comment": "Malware payload (Amadey)", "value": "0d9243abaa2138b04d5ea20054f0610eb760522e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426667, "uuid": "565d6acc-faf1-4fef-bf1b-31ce1fd69805", "comment": "Malware payload (Amadey)", "value": "86e19295a7929b629eca572273a8338f17271e7a796ef0f67070591a6c309727a6128472d94b499c60f9b8e69cb183fb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426667, "uuid": "336c8269-ede3-4f0e-87cb-fb39507b00dc", "value": "T175052327BAD48422EDB51770A8FB16C31B37BC614478D72B6289784E9C32A94E971337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426667, "uuid": "cabf8bdf-2357-437d-970f-7a94ee6f8375", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426667, "uuid": "20239c96-7559-4967-8ad7-80d30309bec2", "value": "24576:DyBTJwppKDJ+vt7qWKhHXReFyGSpCytoH:WBii+vtuWKhHXA4GSpZto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692426667, "uuid": "bcf01940-fb10-424c-8fda-60012e28e90b", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692426667, "uuid": "a9786908-96f7-49af-8d80-e46545536ccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426667, "uuid": "20b147d9-cf27-47d9-9a8c-86a8e15c6559", "value": "06d57592ca7fbe3590d14439fb0965f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e55e794-3e2d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692407453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692407453, "uuid": "6568aaae-dc85-4f7e-8aa4-ca7109ba6b45", "comment": "Malware payload (Amadey)", "value": "31645dda851b53ff5183ab7715743542", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692407453, "uuid": "9b0be526-eb10-4192-a05c-2a76ec6539dc", "comment": "Malware payload (Amadey)", "value": "67dac69f8cf38811ccad57d1ef6c619fbb31823f3a6625e2ddd2facda4a2fd7f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692407453, "uuid": "6d19098e-01f3-4020-a784-ef7bc438c97e", "comment": "Malware payload (Amadey)", "value": "8664a2246384acaefc758a135e51a254ba40694e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692407453, "uuid": "1046eed9-eacf-4c54-bdc7-03a248a16b3b", "comment": "Malware payload (Amadey)", "value": "dd86d790121f752035ebe10f8a15c83c889ad0fbdc75b0aabdf1f1e602e93effbf6d42fe7a4d983cee30edf7b186145a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692407453, "uuid": "2bdcfb70-2058-4f63-875d-4e534e0bd635", "value": "T1B723F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692407453, "uuid": "34918dc6-acbe-48ef-9a80-a79ab65a4f33", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692407453, "uuid": "9629c56f-a068-4abe-a9fe-ad2066815ee7", "value": 46331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692407453, "uuid": "10d8c7fa-878e-4f02-a468-4d9398a05762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692407453, "uuid": "7bf06837-bf89-44c6-a61a-62547d21d785", "value": "31645dda851b53ff5183ab7715743542.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7c4715-3e97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692453007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692453007, "uuid": "923db17f-d389-4bce-a983-630c864d3eae", "comment": "Malware payload (Mirai)", "value": "5c121e508f6bf7c07f705268dee666bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692453007, "uuid": "7f952f44-83ea-4cf4-9bff-6f9a51dee7c9", "comment": "Malware payload (Mirai)", "value": "69091f823a550a79a2086e0a886dc76f3b9514340bae5ded97a81d4339a93f82", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692453007, "uuid": "a8439e6b-6a86-46ad-b959-12b363d243a9", "comment": "Malware payload (Mirai)", "value": "a096849eaf8c1a8e003c6eae538ba74ef7ff6ffa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692453007, "uuid": "fbe03a00-6456-4b45-a10e-fd425d191423", "comment": "Malware payload (Mirai)", "value": "e40abe52893aa2d237650b2939d9a6ade5ea1bc28d7d1e255a9c95ff042e980b4bbce0eda85db77de987040b732fea23", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692453007, "uuid": "3205a47d-ab16-4f18-9802-c9dfd317aafd", "value": "T1B8A2E11572632E66F3ED1C3DC87A8357B9670BFC90F6327679416620C90D24A2E39A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692453007, "uuid": "eb9d74bf-9b0a-4503-924b-98c77ec251df", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjiwhymdGUop5h2:TvQn4j+ZO5fKAlxOws3UozA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692453007, "uuid": "af63a8f3-cf66-4aa3-bed0-b7950e94ed8d", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692453007, "uuid": "334eddfb-1d3a-475a-8196-1b64007c09e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692453007, "uuid": "af0e1e97-174d-4171-a8b9-539ef636acc4", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11ff42e-3e73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692437791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437791, "uuid": "28618455-aacd-4be1-8f71-9085d6c106b2", "comment": "Malware payload (RedLineStealer)", "value": "92de89757ffca47f69145249c7e706a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437791, "uuid": "bf5b0dd3-afee-46ee-a73c-78faff29ec41", "comment": "Malware payload (RedLineStealer)", "value": "6962813081d9e5c2ef9f250a7f47243c3135611de5e899576f9e37aaf45859d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437791, "uuid": "a2705a83-37c2-4703-9c2f-e07ab848eedb", "comment": "Malware payload (RedLineStealer)", "value": "9e21e0bdcae46b51015bf9037d6e5076b8cb8ffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437791, "uuid": "870df6ba-f468-4f9a-a8ad-d298edd5acd9", "comment": "Malware payload (RedLineStealer)", "value": "383d4bde2b75d51474b17f9d5c76627f357dce81daa00d2c90ad0dfd63663e5db7a7194ba08bc60cf740dc36273c6677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437791, "uuid": "c6ff01e4-e637-4a05-9b92-966a01c74a4c", "value": "T163052362A3F44136DDF52B7058F703C30A393CA2D9B4932B8749644B4DB3A8599367BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437791, "uuid": "d228673b-2444-4395-8bae-ed1df432ae96", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437791, "uuid": "2f3fb58d-fbce-4e26-9ed7-6e7a651d1815", "value": "24576:EyXNw1qOkXdMow4WBULvr7SMtm9rSfpU/:TdwFkXdlM2uupU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437791, "uuid": "36159e06-6f02-488d-a144-774cba813f59", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437791, "uuid": "c6c2aa13-4cc2-4d14-81c0-06f048ec1284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437791, "uuid": "15c4929c-b2e2-4988-9c89-a354648b10a4", "value": "92de89757ffca47f69145249c7e706a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d2047d-3e7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692441080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441080, "uuid": "f757dd0f-c793-40d6-b415-bad3a4346017", "comment": "Malware payload (RedLineStealer)", "value": "360c380616d94e98f82a9900e91b0ae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441080, "uuid": "e8dc29a8-d45e-475d-9738-6ea866b8dd7d", "comment": "Malware payload (RedLineStealer)", "value": "6a1c624fc2017b3b7b28bde5c037ba1e9590c67a2caea5cda73e7c912319ff84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441080, "uuid": "5814d035-5090-42de-89de-8649aa460ec3", "comment": "Malware payload (RedLineStealer)", "value": "2e9ed6489ec26db19e8fb94363ff2b5936c59d9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441080, "uuid": "04866076-077d-4b9b-be11-8b38ae191050", "comment": "Malware payload (RedLineStealer)", "value": "6a211f7ca594dfa0ac31db95ac38859b9c808ca2cdb754378bab4b2e75f196c49ac99b942eee6b98d95284a7d3cae3d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441080, "uuid": "5724e61d-bebd-496a-adc9-ec26f5919c0c", "value": "T127252302A3D94176DCB40B7044F622830F75FEF29A69D30B368A9A5E19727D4B93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441080, "uuid": "2c9e5c08-c4f0-48c7-a6e6-c58ef6126c80", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441080, "uuid": "90ffb035-3a6a-4229-b022-8f6274f5068c", "value": "24576:oJyA+2+AOrPhjvgbe7B76T8zV/1eakZ10CZY:9A+2yDie7B7o8zDkZ1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692441080, "uuid": "27e084b9-e870-451b-a252-d1f8e34823fb", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692441080, "uuid": "bdeb7e11-9bbc-47d2-bea9-f0eae6e507df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441080, "uuid": "20e49997-e4fc-4a05-ab51-af732f0f23a9", "value": "360c380616d94e98f82a9900e91b0ae4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b438a0-3e34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1692410601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692410601, "uuid": "bc4a5351-c57b-40ea-abdd-6124598b0654", "comment": "Malware payload (CoinMiner)", "value": "9bc68d66e56707250592697ac8724488", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692410601, "uuid": "e8aed0cb-ae1e-4b22-87ba-ce4acf5b6e33", "comment": "Malware payload (CoinMiner)", "value": "6b6343ca74fe0cd2fe964efa64e2fb80159b239e6253f04e280031d257f5571f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692410601, "uuid": "2af10898-ce06-4d59-bf54-1de90e975c2a", "comment": "Malware payload (CoinMiner)", "value": "f2ba45d7b89b80fc78186430a009a75bc134af38", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692410601, "uuid": "1c9aee68-869b-4e92-9fd5-66b9920bd52d", "comment": "Malware payload (CoinMiner)", "value": "1b2f3a390f1095b5bf193cc68629f6cc75e5c903464cc3fb1944205c61b026188c46b09cfb58505d23dc00b6b78ec3bf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692410601, "uuid": "97e12107-3777-4e6b-9cd0-26430d9c10f7", "value": "T1A456D0359773B93EEC240CBC296CB26E9D392C0D7B45EB8DA80B543D5FA4A1935F8604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692410601, "uuid": "19654789-1780-46c3-9dc7-5cb29ca32a39", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692410601, "uuid": "25810871-edcd-4430-8408-7443eb95aa35", "value": "98304:PxRZZPyvzl9eHht8WGLhvqFQJcgdQ/K1jC1z5ftWDS3JBAEDKgZzhKdTa4m2:PjkzihiLhvqkcgdQOjC1zlEe3gsXKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692410601, "uuid": "874b4b31-b127-48e3-ba95-064c6e6cc2f7", "value": 6029624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692410601, "uuid": "8f68e286-1138-41cf-9812-152e7c0b8846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692410601, "uuid": "a86397b9-d03c-4976-9937-1601f8742229", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f29a924-3e4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692422165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422165, "uuid": "e13b7a3a-0cbd-49a3-b46c-c3ee28dbec07", "comment": "Malware payload (RedLineStealer)", "value": "b634c051b3b9ecaaad577370b1cdaf93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422165, "uuid": "a95bce6e-af9f-4b7e-8e46-e84ce9658bfe", "comment": "Malware payload (RedLineStealer)", "value": "6d62e33f50b6b4e4d8ca4b549a5a71075e907ebed10bef5849b5c3427e331c7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422165, "uuid": "f981e208-db00-4cb3-9629-22ee5a467eec", "comment": "Malware payload (RedLineStealer)", "value": "e723ecc59dc9fd480cc107018a723a0b8f7bd770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422165, "uuid": "56cd1e71-261b-4bab-b76e-9efae9227abc", "comment": "Malware payload (RedLineStealer)", "value": "8dcb98b61e0ba7482a9ff1e5d73428dd1bb0778b3873a457b3fce2bebe8f3cdf9c83e1fb595664231d6a3a2040a0dfb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422165, "uuid": "e3abcd4c-c83f-4be1-b07a-0955ebe55155", "value": "T15025232763F49133D8F00BB458FB16830F367C51A969836A26C76D5A2C727C5A67233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422165, "uuid": "d0bc402e-df4e-45b1-aa94-52f46f54551a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422165, "uuid": "17a8cc05-6a7c-45d9-b929-ecfef9bcc6dc", "value": "12288:UMrpy90dytiPYTBX9uZ54cQiCgc8lvNHzvj0FTC7Ht1nFySIftSPRBZh4fxnbA9c:Fy0wTBXco6xZ6FTgt1ISI6tE42ai1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422165, "uuid": "46f7b398-020a-49fd-b78d-143e861ac87a", "value": 979456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422165, "uuid": "4c8088c4-9379-4eb5-9229-f0d5d8c733f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422165, "uuid": "46df6b00-bf62-4479-8d0f-fa7c07cb207b", "value": "b634c051b3b9ecaaad577370b1cdaf93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65aead3b-3e46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692418256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418256, "uuid": "28cdb4fa-1769-464f-8088-11c8b2ba7772", "comment": "Malware payload (RedLineStealer)", "value": "f21a8129f74cc735a0a7880de04217f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418256, "uuid": "34ed86bc-3029-49fc-88b2-ead5edcc1dfc", "comment": "Malware payload (RedLineStealer)", "value": "6ddbd62e6985a594e1f5b7197c0224d5934d534133695d220f29f6e98b30c2b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418256, "uuid": "8f21dabd-75d3-4bd4-bafc-3328537eb2e5", "comment": "Malware payload (RedLineStealer)", "value": "966c3ffef15ccf246e5a695c0abefe9783b618bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418256, "uuid": "ad44003f-5fc1-4482-989a-6c86280275e9", "comment": "Malware payload (RedLineStealer)", "value": "53b005058c0f6f41aa4c937b0a402f7d2a976c9c452720843650a311bf8b87c86dad12f2feedf5240ed295177e9537c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418256, "uuid": "677e1874-c697-470e-90b2-ae2d38526efc", "value": "T118252202BBD98536CEF51BB508F302D71B3AFCA16874967B2B5688671C72290F072776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418256, "uuid": "d74e5f8f-e726-4cc8-841e-93f1c4477b5f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418256, "uuid": "abc8cb7b-b264-4710-9556-e465ce00886d", "value": "24576:HyAYhv3GnF4V8PMG2VU/oX7qf7UBsuZ3SpVNIf:SAc3Bv+w7qfwBsK8PI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692418256, "uuid": "c1a91fa0-5969-489a-9630-5c39ad4e3305", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692418256, "uuid": "1cbaacfd-c465-4955-ace9-ae838082b400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418256, "uuid": "d736f9cc-fb93-4018-b9fa-9e104331f520", "value": "f21a8129f74cc735a0a7880de04217f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfeb05e-3e7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692441383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441383, "uuid": "c0b30d81-3019-447a-8449-bf613f0a8030", "comment": "Malware payload (Amadey)", "value": "e6a2d4234a23c47b3b6e696b68497441", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441383, "uuid": "13839999-ebb0-477b-9898-008aecd786b1", "comment": "Malware payload (Amadey)", "value": "6efcd5ed0e95142f1953143c5fbcf069269100a52d9e925d8d5a41212f6a5238", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441383, "uuid": "513f8d23-0fe7-4573-bf53-36c7decb229b", "comment": "Malware payload (Amadey)", "value": "1a72b6af310e86b56d9c63ae6f8bb4a944fb8ffe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441383, "uuid": "40e394e4-efba-4ebe-ab3e-cb00b42a212a", "comment": "Malware payload (Amadey)", "value": "707970873b46ac5637d5264b4ee5b504e3e967d126ae1a381a15a3dfb94c23bb9a4c0d45129a13f35a9424ef322e2143", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441383, "uuid": "553ecc68-2d2c-44c4-bc82-569a6375a4b5", "value": "T1A8052206A7E99032DAB26B3459FA12430E35BDF2DD7C431A3B55692F1832694E43273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441383, "uuid": "e31d5a19-5fc8-4680-b5b1-d0beecc9af77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441383, "uuid": "9ed00a2b-53a8-4955-8c9c-9dfab225dbd5", "value": "24576:yyLwnxAKDAIRUnII5hNjpN7u5NcRSpWoB:ZExJR1InNjvu4RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692441383, "uuid": "c6c73425-e238-4e34-b54d-910faea2626f", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692441383, "uuid": "a8001dee-82a2-4fec-a1c6-f6b6b1c49d0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441383, "uuid": "bd182476-e840-4552-b1ec-8379968f7f2f", "value": "e6a2d4234a23c47b3b6e696b68497441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01907c7-3e73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692437789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437789, "uuid": "810a1250-8cc4-40e0-ac71-4c087fad2606", "comment": "Malware payload (RedLineStealer)", "value": "ecd4ee02863e914917ad0c89d56be96c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437789, "uuid": "0b8df957-96ec-4c1b-a888-40e813e4681f", "comment": "Malware payload (RedLineStealer)", "value": "6f62f3d3df87800e1926de4f7dd6a4eb2960994b72cc642dbcafbd77aef0adb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437789, "uuid": "e9d3d5cd-4098-4fc2-994e-add5861c0ced", "comment": "Malware payload (RedLineStealer)", "value": "ad1071bd9efdcb7b3919cc1ebcbe3aa43e0f19db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437789, "uuid": "8d12b578-a235-4783-8c36-3cfdeda8b38d", "comment": "Malware payload (RedLineStealer)", "value": "dcd73079668d19f52a0ccb35416713d3855ae1280e57bd22a8f8a52e3fe85e1594d8e42574837bbcf346ebd77961a4f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437789, "uuid": "3237adb4-6201-424c-a6bd-0f2a5c62b705", "value": "T13225236E76DA9472D9F117302AF617870B34BC5198B8076F26E6C84B1DF3AC8A134727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437789, "uuid": "fb21b87b-aad8-45f8-a8db-bc7182671ba3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437789, "uuid": "ee8c1714-8f5e-454d-9381-1966c8f9e73f", "value": "12288:6MrLy90y4EPLF8ovEZnivVMXjccUCG1rr+jHhPba6B/CkcURYa/7f2MEpZOk3svy:JyiEnHefUIO6B/vOuaMEpok3sFUpAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437789, "uuid": "dcf2763f-ade8-40c0-aa25-71ce052ac1e9", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437789, "uuid": "4739b6b5-a25a-4590-a23d-38d2ae68922f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437789, "uuid": "8aa019f0-2255-4282-9fb6-4ced2fb1b111", "value": "ecd4ee02863e914917ad0c89d56be96c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679c2b80-3ea0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692456914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456914, "uuid": "8febbb1b-015e-49c6-92a0-7ca026a91d35", "comment": "Malware payload (njrat)", "value": "a358d74ef9b3e541519b8cc6c3ccc945", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456914, "uuid": "7a1a97a3-a7a5-4e31-82c6-dc93dbf0cb47", "comment": "Malware payload (njrat)", "value": "70f9b661169c4320d42f92696e98c9234fb83d3f680b8b904c8856af77207ec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456914, "uuid": "388327ee-4c70-418e-b21d-7a1068daf3d7", "comment": "Malware payload (njrat)", "value": "73727883a5e8267e4b2354c873d68f26e579ae64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456914, "uuid": "0cb7e906-e003-407b-b6fe-07145555b4b2", "comment": "Malware payload (njrat)", "value": "c0e77a1cf7fbcf2dc090148a0171ae656d9a7f704deeb0379ddb3ab83caf9af0fd55786c9184c895f52fb74e79db5f36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456914, "uuid": "c83a0c2a-baeb-4fa9-b5a5-4f12d76222ee", "value": "T1C1F5DF38A5824E3BC03D17359C6FAA7464FD7A04297E2783B38C55EDAFE730465A5382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456914, "uuid": "752b06b1-c06b-4942-9ecc-6c8a57ebb6ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456914, "uuid": "e2b7ea7b-2cc9-47d7-9e8e-2f4c96f816e4", "value": "49152:Q5drQyNZoSw4TAIP5Zq/ZtMdZqQVsDb5cTH:QbQy4LpIDq/Zt+5VsviT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692456914, "uuid": "4fb08ab8-dcbf-43b6-a630-688eb85995c1", "value": 3645440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692456914, "uuid": "31a8e200-3d26-4d7d-a36d-7c7ac56243fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456914, "uuid": "0aa19019-bad8-4c5f-994f-81f3d29d4d8c", "value": "a358d74ef9b3e541519b8cc6c3ccc945.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae54270d-3e3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692413654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413654, "uuid": "d0d02a28-1499-4f98-bb18-b5936ba1ae7a", "comment": "Malware payload (Mirai)", "value": "b67eda1a63c37db0f413dae4cb3fac96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413654, "uuid": "0267f9e3-c33c-4dbe-90d7-4c279ebdb4a6", "comment": "Malware payload (Mirai)", "value": "7100a40a34943b134f57bf5cf12fdbfd610111b42152fc6742ac7fdcb5eceb62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413654, "uuid": "2c2adb36-3625-4842-ac8b-cc5803752b16", "comment": "Malware payload (Mirai)", "value": "c6fed733e44906934ec02f85d90db5dc0766583b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413654, "uuid": "68a2c3dc-84f4-421d-82b8-f5bc36501f06", "comment": "Malware payload (Mirai)", "value": "9e022636d781d175edef2286a3f200cad8748565ce8d0cda86c9bf0f294bce2a91887048f0a9080e9b2ebcf8b8a577a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413654, "uuid": "cf95e883-62eb-47e5-9cf6-8ea6b06153b2", "value": "T11DD2E18D76D353FB8C8DDA7EB61E403A309E78A5A6B2D323B301D5530726180E695E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413654, "uuid": "42499991-03a0-4860-ad36-764e603c67c1", "value": "768:WlxKd2FLPxEnspd6IHE4RlY990lMtupmI:Ld2FTnplHEw0aSiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692413654, "uuid": "cebce5a3-9e83-46fb-97b4-b7e76b5dbea0", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692413654, "uuid": "53678f8d-5113-4ae6-85f9-7586cc0b49c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413654, "uuid": "f0e3b0ef-2678-4eb9-90ee-e9ce833819fb", "value": "b67eda1a63c37db0f413dae4cb3fac96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9556b2a-3e4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692421860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692421860, "uuid": "2b872f76-15a2-478e-9cac-1febea229237", "comment": "Malware payload (RedLineStealer)", "value": "51382f3532b24d82a20cda7322a41012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692421860, "uuid": "729ad14c-ac4c-4f6d-a343-6b613551816a", "comment": "Malware payload (RedLineStealer)", "value": "72df1b483c489fce90957643e2b810e9908ea51d77509d6dfa1eb4f83ac737e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692421860, "uuid": "02a87b4d-a31f-4bf4-bdbc-5ca2dfc468ae", "comment": "Malware payload (RedLineStealer)", "value": "ec3749dde9aad2511c8c5c419de8461421a8b7cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692421860, "uuid": "668e9001-e1fb-4d80-83e9-c5b005ce87d3", "comment": "Malware payload (RedLineStealer)", "value": "c12055ef34bc253dbe7fdd9dc989ce7fcd5a1ef6280d6b389a5dcb9a16f71824f867ce5c72b04a5b4cd0ff9a6cf7244f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692421860, "uuid": "edac2ae3-c583-490a-a8a2-bf958196cbff", "value": "T1C12522A15BDC5033E5BA2B7018FA06C317367CA24AB8968B3651DE1D5DB25C0B631B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692421860, "uuid": "d6993148-5c23-43dd-ba9e-81ddb4bbd69d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692421860, "uuid": "5e85a9f9-333f-4062-ab00-d90ab6ee7af2", "value": "24576:5yB2EpS9Tg35e/VIUmbWl6t5g70tQqpE:sBFS9Tgbi7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692421860, "uuid": "fdfe9968-bc4a-4aab-9d61-c91ad7b08759", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692421860, "uuid": "7c082e4f-6941-424a-87e3-f08b5d7834ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692421860, "uuid": "64d228ff-9da7-40b9-8be4-811f3df7e8bf", "value": "51382f3532b24d82a20cda7322a41012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6187ba-3e47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692418862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418862, "uuid": "09bb6cde-fc7c-4d8c-aa79-89b985331d26", "comment": "Malware payload (RedLineStealer)", "value": "1d1ed1d3d73bedbbe2d76c7b25785d86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418862, "uuid": "0354b814-0df7-4e0d-b29e-0b7f6a72fb14", "comment": "Malware payload (RedLineStealer)", "value": "72ed9a6d3da7acd289de898ea0657b9265767a8659c29de1a864b95aa501c232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418862, "uuid": "79e7ae79-2084-46fd-a6d9-74c46b38daf9", "comment": "Malware payload (RedLineStealer)", "value": "b454688ce1b400e037af546909fbc8cab87984b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418862, "uuid": "d04b6bd7-c437-4782-a75b-b983a6fb7603", "comment": "Malware payload (RedLineStealer)", "value": "3d3cc1b7614b03c51f0308442e96a7bb297a7ff99056936cbfe634979d8baaf35c9bce12375a5bf910e96d70d6928696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418862, "uuid": "a8dbe2b0-8b30-4b6e-9374-47a606634ec0", "value": "T18E7429C03398B9CDCC4F8EF161611F688A70D452A257BB537C8BACFB3859395AE055E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418862, "uuid": "13aabea4-11e9-48d8-a78d-39e38d0d138a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418862, "uuid": "6fe3000b-da52-4677-9622-02baf08e6244", "value": "6144:xEV3quCt4RQ5644ehC6V3kf8MM2bdpN1aLTi:2qAI48+M2bd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692418862, "uuid": "18f61060-13ad-49ba-b887-2d457c5bdaf3", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692418862, "uuid": "e5f2daee-cf5f-42f5-aae3-8359a0d8f808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418862, "uuid": "d9cdd489-fc45-459b-8411-e26fe0b190e4", "value": "1d1ed1d3d73bedbbe2d76c7b25785d86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4e41d2-3e5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692427985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427985, "uuid": "4b457919-e374-44ff-8221-886b96aaa8da", "comment": "Malware payload", "value": "236db7bca90c431cf7e4671ad66c00b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427985, "uuid": "502fc0ab-1ff1-4e9f-8694-a21cc97105ce", "comment": "Malware payload", "value": "73ec8669c47abd618e280311c9df62c3bbdfeb450e7ee9ea3e92560f821615af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427985, "uuid": "b631a6c3-6dc6-4222-accf-f59fbf7ba010", "comment": "Malware payload", "value": "a7a9dd4e0c70b12e776402cbbb53ec7cd8dba436", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427985, "uuid": "9ca8bbb2-7253-4e96-9caa-7fdd4f996063", "comment": "Malware payload", "value": "43ab691206a551dc5bb120332238f4ea5298906c4d42a3948533296159694a8dacf9b45bd44877f0b6d985a744d43740", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427985, "uuid": "1e2c5c32-5693-44d2-9334-2d85c40b5330", "value": "T1E6D2D1CC60A6F87BC99D5CF4525D13A249B099D0328E43DC9B128CD8F67AB87B11D4BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427985, "uuid": "6432552e-f5c7-475f-955c-8f1e6ab994d8", "value": "768:h6YWsmDlIJcBxNPc45TxajUxye1VNlYxWr:h6YGDyJAPx1qUEQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692427985, "uuid": "ef22d9fb-2aeb-47e1-8687-3d826ef59b59", "value": 29284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692427985, "uuid": "b6d30156-f62d-4d48-971d-4bf5d034a690", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427985, "uuid": "932fe484-dcb8-44aa-b560-94c3e82baaad", "value": "236db7bca90c431cf7e4671ad66c00b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4c5062-3e75-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692438377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438377, "uuid": "3f51648d-6359-4bb6-8330-8cae0500366f", "comment": "Malware payload (RedLineStealer)", "value": "f497be70573e3a4cfc122af82edc822d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438377, "uuid": "343faade-9b30-4e48-bc3d-a0be32491e98", "comment": "Malware payload (RedLineStealer)", "value": "753d498b51ca76be3218a2ce7fa90488b8e129fe4733db056cd32ae06c539d92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438377, "uuid": "8d25f387-a20f-406a-b642-15c2b665fe4e", "comment": "Malware payload (RedLineStealer)", "value": "da01174d4b312c855112683f9ce77aa1648e91b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438377, "uuid": "643b3cd9-fc56-410c-ae3d-8ce619d7e2cf", "comment": "Malware payload (RedLineStealer)", "value": "f58728c21f33981f5ab21da0031410689ffb4d3af8d87bef40b1db747689a37278d59df4fc8dda148dc344056b4aeb9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438377, "uuid": "860dc95b-8191-4ac0-a9a8-d2c79bb9c95f", "value": "T1A9052216EBED8856CC741BB099F703970B353DF28DB9979E13909D5E0CB2584A23932B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438377, "uuid": "d77111fd-68b2-4758-8f1c-c10b84275b7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438377, "uuid": "de115334-0ef9-4803-b706-fa333037771a", "value": "24576:eyh+NGmKOdGnYkYnF2s87aGP8SV0RNpQ:tTOdGnfYnF27R5V0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692438377, "uuid": "65119c32-9064-4cd8-a316-e6edc3f3334f", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692438377, "uuid": "56652720-0fac-472c-8f85-6585981474b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438377, "uuid": "6c35548c-a297-4f36-b298-b3f705479626", "value": "f497be70573e3a4cfc122af82edc822d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b7232d-3e8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692447702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692447702, "uuid": "ecf07bb9-9ef6-4e14-b153-812eaa57a9e0", "comment": "Malware payload (Mirai)", "value": "61f73ed39f217b3555cbfa7376d3bcb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692447702, "uuid": "8dee58a4-a3cc-4655-93fa-baf0c3b30602", "comment": "Malware payload (Mirai)", "value": "7699a4a283c78410c50e6c34f0d0e1eeabef9c677d50d9a46f6315acc7646512", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692447702, "uuid": "6775636d-a4b7-48c2-a32b-9d74e1860cec", "comment": "Malware payload (Mirai)", "value": "00a867f60cc4bd6a20bac03fae7600f9f26cbe20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692447702, "uuid": "af028d2f-548b-40bf-9311-d5e8c5575198", "comment": "Malware payload (Mirai)", "value": "b4f87c676d52b22f71a4b97dbf940f384a308c0d561bd6c7a79c0b257be9c4c81039dea49a05f51111fea9cd63881e90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692447702, "uuid": "a3835d20-cb32-42ef-8ca9-c35f78c9ca51", "value": "T11B63F682BC80E616CBC01677FA1F518E33156BD9E1DA3342DD265BA07ACEC1B0D6B746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692447702, "uuid": "d29a3c5e-7d6b-411f-ba0e-c18d148e3150", "value": "1536:b4blEKw06Z1XjuxfEQPqm5YB8t46zHMeJcH:b4bllw0W70484EHzJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692447702, "uuid": "c80a3421-6664-45c6-96b5-d276f3f490d4", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692447702, "uuid": "467d1e8d-cf94-4eff-a0e4-b8bcf2f9eb30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692447702, "uuid": "868ee852-3b57-4d7c-a4e5-5f174cf1f328", "value": "61f73ed39f217b3555cbfa7376d3bcb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce94d916-3e46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692418432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418432, "uuid": "ee8e1a77-1fff-41db-8607-a95b65394878", "comment": "Malware payload (RemcosRAT)", "value": "f3f414f46daa3779ea3103c418b35d0d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418432, "uuid": "e285d5d0-5c44-4122-815a-8f42bdc1720c", "comment": "Malware payload (RemcosRAT)", "value": "77b6482e415499d039fd94dc2c588217bb71bd6f3da0747c53a439bc9490fbed", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418432, "uuid": "0400f9ad-adaf-4a03-9cd0-c380f68a95a3", "comment": "Malware payload (RemcosRAT)", "value": "2b3adc2bc3f4e40a855252a7931b8e24475d7488", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418432, "uuid": "172b0b82-10f7-4dd0-aaf9-c8c09d355819", "comment": "Malware payload (RemcosRAT)", "value": "811ce5be2e0b14fc99e0275a6fc02ddb25dc6a2ad9030ab08566fc5c19fe24d799964e33ed3564c89ef19be6fba27eb6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418432, "uuid": "d9de49c1-92d9-4728-968b-16f4bc0c7414", "value": "T137352360BE0ED3DDC591D270593BEB1C2E543E7DEC6536F5728A6BCB1275A08AC32128", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418432, "uuid": "7eec3973-9ab6-4f55-a896-7bf2fb4901ca", "value": "24576:OjqxtwQzFBi3ZXkcWFSlqbh/gAZ3QZYPFznOSa5:OG8QzFO9kcWt/Z3QaPROSa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692418432, "uuid": "33801485-77da-4c9b-8baa-019da3881755", "value": 1104299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692418432, "uuid": "45fce296-8394-4046-b0b9-2d14093c0629", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418432, "uuid": "8379df39-3860-4b84-abf4-436d59de5050", "value": "Rooming list.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba0677c-3e29-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692405650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692405650, "uuid": "c0bb736c-93a0-49a4-87cd-10ca7315dc49", "comment": "Malware payload (RedLineStealer)", "value": "0521e4a3c3b66345306c573fd162020d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692405650, "uuid": "cb3b41af-1bbb-4a7c-92e9-7c7fc3c4358c", "comment": "Malware payload (RedLineStealer)", "value": "79979f9c74f039b33a61b1588681e74d1b18bc09f622138faeb112b9dad0ea65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692405650, "uuid": "a92347c3-c69c-4eff-a3fa-6bacec572c37", "comment": "Malware payload (RedLineStealer)", "value": "418f8ae9c852073d2294d3fbf49b3e1e23608e55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692405650, "uuid": "45031e18-1164-4cb4-991d-7a01c8cd0cfb", "comment": "Malware payload (RedLineStealer)", "value": "f51491a671088fc3a4954112fbf20ef20154bfeb6d660656621953fd963840b7b1b8d4edf9eefd4334ea565bc3952b93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692405650, "uuid": "43a23de7-d599-41e6-9a00-179114587494", "value": "T15923F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692405650, "uuid": "980a5960-f96a-4564-bccd-1fc25496873a", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692405650, "uuid": "a590bd6c-2355-4306-9aaa-055695bb4355", "value": 45978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692405650, "uuid": "fa43d0e4-5130-40a2-b2f1-f03a86344251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692405650, "uuid": "a6e0d81a-b1cb-4578-8eea-c96e5a92dc83", "value": "0521e4a3c3b66345306c573fd162020d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29eb852b-3ec0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692470555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692470555, "uuid": "89d9612f-79cf-49b5-b6c7-7e9875f16760", "comment": "Malware payload", "value": "0cb74296cc79ff0a20f5046f8e80d7b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692470555, "uuid": "eaa618f3-fb15-472c-a988-d2e12888a626", "comment": "Malware payload", "value": "7a2d2e9abdd5d210007969efc6ad1bbec322329253895fd09b60d9d118e03129", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692470555, "uuid": "35a01417-efd6-48a2-a8a4-c8b7d2e5bd38", "comment": "Malware payload", "value": "175c5b445ea486f2de1c6e0771855768018726d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692470555, "uuid": "b9e1c21e-e679-4e1e-9f7e-24ba034b1207", "comment": "Malware payload", "value": "54387648f89069f567b9f5dbe17372fa9274c6d38db4eda6f1f07f684ab09ea63c0d653c6d3029994e4a0550d4a8d888", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692470555, "uuid": "2b72c5ec-15ca-4ce5-ac2d-cec472553c41", "value": "T130C533CCB9978909C6A6EA3CCD3153CE4721BD502E74391733EABFCA6677212196B1C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692470555, "uuid": "716457f7-058b-4363-a529-8530a12d8e53", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692470555, "uuid": "f786dccf-2756-4fbe-bb19-c376cf0c5efa", "value": "49152:GdOSvW+BpGy9/5DL3C4wvsdb9Nt8iy+NZfTJ5XkrwHF9fJKDNTn:oOYW0X15DL3C4ispzt8KPTTsTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692470555, "uuid": "c5dd501e-303c-45be-96a1-651259106342", "value": 2578944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692470555, "uuid": "d28b3058-8429-48f9-a05a-c1ab804f2c13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692470555, "uuid": "1b9c0731-ab2f-418e-b27d-63cdf03cc3ac", "value": "0cb74296cc79ff0a20f5046f8e80d7b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4130548a-3ea9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1692460715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692460715, "uuid": "136a9400-1e6b-4a4b-9cb1-957049042985", "comment": "Malware payload (Cobalt Strike)", "value": "4a82732a29459d7b81bb53c8f1a778e5", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692460715, "uuid": "610d241d-26b7-42d1-951f-63e595c4ccb4", "comment": "Malware payload (Cobalt Strike)", "value": "7ad79f28a7e10df617a55f85d379949f65fa30770966d889d899c94734e24cca", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692460715, "uuid": "693c2bf0-456c-4065-a55c-7a32ec477ce5", "comment": "Malware payload (Cobalt Strike)", "value": "09cfec9d530cf471423fc062f21ddf23d29a04c7", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692460715, "uuid": "9385addb-1460-469c-9713-68e4d50b1096", "comment": "Malware payload (Cobalt Strike)", "value": "f00d9cf1733243d022886203c2f5fa7a84b3916df2528dab123a224a4d2f2d13048c9a033fafc7d38718be9683168e42", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692460715, "uuid": "1796b0e6-b2a4-4c02-94a5-a852f1e15377", "value": "T167445A4532A03DF5ECA7D67ACA534616EFF2BC624630D71F03641A5B0F273A1A22E752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692460715, "uuid": "3f3b2412-5401-4893-8c72-0c151df5baf3", "value": "39a613f0d59cc3ef3bbadfe701521e7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692460715, "uuid": "4b23819f-e173-4d6c-bbf7-4ee0550ed974", "value": "3072:mJwpS2NACV4qAbypuljJGnJYoTjqETdtbsnOfFwXVa/o494YJGaXMXhwHnaHL:mJwpYVNcn3pTdNe+WXVin4utHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692460715, "uuid": "9583f261-1159-4992-a6e8-de147a1e2054", "value": 260609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692460715, "uuid": "93c6dfcf-3906-48df-bee2-1293df2f0bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692460715, "uuid": "00357c4c-2375-4940-83d5-06012cc38ae7", "value": "b64-2-xord.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaba35d6-3e5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692428251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428251, "uuid": "5bef4c9f-8333-45d2-a500-13bd9ac47ccf", "comment": "Malware payload (Mirai)", "value": "cfffbc09978b5ba3dde64e02bc8f3164", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428251, "uuid": "da6e4771-127b-4d23-b86e-5d2b93670ea5", "comment": "Malware payload (Mirai)", "value": "7bac0d9b64d6eaf081c88f04f7344cdd1aa4e9e434e63144a7d4b16fc141ac5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428251, "uuid": "35f1d28f-5270-4704-8926-d349e2eecc49", "comment": "Malware payload (Mirai)", "value": "7b554ab332e53f73bd714b6a8eec4a6623c6a2bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428251, "uuid": "efb8c9f9-4a6e-4db9-a430-a59c6686c26a", "comment": "Malware payload (Mirai)", "value": "ee42a765f6f20250c33019f8e0e1cfbf8dc39a28039502917c038f0c02142fb064c8eeaca0e093dec2bf02c582f7fa34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428251, "uuid": "6930c628-1f20-424d-90d0-83993738ca54", "value": "T106C2E1A3A4E9CD19C863413B6E1F1A9B61386524134DEA1E323FABDC63460B4A176DC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428251, "uuid": "a6431756-03eb-4cb3-96d4-28f0902ca3b0", "value": "384:MRG/9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5cwd/DyZTYHHJC8oytPFnAqV/LlTu:/5+Kcrb9VDJeIwkTYTlPFnz/W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692428251, "uuid": "32c55886-0fc2-47ca-ad5f-3790aae484ec", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692428251, "uuid": "98a563eb-e344-42c0-9bcf-b7f161439047", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428251, "uuid": "7bb20f5a-7fb1-4da9-8ff0-9392d2c711d2", "value": "cfffbc09978b5ba3dde64e02bc8f3164", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9c1bc9-3e5e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692428767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428767, "uuid": "449ed6c2-d072-433d-a153-8d0360dae212", "comment": "Malware payload (RedLineStealer)", "value": "333cdafa8fc8b80d08871a49fa9fad78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428767, "uuid": "d167301a-1317-4f15-a957-765a22fee270", "comment": "Malware payload (RedLineStealer)", "value": "7c09957a97d1a5fae0095c3c02a83e6c5ee2446b3bf789ac28b670aa5f91774e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428767, "uuid": "59df85a3-fbd5-48e1-91c1-b55bee206c2d", "comment": "Malware payload (RedLineStealer)", "value": "2c0c3baf71e0d85f6c520cd962381537f9d997a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428767, "uuid": "cd3a2a51-6e14-47dd-9dee-3336af9f5ba8", "comment": "Malware payload (RedLineStealer)", "value": "c92377270e1697d719d490439fecce01ffd1e6a82da8e3c90b3b1f31ce404137c475db4c2dd55c2f1401311238ded745", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428767, "uuid": "c40e2376-1ac0-4450-ada3-5f6b984e4047", "value": "T1FD052263D3F98463DCB527700CFB06971731BCE099B6835B27826A6E0CA75D4A87172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428767, "uuid": "63ef11f0-d62b-41e9-8662-aa4be0df1b29", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428767, "uuid": "33fca415-e835-404b-abfc-ef8aa3bc21e7", "value": "12288:UMrny907NMc0obykg4qwgAtS3vXplH1YgSLK8uRegnjHfE3QYir/C3vlwLKA:Dyhc7bykgFFkSfXp5Um1njHfEkru6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692428767, "uuid": "b5f2f852-2696-40fb-9131-af6f533b5214", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692428767, "uuid": "99695d76-7ab2-4a2c-ba8a-6e6e041e19b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428767, "uuid": "b92210a3-d52a-4273-9088-b641123e086e", "value": "333cdafa8fc8b80d08871a49fa9fad78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39541563-3ed4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692479171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479171, "uuid": "4e120327-5112-4c0b-a4b5-5abbf9c2762a", "comment": "Malware payload (Mirai)", "value": "1a0df7d94e7064ad0e7accfcb82c1f1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479171, "uuid": "9218a5ee-3f71-41a3-8236-daef15be2177", "comment": "Malware payload (Mirai)", "value": "7d584c03e4ed45a3d346881fba86d778dc7c71761a3d06c96f6bb2228de48513", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479171, "uuid": "68195284-0e98-440d-bd01-90ec4844c98f", "comment": "Malware payload (Mirai)", "value": "cb93ce670598865500ce001c0bd2cc7813d3e66c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479171, "uuid": "cc3b7e37-7e42-4f54-809c-4d4f2c12859f", "comment": "Malware payload (Mirai)", "value": "44b3a7d3d2468b9800bf47d026cbcabbcfb765b1f2f9b02ff5875d1e5da53b8211b984a7289ec1eff1ed022e47d0cbd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479171, "uuid": "81413243-6aa1-42c7-9795-7076e74c2324", "value": "T1E9B3C40ABF610FF7E8ABEC3745A92B05249D550B21A97B75B930D828F61B60F19D3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479171, "uuid": "e5907471-63e0-4232-b94f-f8ca4c597c52", "value": "1536:g9DYWFx+xx+AaEPiZMR2jk2EkZ+BzYcjKoOvDBgplbngVZ14hvG:gqWFx+xUA06R2hEkZ+BZpZK1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692479171, "uuid": "c728f8c0-4029-442d-aa33-7134c5121737", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692479171, "uuid": "79cd11b1-f463-4622-b3c4-93c93d8077b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479171, "uuid": "ba8deffc-9e8d-482c-a100-a344f9c5579b", "value": "1a0df7d94e7064ad0e7accfcb82c1f1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8da6f6-3e69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692433485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433485, "uuid": "1e1f1c3b-7b37-4e8f-b59f-28ee78f2a8f0", "comment": "Malware payload (AgentTesla)", "value": "4b054b446201881a584d41cf7c9e4680", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433485, "uuid": "457fb3f3-cd6c-44fe-86f9-d6ad7015b108", "comment": "Malware payload (AgentTesla)", "value": "7f963762e0a5ab3972310b33f67a123ba3607338da8d1a5426e42dd8f2aca9d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433485, "uuid": "d9020137-56a0-49c2-ac5d-fdcdd44854d7", "comment": "Malware payload (AgentTesla)", "value": "9baa1896456aa1ceb25ab1e5bc8ea5d8490efafe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433485, "uuid": "c568bde4-172b-47b3-8dd8-974e6df02a6d", "comment": "Malware payload (AgentTesla)", "value": "5713908b0ba4ced0ede444439fff2da9a6dd45b2aafaaa6fc3e398764b1fde66113db0ee0806b618f38b491fcd956869", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692433485, "uuid": "a72e35cc-bda1-4971-b2ce-c3ff50b40bc6", "value": "T1A2F4336DF5C128005477E4F0B974B49AD2E37F9E24E6F39332D886E48BA69910390DA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692433485, "uuid": "cace05af-d982-4d46-ad81-49162ef1b4f1", "value": "12288:NCnWhRMrbM25z2/P3t1qImH3EJ13HFQxIBT66VFJu5fe5GSN1r4YQQthmDgJpTj:gSMs25z2nr6wR6xIBTpls+nJthmDgJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692433485, "uuid": "5a338efc-0d00-42ea-a14e-196a70c72ed5", "value": 757740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692433485, "uuid": "6352f208-db44-4e12-b966-46989741bd85", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692433485, "uuid": "b3246780-cf3a-4e4b-a3a8-4a23db13187a", "value": "926__INV_20230819.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804457db-3e4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692422167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422167, "uuid": "76cf17a9-5c7b-478b-8cc9-b2798b666323", "comment": "Malware payload (Amadey)", "value": "f3487b626bb2a67e05a0a99868c65014", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422167, "uuid": "7f776737-8ebf-4032-960b-57cbf97f242c", "comment": "Malware payload (Amadey)", "value": "801d10a862b8a0a2b425589af8de24a55271d4c0aa28927932993927e2cfc58c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422167, "uuid": "f03881dd-24db-48eb-9d1b-8f9995de29af", "comment": "Malware payload (Amadey)", "value": "e13f77ccf395221385a8e0b4ab9216e5f851cf7f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422167, "uuid": "35893636-cd2d-4220-a504-385aef760e7d", "comment": "Malware payload (Amadey)", "value": "cdce29165be52e620b9d79352ec67c9253a41b8a720eba75142361563bf20c13d9a748e2d139b560e989874a76ca78c1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422167, "uuid": "19ef066b-efae-44d1-96a2-288a2f2a956b", "value": "T1AB05224B96ED0572EEA42B7498FB07C31F34BC908A7097376391981E68B2AD4F436375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422167, "uuid": "c8c1ab1b-46d2-48a1-8458-d409cace6ae6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422167, "uuid": "a0128b57-6f38-4930-b393-ad1e4809a284", "value": "12288:JMr7y901HcL9IVNSLsoJttcrW3K5WnIbDeiNDKRWrXDp7ahYz80pCqN79cUbqGxA:GyFNYCKUIHPJK8rdXzHpN79cOqGjnBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422167, "uuid": "c5a90303-7ddb-4b58-aac5-eebdbddf3434", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422167, "uuid": "3f23b99a-b994-4419-9e1c-e3ebb6446ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422167, "uuid": "3b9c40e9-196a-484f-b810-bb26143b5263", "value": "f3487b626bb2a67e05a0a99868c65014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40ed05e-3ee5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692486678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486678, "uuid": "8dde7ed3-f9de-42cf-a721-335e985cde85", "comment": "Malware payload", "value": "fea76e09843cf754e07942081c1df4cf", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486678, "uuid": "53cb9235-eb52-450d-ba97-cd17cbf13948", "comment": "Malware payload", "value": "80bd5c61106374e56b3c48ff58d5729e58e4f9ee4aa9668cb4b4fe39c0f8751b", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486678, "uuid": "5f90c345-d443-40d0-a2f2-6d9061b729bc", "comment": "Malware payload", "value": "768abbd8964e992822867112c3c5d5f05e2ac70a", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486678, "uuid": "61a2a266-565b-43f0-9d46-31fff6077f52", "comment": "Malware payload", "value": "c3cf486a9aee1b67e36dd36082bb69e0238ff43295af1b63ee37dac3f71173c6262d2fe504450a5e33acc2b2ef90f6d6", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692486678, "uuid": "77da0a46-b066-459a-a9bc-2dd669034234", "value": "T1CBC08C20412D8828802B0508850C8EBEA81351C0215BCDB012F25948EC620161E4C0C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692486678, "uuid": "9b545b94-3db2-44bb-844d-05b4cd3416df", "value": "3:HRAbABGQYmimmQ0UEg5xtNRBv2Ne1YSo/QJ5HCbyYesbBSn:HRYFVmi3nOx/RZISoIJ5wyYesbBSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692486678, "uuid": "f773d4c6-7f05-4b05-926e-1f90a91b5b20", "value": 142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692486678, "uuid": "ab6ea4ed-676a-474d-abe4-5b498c67bfea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692486678, "uuid": "420fe913-1155-4494-a4ed-4fff42ac7074", "value": "enlc-stb(download(upd))ef.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125d78d5-3e63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692430572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692430572, "uuid": "9fccf525-348e-436b-99fe-3dda9a2643c1", "comment": "Malware payload (RedLineStealer)", "value": "7bc9411bae154221ea5338e525ca3e8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692430572, "uuid": "642e0b4d-9661-4a14-b8b4-6e78b6e2a05a", "comment": "Malware payload (RedLineStealer)", "value": "83a6e817501b035c4d46ab98af2a5c4403f082a02a0a4c80068feb580d2c3a24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692430572, "uuid": "8d63c270-6a2f-4b0b-a8b7-e9cc108be9de", "comment": "Malware payload (RedLineStealer)", "value": "88c62dcd1c35ba09b4afb1963767cb149317b4d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692430572, "uuid": "aa18c1fd-3ebf-40c8-92db-e5df4e898e82", "comment": "Malware payload (RedLineStealer)", "value": "406b4d973a5679fba12098310e0c5aa46668ecf517e3006d90c10e3d55cac02e7759885204da49a83b763770b002d5ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692430572, "uuid": "eb95917f-ddec-4cad-8aa0-4fb6871cfc17", "value": "T15DF41203ABD55072EEB817705DFA46830B36BCA05A78CABF7356284E08736D49936377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692430572, "uuid": "798d9582-5b02-4498-9441-b9647428b54a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692430572, "uuid": "5d1f1b7d-2612-49ca-8151-447aa2b29cca", "value": "12288:kMrFy90nIG3CsK/dGerMmC4452+deiMqWD7C9CKAme7nLRKR1uXzp77saXM+B5YY:xyMDCsK/dFBwdexqWDWEv97n9K/utlXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692430572, "uuid": "09d2fd78-36f7-41f0-a6c0-867539f86273", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692430572, "uuid": "3780cec8-90e1-44fc-83df-ed30d5653f78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692430572, "uuid": "10204d5e-207c-424d-ab82-c6edda7674c8", "value": "7bc9411bae154221ea5338e525ca3e8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb057b41-3e8e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692449404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692449404, "uuid": "c8cc2eb6-2472-4ea5-bb51-08a5625b95ef", "comment": "Malware payload (Mirai)", "value": "a8d7677ee8d0a71c52e521f8c82c3b19", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692449404, "uuid": "404343a8-08aa-4735-9c5a-52e9b6a656b8", "comment": "Malware payload (Mirai)", "value": "83d2059a2c2aca3ead932f7dc3a500db615062f4ab92894b96bc496ed94b11f7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692449404, "uuid": "a985ce55-0e72-4efe-be6c-8456be33a43b", "comment": "Malware payload (Mirai)", "value": "7ddfdd6ebd319d579aa8be85e820e2d5e962671e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692449404, "uuid": "30776f00-e910-449f-ac8b-1c765893f50b", "comment": "Malware payload (Mirai)", "value": "fd85f7aa41b81edf8d7c69e320ce9beac190a03154d55d1b4322dac14c170f98f9904ab9d571ce6d97c3a00ee46d6820", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692449404, "uuid": "20a689b8-9695-459a-82cd-bd7f97123370", "value": "T155E34C86FA408A13C5C61B76FAAF424A33229B55E3DB73068D185FF43F87A5D4E13606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692449404, "uuid": "d9297916-1258-45af-acac-81008853695a", "value": "3072:Pib6EdR0WkESrJYqNo56juvMuK/U6YQXZaXWZ2M/9c/r:WnRpkESxhuvMuK//YcaX9M/9c/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692449404, "uuid": "99a5656e-5361-406a-837f-671d229cf6db", "value": 144087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692449404, "uuid": "4335a8fa-19d9-461a-9cd1-802a1ad47714", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692449404, "uuid": "81671c61-6b71-470b-9ee7-586f8d49a85f", "value": "Mddos.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bb182c-3e7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692440476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440476, "uuid": "f4d4e974-f72a-4084-936b-0d213c79a771", "comment": "Malware payload (RedLineStealer)", "value": "16399fa3e9a86bfbad246327af72dc87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440476, "uuid": "b9198851-81df-41f1-b6d0-35348a93430d", "comment": "Malware payload (RedLineStealer)", "value": "84a1cf2cb1b60b367e5ad260ff65e48aedda519f1a9b061409d168a66cd7e3dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440476, "uuid": "3580a685-a505-42cd-8351-e60d95d1af64", "comment": "Malware payload (RedLineStealer)", "value": "56af190a62c7f8ab601a3c1c4ecf3f1400903338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440476, "uuid": "64f1dbcc-e790-43bb-8336-858e1b702a08", "comment": "Malware payload (RedLineStealer)", "value": "095499893aa8d2a89b1effea097bec4eb6e00e10daa2c397712f710aef35347ebde11795ae003241bdcde6b5942c2283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440476, "uuid": "f0f8a2c2-17bd-448e-8e78-d720610a3b09", "value": "T10C252256B7D844B2CDB50B3054F523870B357DB29D7A936BA781AD1E08B3AC4B83172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440476, "uuid": "83dd227f-d361-479d-9814-d68452d1cdc0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440476, "uuid": "8c26c9f4-b15c-46e8-aa1e-927fc2951ccd", "value": "24576:dyzQBCaT5MuinxcvmLJ+vTexL2MhwHZ8pjC:4zmMuuxcv42Texlhw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692440476, "uuid": "955f7dd6-79e9-43a4-ac8e-585a3374d9c7", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692440476, "uuid": "98a779a6-5499-4939-9121-516d1b6441d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440476, "uuid": "3bf16d89-aeff-4cd0-88ae-5346fcd292a3", "value": "84a1cf2cb1b60b367e5ad260ff65e48aedda519f1a9b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f52b76-3e69-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692433184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433184, "uuid": "7020eaed-5952-4a6b-89e8-20d8850908c1", "comment": "Malware payload", "value": "ac543b7737bd4b85e2efbbe8d63d3893", "object_relation": "md5", "Tag": [ { "name": "146-70-158-173", "colour": "#46FC62", "exportable": true, "hide_tag": false }, { "name": "IWRReverseShell", "colour": "#03735C", "exportable": true, "hide_tag": false }, { "name": "ReverseShell", "colour": "#726911", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433184, "uuid": "fa3ef8c9-f33d-4b6e-bec3-be10860f02f9", "comment": "Malware payload", "value": "84ceff36090f2db3e2332d769fa2bde43636b30cc9e9485203afd724d39e9da7", "object_relation": "sha256", "Tag": [ { "name": "146-70-158-173", "colour": "#46FC62", "exportable": true, "hide_tag": false }, { "name": "IWRReverseShell", "colour": "#03735C", "exportable": true, "hide_tag": false }, { "name": "ReverseShell", "colour": "#726911", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433184, "uuid": "4691da20-864d-421e-8e1d-1fbbccf8cded", "comment": "Malware payload", "value": "ad1f194358eb71ac6a1d458788d08ecbd1750100", "object_relation": "sha1", "Tag": [ { "name": "146-70-158-173", "colour": "#46FC62", "exportable": true, "hide_tag": false }, { "name": "IWRReverseShell", "colour": "#03735C", "exportable": true, "hide_tag": false }, { "name": "ReverseShell", "colour": "#726911", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433184, "uuid": "ccd14858-4f1a-4b25-9997-63feb61c1dbf", "comment": "Malware payload", "value": "ae3da7b15722e4fe7a3ff069cfe917a3748094d06382a352b28919c312e06d8123c774c662206432ae4f0dcc109a2ef0", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-158-173", "colour": "#46FC62", "exportable": true, "hide_tag": false }, { "name": "IWRReverseShell", "colour": "#03735C", "exportable": true, "hide_tag": false }, { "name": "ReverseShell", "colour": "#726911", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692433184, "uuid": "9aefe43e-a732-483d-a5db-baad34384776", "value": "T11311E37DC5B4FCC4036CB54006243FDA21949D37C2765A94D6920C963D29746FF2729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692433184, "uuid": "fce9a0cd-9b5e-4786-987d-132f82ac23eb", "value": "12:s8A9sBFZf6AfOYsXktFCoS9uI/JM2XCejk8N0gYna2ru9Cejk8N0gYdlLkRC1xkT:336hYBt4B5rVegOa2seg+CJqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692433184, "uuid": "3ce47a03-81bb-4802-ac5f-3228abbf695b", "value": 860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692433184, "uuid": "fe613435-fde5-439e-ab7a-a1af6722b057", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692433184, "uuid": "a1afdc00-3a9e-409a-8cdb-badf3dfdce88", "value": "BD60WZZq.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ca3aa6-3e73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692437777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437777, "uuid": "0956a87f-98e1-4102-b038-6e7a54500f2b", "comment": "Malware payload (RedLineStealer)", "value": "0d4056c6a8afe95f316cfdd08342f28d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437777, "uuid": "953947a7-c263-470b-8d10-9e1b2289acef", "comment": "Malware payload (RedLineStealer)", "value": "86323a80511c7c3cfcb6525592366efe03866cc196101d58d2157ea1bcdaf6aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437777, "uuid": "da1baf62-b235-4f24-8a19-9b23d4663a17", "comment": "Malware payload (RedLineStealer)", "value": "89fe0c05a70a9825be22196a4ed930876e77083c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437777, "uuid": "9e9ee30b-2a84-4c1e-bc73-0156418becda", "comment": "Malware payload (RedLineStealer)", "value": "11f0fe2ef6cb1f8bf14af5c8c6aa5cb741b748e6b35a2c9a396d79fbcd000c9e6c38a43df0263162b1b1ea3deeef13a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437777, "uuid": "a0df52ea-064a-454f-90d0-5edb3d7fd243", "value": "T1C8052203FBDA5133DEF167B068F606C71A367C52586C572BB395686D0C72A89A43233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437777, "uuid": "82fd9d4d-b16f-4134-a941-5ff2f3cc2c10", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437777, "uuid": "4e03bc6d-dc72-4e4a-b5dd-8bc0ad1722a4", "value": "24576:fyRlRo7FE0CeQvwXu7goKorsOXQ8jvoENpWXx:q727FEXehXusoKorsOA2o2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437777, "uuid": "4e75dc6b-9b17-4775-b489-53c42c72a303", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437777, "uuid": "650135ea-0b7c-4702-be9b-e60800bb9da2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437777, "uuid": "9b21dae8-cc0f-4259-8e3c-90c7cbd34130", "value": "0d4056c6a8afe95f316cfdd08342f28d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613c3d3d-3e42-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1692416531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692416531, "uuid": "03e05883-9b35-45ee-bca0-83e8fbea2c85", "comment": "Malware payload (StrelaStealer)", "value": "7d7c79af0ea8ddd5ba251d0f9a34667e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692416531, "uuid": "342d75b8-7d62-47d6-a050-8fc40818ee10", "comment": "Malware payload (StrelaStealer)", "value": "87f3de379c3c126d924791f31cec59d4eb5cbe5b63f1a307b11890dafaf433ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692416531, "uuid": "25331d4a-cca6-488c-a96c-062900e8bd18", "comment": "Malware payload (StrelaStealer)", "value": "09a1563b1cc9b092cb0027d06d633d8273a28ed6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692416531, "uuid": "e1f1be28-024c-48cf-a252-87b0e3f493fc", "comment": "Malware payload (StrelaStealer)", "value": "538900f838b7f21593d0ffdab2159283d4971d4b3232937b230b909840530e595a14eeaf83665469e00ac72c33587001", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692416531, "uuid": "4b9191c0-ef69-4b73-9b7a-308bfbe6ec7f", "value": "T14516D7F4B2517AE60FB4191DF38F80B26C27B85BF0BE5ECA2265195DC5C4284D9E6CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692416531, "uuid": "6816af91-4c4a-4247-84dc-0e04bca5a623", "value": "24576:7kYjISU4NCYkYuEhMml0/WoLScl7ADF+ToUwueEYV+WeEzJooRBADu/E1bpfFUN6:7ktRp4xutEmUeUbUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692416531, "uuid": "a05a6420-f8f2-42b4-bdec-07d5bd1fd6dd", "value": 4213259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692416531, "uuid": "9b5170ab-f12d-4e3b-9ba8-2b6fde119811", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692416531, "uuid": "a12a25fc-7587-404f-8e52-47dd5a124a8c", "value": "137881292511868.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa39ac2-3eb6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692466556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692466556, "uuid": "31aa2b6d-6de0-4c31-ab4e-0848822f5497", "comment": "Malware payload", "value": "aabf9d98a82913dd8933cab118cce866", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692466556, "uuid": "b18ac08d-1930-4a5b-8ff6-c5a1a99a03ad", "comment": "Malware payload", "value": "885b24b4b170b86c5c963324a78f9525b758bdec0bd4c254d7c1083a43e0e3be", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692466556, "uuid": "916a5f7b-9653-4f16-9f27-38615a7bd345", "comment": "Malware payload", "value": "a2315a060d193b578c059580d005b4bd5f21f2e8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692466556, "uuid": "c3891217-6a1e-4e4a-867e-70a5e6044838", "comment": "Malware payload", "value": "8fdff3ceca5763085ad8d2d979b93ffb934cf85f6eb4958e87beeb612b630e815ab4512b2210790617778ed595f4aae8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692466556, "uuid": "44431c40-b8f3-4fa8-bd7d-0c60e8abacc7", "value": "T1AE472386FBA9C92FC87B1132446A4771226B4D12CF829F47B948371C6D77AD80F49BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692466556, "uuid": "5b68df83-4b83-4fa2-9613-7746e74b2bca", "value": "393216:ma4No5ttMngM5Vhl22cFVyoFYknwcR24of0vNujGD58+JzKjMMfTteUaPXUq:maoo5tmHVX22uMWnwzXgsjw6+JKjrtFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692466556, "uuid": "032c0085-8dab-4360-b8cc-3512b8e68857", "value": 24626618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692466556, "uuid": "952f8ed9-8193-4136-92a2-b4f1ddc3127c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692466556, "uuid": "b1ea3fb9-a20d-49e0-b902-635cfce6eda3", "value": "com_app_happyminer_aabf9d98a82913dd8933cab118cce866.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcc5ea4-3e4b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692420361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692420361, "uuid": "04b5689d-c768-4f3a-b854-20e6bde91012", "comment": "Malware payload (njrat)", "value": "262cb9fe276a73f547aae0e91c799435", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692420361, "uuid": "f96f05e8-73e4-469b-8fdd-32818b547a80", "comment": "Malware payload (njrat)", "value": "8a0ee7d1af6f42a169a239ea1e8370726c52fa5b8eff3269ae9c69066442371c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692420361, "uuid": "91164843-3e7f-40b7-afbb-c6a5a274f5ed", "comment": "Malware payload (njrat)", "value": "697a363509eede0cd0c703639849d860d776f4ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692420361, "uuid": "b736b1ca-21bc-4f39-9df8-4dfefee57609", "comment": "Malware payload (njrat)", "value": "fbc4ed18db7f01e22ad731d7e7758ce7369c95f475c1f8f44f11b2b1d0b6e356ce4e80873c9dda872b11491b0a27402e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692420361, "uuid": "a45dc0fd-b34e-4b2d-aaba-46619f2df4b6", "value": "T151B22C4E3FB98856C9BC17748AA5965003B4D1470423EE2FCCD554CBAFB3AD92D48AF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692420361, "uuid": "9457aed4-dfb4-4b6b-b23a-ba11e18ad1d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692420361, "uuid": "07d47db8-28ff-49f4-b8c5-686ee4f2342c", "value": "384:T7sqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZAT:TQf65K2Yf1jKRpcnup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692420361, "uuid": "83756034-64b6-4a85-a8ae-cde90b84a96a", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692420361, "uuid": "7810e138-bcca-4f82-b67e-a378b3370900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692420361, "uuid": "7b11a8d6-652f-4677-9629-ef452dbf0d6d", "value": "262cb9fe276a73f547aae0e91c799435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7c4193-3ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692469645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469645, "uuid": "f58a9933-e077-4d41-8ebb-4b4723b8a2d6", "comment": "Malware payload", "value": "3b96a72fbad2289ab79106371b9c0716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469645, "uuid": "524129d7-cee7-4399-88e1-9db4b6afc8c6", "comment": "Malware payload", "value": "8d511d6fbbd0ffbd98b87e80effaee645a559defea31a2a97f6cd8113a5ab854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469645, "uuid": "2afd32f9-bb3c-4ae2-892b-10458bffef1f", "comment": "Malware payload", "value": "08ade980b7ef9be88496ab1d454b8f6f323e4902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469645, "uuid": "d33215f2-b87a-4c85-8aee-6fbd49dbb6bb", "comment": "Malware payload", "value": "d4693c611fceaad5a2116cdf0b395887bd18d488ad9ec3eb9fb1195d4999461bfa08af38f0ef1793357970321ccb0f98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469645, "uuid": "f010931f-1b21-4621-9621-6adb4ba396a4", "value": "T1A0342900D3994759EA9EC7F4F078670986B6C276B19FE78B6E84A0F9DD73349CB02052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469645, "uuid": "a8c882e4-1c07-4c37-899e-b97242971e63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469645, "uuid": "fe10362f-0f24-4582-b08b-59b3ebffd956", "value": "3072:/WAE4LlYXcup6n5WNnnyclOViy5g85hfOQzeXWANMHC0egdzZoHJ5ey4FTgl5W81:c4LuMup6It1OVPgUhfr6WrhwPD5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692469645, "uuid": "00e0cdd0-57cb-4e80-9bdf-286e1caf7e17", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692469645, "uuid": "f767c0d2-cd8f-411f-8198-361b4b7347e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469645, "uuid": "b07cb8c9-19fc-4bf4-8a8e-e92d3110beb2", "value": "SecuriteInfo.com.Win32.PWSX-gen.6456.26562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b9ed24-3e34-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692410633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692410633, "uuid": "8f0e3eb5-95d7-4f35-860c-2deb5b5d2ea3", "comment": "Malware payload", "value": "f0e7def68cf0ad13fa1465a84081e7fa", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692410633, "uuid": "1788da68-a9d5-4d68-a103-2ed9682e7c59", "comment": "Malware payload", "value": "8dc60ed97c72e928555748075175d01c1568d89536d5b0040d6edd977e9613e3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692410633, "uuid": "9b79ca8f-c999-4dfb-8556-7246e64ca9fa", "comment": "Malware payload", "value": "ec0794f7b9e700a2e65030fff696856f9c95e3dd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692410633, "uuid": "daa88001-5550-46b7-88db-8000c9db807d", "comment": "Malware payload", "value": "ea7e015ed295ac5b148a264a3ea8900e5303da17ee25b90279e0d0fd1f8ddaf30e0d0ed8f76006f13764c2d8934b5175", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692410633, "uuid": "0d4a9af6-3045-4c83-9061-98f812594d8a", "value": "T17E44D15366EC3CE6D03A9334B7BB83C5E72EEC6052A1C65E42D042A09E7E1537D267E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692410633, "uuid": "7a16dff0-7867-4422-ad51-96c23bf88ee4", "value": "bc8d2a62cabbf7fbe1ecc06695be542c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692410633, "uuid": "3c293ba2-6c46-49db-bc73-e909a4696bdc", "value": "3072:/wxoSJkOZc+Yu8zNbCjPoXk8RB4QZvQHp4iFw5C84:/wxzvc+Yu8zNbc4kUB8HOUwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692410633, "uuid": "1d073ddd-7685-4c3e-8aca-eb90030f7dc2", "value": 259744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692410633, "uuid": "26391d3e-6959-462f-8295-19a4ea755531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692410633, "uuid": "4a7d5c8f-f9fe-4943-815c-4e3b589eccc3", "value": "f0e7def68cf0ad13fa1465a84081e7fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e13ff62-3e69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692433276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433276, "uuid": "df36e960-b425-4b07-9e04-37cbadf1f266", "comment": "Malware payload (RemcosRAT)", "value": "0cad3dbf5f55a2930a84bbf7bf1a568d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433276, "uuid": "ca9e2dfd-8f72-47c5-93da-0140e3ff6016", "comment": "Malware payload (RemcosRAT)", "value": "8dd8b145ec24876f20be6dcbf4818b5e6d38a2b5cba55d19ea5590d14208d787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433276, "uuid": "e501aca4-3f33-4fb0-9753-f988919f1544", "comment": "Malware payload (RemcosRAT)", "value": "b16a1465db7890d8865e26666cb187a73ad29e23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692433276, "uuid": "659cc6c1-f561-4e13-823e-22ef32e8e492", "comment": "Malware payload (RemcosRAT)", "value": "edc0a884a8839f8c5fc7e50c768e1b854e313f6fc31f25397f995bfa741de8f5962a5b444a84e2c1fa66e5fa53111183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692433276, "uuid": "81fe91a6-552d-4933-a64f-fb1d0ab20f95", "value": "T17C352355734D4E9BC9FE83BED0D0661447B0816B6A8AF3DF6C4E0B660D187DE6A0324B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692433276, "uuid": "1d5cd6e0-8188-4566-83ce-d2fbddb33fda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692433276, "uuid": "fb0b8b40-f7d0-4534-8530-d83a9aaff324", "value": "24576:BSoUQ4BU6CXEFENRLBZE3RmZDWkhkz+t/cOlIoxXz1WvDuS7K:Ib4JBZEBam+t/zFX0LuEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692433276, "uuid": "8023d708-66ad-4b68-a767-2c6393927e7f", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692433276, "uuid": "7ddf4a4f-461c-4f84-96a2-1d6cb41f5799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692433276, "uuid": "c883beab-6f81-4631-b640-b025b9288251", "value": "Rooming list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6c41c2-3e3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692413381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413381, "uuid": "feef2174-ad04-4426-ae00-05ecaa41736e", "comment": "Malware payload (Mirai)", "value": "93cccc5da76eeaf9fdb8be8ba7499a89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413381, "uuid": "8d99b420-b50f-4103-a24a-b09907f1e51c", "comment": "Malware payload (Mirai)", "value": "90ad1586c24be13ada74e87418aca994d6d67e46072fdaa960547b5b003d75e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413381, "uuid": "1befdff2-ff91-4076-bba5-182346adee82", "comment": "Malware payload (Mirai)", "value": "29a812998926c58858730dda333cd4cff21f0da8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413381, "uuid": "f69e65d6-6685-4a29-8a9c-33e076bf7c89", "comment": "Malware payload (Mirai)", "value": "4f9d739d366c32e5f92f3d3649e50ac98ead6f2bfcde264f440fc4315f5b4ba27bc3b796d52d883a2ea0bb3f4343dbc9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413381, "uuid": "55f4df0a-492d-4370-818b-bc65048302ca", "value": "T12E539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413381, "uuid": "c94aadc8-2b26-4efa-9fff-ce8bdaaaf07a", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692413381, "uuid": "6f05b1cd-32fb-4c3e-a58d-69098f255580", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692413381, "uuid": "59331ae5-67cf-4e44-9d5c-017aa7498b93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413381, "uuid": "1fddc617-d74c-4872-8cca-d955e62961fb", "value": "93cccc5da76eeaf9fdb8be8ba7499a89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa408e37-3e61-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692429968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692429968, "uuid": "59815e9d-48ad-4cb3-8e9f-81579bef50ec", "comment": "Malware payload (RedLineStealer)", "value": "83bd02862353424d86ccaa81664c08a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692429968, "uuid": "7d09e5ba-e847-4828-bfa4-e74e8c3c283f", "comment": "Malware payload (RedLineStealer)", "value": "91697dd3b1a3f2aadb6d39040426552d64e94673b44f479b23916892004da8af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692429968, "uuid": "651dadbd-c418-4f32-a61f-ed16b23012b5", "comment": "Malware payload (RedLineStealer)", "value": "88ce8f504d32b02e33fc338471ff73f44a0eda25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692429968, "uuid": "a0dfb69a-1fea-4c50-8fed-3721a19065be", "comment": "Malware payload (RedLineStealer)", "value": "678a51c7bc36245bc0c3dca606924009941a7d68632b9142fea02d9d9d9143e70e3057a210a972056520822e501889f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692429968, "uuid": "27b0cac9-1728-4671-bdd6-f750e5e660ee", "value": "T173052202D7CE44B3ED75273084F713D30932BCA24A65DB5B3785686A4C726D5A836B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692429968, "uuid": "839ec8ff-d07b-4737-a43e-c96e7c375cd4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692429968, "uuid": "1a222e50-79f5-45ba-9fdd-4645feee4038", "value": "24576:8yxCxICl/NP1UBerZ/5z7kNKbxMffYkk/sE:rWT1Um/5zYNKbxMfftkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692429968, "uuid": "85be3919-b5fa-43da-9433-ad84adf0ab65", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692429968, "uuid": "acfba904-7b1b-4a6c-9815-22303157743b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692429968, "uuid": "288e4f77-af63-4764-a2de-5dc553597bd1", "value": "83bd02862353424d86ccaa81664c08a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab02bf5b-3e68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692432976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432976, "uuid": "0e7e7a6b-1ec2-4f5a-ae56-cde55debea75", "comment": "Malware payload (RedLineStealer)", "value": "8434c354a7b488e8a7a3aaffec572295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432976, "uuid": "ad2e5a76-f6d9-4aaf-b1b5-17fea5a77463", "comment": "Malware payload (RedLineStealer)", "value": "92e3b9943eedaca5edc59649085eb8f1636aaf70304089aeabb55ec86e73670f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432976, "uuid": "e3895124-a6f0-479e-a7da-f891889a24c4", "comment": "Malware payload (RedLineStealer)", "value": "e317f2049c52cb419ebbf7c8586de1b726aa19a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432976, "uuid": "a4a87d39-9708-4401-8834-a47d1a6c9d57", "comment": "Malware payload (RedLineStealer)", "value": "b7a33f931cbfbc2ec3c7a0eb17543e63a09d57889f7daec3379506b1ea0276e2be434bea641915242ba46f1ac5571d91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432976, "uuid": "7fe7dacc-fd00-4ed3-9cf4-750d1ae02c92", "value": "T1F9052323A2E84427DEF51B7014F513D70736BCA64878D3AB63E6640E1CB3C859579B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432976, "uuid": "3d486461-de56-46e5-8861-c991cd8ce791", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432976, "uuid": "70021480-c387-46c2-8050-21ec74dade4f", "value": "12288:yMrXy90g2sVCX6/Z59utYEkwTVKbo0LYfu8fvrlljxSGdcgkYFl5/IKDE:9yIq/ZHuGEk4R9XHrlljk5IjIKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692432976, "uuid": "b3e6f146-57cd-4a03-98ab-399669a070b9", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692432976, "uuid": "c013690f-f3d8-4d38-8b3b-f2be3e0b980d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432976, "uuid": "b25214fe-0382-4a65-b2b6-75eb35083a1a", "value": "8434c354a7b488e8a7a3aaffec572295.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82890ca6-3e4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692422170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422170, "uuid": "b9ef6df0-918a-43c3-9dd2-39a73f97c665", "comment": "Malware payload (RedLineStealer)", "value": "9e15e0a03de345239c0d3235fc25eb6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422170, "uuid": "b1c6f5a2-e45b-4946-bbeb-1ed77dc0dcc9", "comment": "Malware payload (RedLineStealer)", "value": "9629e332197351fb74e30f443ea185eded5b91f0a5aa4950a2f45e7329848de3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422170, "uuid": "dddfc068-3532-49d9-b7c6-4da291aa5e93", "comment": "Malware payload (RedLineStealer)", "value": "84ceff44c8d416be4d1d446e9a83a61d4f3ce3bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422170, "uuid": "b883da86-6d64-4c44-aed2-3a0edddb02d0", "comment": "Malware payload (RedLineStealer)", "value": "832fcc3e00ae201fd4c7c756c8c202cd1563b065766a01c47f4b5296779e6383a98fe4bfd371f1df5526a7c89778f30a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422170, "uuid": "07512d0b-f6ed-40f7-9a86-4cb8b5095927", "value": "T125052206BBDC5433CEB1537068FA16B31B39BCA61478576227922C8A4DB26C5F93533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422170, "uuid": "a58c183b-ab0e-4f18-9aa3-837f7420cdc0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422170, "uuid": "93062a17-a2f3-4cbf-ae81-239a7905b0f6", "value": "24576:VymyhlrcjKpR+y7hXKBih1tnmELZSEp4id:wmyhlgjK7+yNXKBihTnpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422170, "uuid": "23f1903c-74a6-42e2-b977-909e01fc4ab9", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422170, "uuid": "d9e2da8d-dbb5-4e17-b1ec-bfbe44520fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422170, "uuid": "1bab585a-2d11-4e72-ad2e-ce99344ac1f0", "value": "9e15e0a03de345239c0d3235fc25eb6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372c38b4-3ed6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.Generic)", "timestamp": 1692480026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692480026, "uuid": "6d19077b-8514-47fa-a414-b38113e33df8", "comment": "Malware payload (Adware.Generic)", "value": "33affbe19f092d28932d254fb5c48474", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iuterfil-space", "colour": "#6A9E7F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692480026, "uuid": "57242ed5-086d-47a9-b53c-9d7005864584", "comment": "Malware payload (Adware.Generic)", "value": "97347c65c52eae6595ad00223d3c8bb60b241348551c2906641564cc557435fc", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iuterfil-space", "colour": "#6A9E7F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692480026, "uuid": "9433325d-1ad1-4c29-9e22-29c74c841e1b", "comment": "Malware payload (Adware.Generic)", "value": "66e2e5adb11c42bf974fdc2c9eccfc70e3a70aca", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iuterfil-space", "colour": "#6A9E7F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692480026, "uuid": "a329591b-dc66-43bd-810f-d9bdd86c3f9d", "comment": "Malware payload (Adware.Generic)", "value": "a116c83d310af7bca81e85f3b56213f48ce1270394df6f7a802ff0686b3638a0e408089de32b94614e86624a00afb4ad", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iuterfil-space", "colour": "#6A9E7F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692480026, "uuid": "9bb766c2-8c3d-4a60-8480-205729ed3b00", "value": "T1201633198AFE9897C2CE483BA8DC4582EA38C9D765B0D6564FE420716B03BD7DD630F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692480026, "uuid": "6047eeb2-b4e5-45f0-bc78-b45248935d10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692480026, "uuid": "9ef7b57b-7d68-4859-89a1-c31eba0a2bed", "value": "98304:hIiqp/+yulzhzgss5JR3K0F/TT2xDJLu3BlFQ4P:haV+Nl1UJRfTCx1SLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692480026, "uuid": "3b3c0ba3-4101-48bd-a32d-c0d0f9f3dcf4", "value": 4143368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692480026, "uuid": "7bd75a0f-7d3d-4b8c-86ef-088b8a747bd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692480026, "uuid": "3bf17e3e-d6f1-48ed-8506-8942887bde8e", "value": "GenericSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fa481a-3e81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692443787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443787, "uuid": "9fffb5c9-67ac-423f-9f1e-a9c38a4b1558", "comment": "Malware payload (RedLineStealer)", "value": "34dc3b6f5ad9472d3eee5fe006b97b4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443787, "uuid": "063e7bdc-7143-4af6-8c28-ac8b9a4f3ae6", "comment": "Malware payload (RedLineStealer)", "value": "9785eec1ff877367352742e441815f7f7372615e463e3a5862fa7881eb2e7081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443787, "uuid": "cdbcfc0d-f158-454c-922c-758a49fe81b2", "comment": "Malware payload (RedLineStealer)", "value": "ab1db703b3a1f8d5cdee2e24649b994ef4f0dd20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443787, "uuid": "50505798-80b4-44ef-af99-9f28c917d8dd", "comment": "Malware payload (RedLineStealer)", "value": "37884b5e601587a1367add101f226b1b9f8864d0b026f62199e8984eb0ef3278a62ec019403ce77fcf79591899d414fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443787, "uuid": "8bf36e49-8fe7-4bda-9055-6bf34ce7930b", "value": "T12CA538E13F0B4FD1F3D2353980962011CEAAEDEB1231F21F7E89448936452EB599BD66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443787, "uuid": "952d2bf7-dea6-40b9-b319-0045a40224ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443787, "uuid": "0ee260fb-7e84-4ce5-90eb-442b5478237f", "value": "49152:OJ6ogow0HOLfdH/1AV38wQxKSgp4a05AwsXLZM47CY8BwLuRrKCLv8jY0OsOv8E5:Fo7w57bReUhhhuuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692443787, "uuid": "6dc95605-fcec-445a-bc0f-4bfb11ed20cd", "value": 2097664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692443787, "uuid": "ae71e36c-95fe-468c-b6f0-708a1d23e782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443787, "uuid": "5933c36e-f6b6-4063-9539-206db43877f1", "value": "9785eec1ff877367352742e441815f7f7372615e463e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf8beb5-3e73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692437786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437786, "uuid": "acbb276f-8c57-40fe-8b1e-db0da471beed", "comment": "Malware payload (Amadey)", "value": "a21ddb12ebf8572421bd280fa0e01c7e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437786, "uuid": "ffb43f9f-11cf-425e-b97b-9545eb68a1f6", "comment": "Malware payload (Amadey)", "value": "9a1041ee840a569488aa3aa05ed422bfdb293811a30a9bf950188c355c7d3a4f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437786, "uuid": "7ba4eab8-63dc-40e2-b871-ad115e4ce24e", "comment": "Malware payload (Amadey)", "value": "85f7195e72b0cbe01899cdecb96bb3bb4e2d0bb7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437786, "uuid": "498a21d9-1c63-4b84-976c-7647d8070c6c", "comment": "Malware payload (Amadey)", "value": "abd5f4802260241659c2b8ed08030b6ae4cb50540cb3abf9b37db04be79d958df4b1d3263a4b1b5904a344fb568cff25", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437786, "uuid": "9436860e-e649-4aec-9604-929f71947259", "value": "T102052307A1EC8073CEA4277190F72B9316367DA2497CD75B3386A80E5A729C0B57973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437786, "uuid": "88734c60-eb5b-4317-9816-3491cf98cb44", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437786, "uuid": "d514d1e8-98ed-4946-ba4d-0e76e9f87351", "value": "24576:ty3487kRs1F18WN79WKlln+uvoErCY/n0:Io8JF18WNRWKlln+uvAYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437786, "uuid": "0c952c94-4640-47f4-aa85-9d5df601b3e5", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437786, "uuid": "32e02d93-289c-489c-a9bb-3e8b8bd75f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437786, "uuid": "bf0a4546-b154-43b8-954f-8ffe7e2d9ff4", "value": "a21ddb12ebf8572421bd280fa0e01c7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb379543-3e5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692427876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427876, "uuid": "3194d3de-6059-4e01-9893-71b2fd739b63", "comment": "Malware payload (RedLineStealer)", "value": "698a09cd7e4b84aa6f0fb9081ba10080", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427876, "uuid": "47ac7586-e7ce-4a6a-a513-3708e4737f99", "comment": "Malware payload (RedLineStealer)", "value": "9aea53c491a3aa6654d78b3ea4c72c902fc63dddb716d118268f2ad6c0376a78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427876, "uuid": "023ecbca-7ff0-4248-bd68-9cd0661b5d35", "comment": "Malware payload (RedLineStealer)", "value": "3afd83e781ca2c17bfdada47dc10b5d301408a51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427876, "uuid": "c781820b-4fce-4abd-a1d6-3b207db01a8d", "comment": "Malware payload (RedLineStealer)", "value": "6327f4da737362db10a3d08f1c2d9984b3b75b0aebc85d5c2e1118362a0e959327acac1e9c449979bafc37a9120a4ba9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427876, "uuid": "208bcab1-3745-4f61-a478-a08af7957799", "value": "T13C052213B2EC8171EEB6277068F607930B33BCA149B4D36757895D5E4D22B84B97232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427876, "uuid": "f58c0083-38e4-43bd-8497-0fc45c9c4a18", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427876, "uuid": "5a669423-ba79-43cb-ae47-50942616d8d5", "value": "12288:YMrqy90FGhWyDEV0CMt1ehOmrjdMaWhilWTKMDOPCRIX60knxKRH4AzWnGY5lwxh:CykGhbEAfmHbt/PCRC4QzWntolnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692427876, "uuid": "8b32ecfa-0b5a-4715-bba2-73b67dbd2698", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692427876, "uuid": "c36ef579-be75-4d12-a54c-b29d15d598ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427876, "uuid": "5f77166b-8c5a-4093-8977-19427504465b", "value": "698a09cd7e4b84aa6f0fb9081ba10080.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a343279b-3e2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692408052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692408052, "uuid": "e3a0ce5c-2d97-4348-97a8-405f8582a82d", "comment": "Malware payload (RedLineStealer)", "value": "60a8a3c5ad50f1911894a834c57245e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692408052, "uuid": "2c6c8501-ec04-4756-9870-21a9297098a1", "comment": "Malware payload (RedLineStealer)", "value": "9c112ae9acbcde6adb63c64d27ff43d36347573dbe3be66c3bb0fa1dd07e2f97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692408052, "uuid": "5fa4392a-dee4-497a-94c6-5289b4f38dda", "comment": "Malware payload (RedLineStealer)", "value": "8d8c2bead39fee639eee09d20ade6fdaf2841497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692408052, "uuid": "d7923972-3692-4031-b174-bf003a3ccba2", "comment": "Malware payload (RedLineStealer)", "value": "f779929d87ac1175510fd22b8d1df4ac55ff781988e93fffa15d2e0836e22e6d60cd2c5ce5641e9b9ed35778ee94cc5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692408052, "uuid": "00102e7a-0c3f-4e93-b251-2d6a61d05291", "value": "T1AC051257B6DD4572D4FA1F7068F602D30F367CA28EB453AB234194590C73982AAB533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692408052, "uuid": "7d836a79-db7a-428a-8d97-fc984e94f7f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692408052, "uuid": "0b974a0b-d308-4701-84af-ffe4434ed56c", "value": "12288:hMrby90UuJtlwX75wP3JfcpCEPJc7wAD0JLk5gG4Ze8cfh2qzRuTl3N:Oyr4lE7Y31ZExc7wAD0pk5g7TctzmxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692408052, "uuid": "9e4f969f-9de0-46ff-bede-c3125d859cad", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692408052, "uuid": "254a221b-da75-46d8-b207-9051b8df29a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692408052, "uuid": "c7dffa2b-c25a-49b3-ac39-929e9c298464", "value": "9c112ae9acbcde6adb63c64d27ff43d36347573dbe3be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edeaf544-3ec6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692473461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692473461, "uuid": "64ca3890-7a29-4679-8bbb-ac98939beb60", "comment": "Malware payload (Mirai)", "value": "72428c9bed9522a32253bf2edc00f5bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692473461, "uuid": "21515d29-53c1-45c8-8a3c-be1fdcfde510", "comment": "Malware payload (Mirai)", "value": "9c4de4056c4a56d51d1602464d89f28528534ec05a91807a4ec96f6c60e5a165", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692473461, "uuid": "ec6bd90e-e5f8-439c-b136-c058782d266b", "comment": "Malware payload (Mirai)", "value": "8d26dc98874682aa84210a118e8393b6bc45382c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692473461, "uuid": "2da1e788-53bf-41a5-9679-72be7a8409f8", "comment": "Malware payload (Mirai)", "value": "a8ddd3eae3cb773176ef96ba99f83dc35247132dc0c77c0e716ac3882175428229a8ed3d420bc535b0458445bc432cad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692473461, "uuid": "f8a26951-8fdd-4f80-8cb0-4dba6722463c", "value": "T136B34C73CC256F68D665E1B4B0B08F796BA3A950818B1FBE1567C3758043D8DF60A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692473461, "uuid": "e01c79cf-b30b-461c-90d1-d114482ff76d", "value": "1536:Ua0UAviDnAAiKeCjKOR1Ne0al/Cq6WSn6qJ/tJ9:U9en3iKeXOtal56Wu6qbJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692473461, "uuid": "b02c8877-fb3b-4ea6-8097-208d0ea3ec54", "value": 109376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692473461, "uuid": "33205f37-5d08-4036-9a05-ea63bdbc5a8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692473461, "uuid": "c7697b38-3c3f-4b21-ad56-7395e2ffd9ca", "value": "72428c9bed9522a32253bf2edc00f5bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ada7e3d-3e50-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692422480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422480, "uuid": "b3283d6c-bdad-4d53-8210-012df7a76f14", "comment": "Malware payload (Mirai)", "value": "fac0421e6b792a739329c5d2d12d22c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422480, "uuid": "a47533f1-85da-4e29-b282-de615a54c32c", "comment": "Malware payload (Mirai)", "value": "9d21a4c2ca177c947cf7066067e4dd404b83b8031da7e4e74710ce78194b943e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422480, "uuid": "6a4fe2c0-6e7e-4402-87fa-6660941aa416", "comment": "Malware payload (Mirai)", "value": "a9a0e71e6f6d0f62d1bc6f5b8a84ca9c351b88a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422480, "uuid": "cd999f33-6563-4fca-89b5-ac7dbb637c0f", "comment": "Malware payload (Mirai)", "value": "9721706e131dc7c47cfc9c416dbbda80bb129081f6919fb0afadc71a4c1c28f1ec0775a971e134717a1fe61a042e3cbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422480, "uuid": "566dc7ff-4161-46e4-b4d4-bd89e57ce9f3", "value": "T113634B85A802DE7DF98AF67D50610E0BB520631165D30F2BA7AFFC93BE73168A931D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422480, "uuid": "de2891ea-9ddb-453c-be43-c5bc7570bc2e", "value": "1536:Mn7G+9XRoYmyKzkFr1xMav88JvUkkwZpWsT/II/:M7G+DH1x/NhZptT/II/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422480, "uuid": "9f5172c3-2d5e-425b-865d-97590078411d", "value": 67384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422480, "uuid": "10462408-d0bc-4159-809b-c8013ca0d7fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422480, "uuid": "34f36776-8715-40a8-a862-a8dc2620c59d", "value": "fac0421e6b792a739329c5d2d12d22c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729814ee-3e6b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692434170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692434170, "uuid": "904a3190-2251-4539-b986-1c2a9dbc35f9", "comment": "Malware payload (RedLineStealer)", "value": "def2b51035f4f963149c9e0acade6ef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692434170, "uuid": "84755623-09b4-4d62-86d3-ed1308f255cd", "comment": "Malware payload (RedLineStealer)", "value": "9da8ebfe3ff205b770ea1501c2fdbd45a14d3ea295e42c8560b167535efb7950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692434170, "uuid": "54009f5d-f461-45f2-b18a-89bf401e1691", "comment": "Malware payload (RedLineStealer)", "value": "f5138e72550fafc7310eb3a5b31f7a8e5aa4d4e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692434170, "uuid": "c193de00-b0aa-4763-bb19-d63efaeac4f2", "comment": "Malware payload (RedLineStealer)", "value": "40e3411e483d90b031ca9ab8d4beee0a669d58aa8fd992651342cb0c7de3b107aa2f4725ec2baa96f983d303b7061736", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692434170, "uuid": "a2b942ee-1410-4933-a564-8652369c03d8", "value": "T1DE05235297F88632DDF2037058F213970B357DA25E79436B3762A95E6CB2B84E831327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692434170, "uuid": "190ea296-bda0-4a6c-84f6-4e4c3541682f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692434170, "uuid": "671aa7fe-616c-4ad3-b166-57ac95d7f7bc", "value": "12288:8Mr7y90LjHOl8Il3VasHYs+pTAO62P+qE6eA36mAni0Wq6FWD1UETHkKL9muK4a9:/ywOZasHYsHonnI6FobhLqN34jG75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692434170, "uuid": "ab1cd7c0-715c-4b31-9e6c-1243f47ed8b0", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692434170, "uuid": "06da423e-42b8-4a8b-ad6c-40c8d3cc435e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692434170, "uuid": "0c58f4e4-bfd0-4f70-b71e-ec071adba56d", "value": "def2b51035f4f963149c9e0acade6ef8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2284db01-3e73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692437471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437471, "uuid": "67e9d472-e22e-4b79-acfc-bb8a019b2509", "comment": "Malware payload (RedLineStealer)", "value": "6ef503347593d1a19e18bbf2c416edf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437471, "uuid": "e40c477a-8b98-48a9-ae6c-2340876f6214", "comment": "Malware payload (RedLineStealer)", "value": "9ec3595393fd637f8b10f63edb28b5e3b745f3be24b84fa4101f222da85ddb8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437471, "uuid": "093b9703-814f-41f0-90c0-b36fbc96cb83", "comment": "Malware payload (RedLineStealer)", "value": "da5b4434844257e4af35faa100176a1a0cbf849c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437471, "uuid": "235a6391-1f51-482e-8e10-536858923e3c", "comment": "Malware payload (RedLineStealer)", "value": "53231328348b100f1a296c4bc59af75e2fb5907cf547b5d07469e0444f5fac6d5a319d6bc618e52449e634758b762438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437471, "uuid": "011c7c53-927a-4368-a31e-791842739e71", "value": "T1B0052263B6D90033DEB41770ACFA16C70A347C629878827763D558AA1D33AD0F97936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437471, "uuid": "a19ba917-178f-4c04-8a37-6979428d1ac2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437471, "uuid": "93d310db-e07b-4c62-b22b-7c938ea883c6", "value": "24576:3yJoXJGe2if2LLLT7UcK+re7HSOZEbYC2Pot2:CJoXSi+LLLTocK+re7HFET/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437471, "uuid": "c482d693-9564-4ef6-9622-038688194ad5", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437471, "uuid": "c951d1bb-c318-4f71-a7fd-dacc3d1a87e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437471, "uuid": "ae0d4fa0-6185-48fc-aeb1-ff908f9bec3a", "value": "6ef503347593d1a19e18bbf2c416edf6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba87917-3e59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692426669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426669, "uuid": "427c7a52-2727-47a1-a03b-44ac67a1e2a4", "comment": "Malware payload (RedLineStealer)", "value": "9a00e2b8ed3194fdd499965c2d63bb95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426669, "uuid": "cb4a3af5-61e6-4eb9-a60a-436ee938ed2a", "comment": "Malware payload (RedLineStealer)", "value": "a09497298d5a7c3ace66f539ca4fe99e612eceb5eaf6bb0c4e52319820b2b085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426669, "uuid": "569d6751-b8b6-4ce1-b043-98b8d84efc77", "comment": "Malware payload (RedLineStealer)", "value": "bce5bb05d874b5f8de181124dbc02b787c2d5827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426669, "uuid": "b82985e0-4b0f-4d54-ba83-808bac51c184", "comment": "Malware payload (RedLineStealer)", "value": "89e6f3b879ddc22ae74a90650f884071df5ecb7984dc9493327574e948e66b5b63aab128e55856adf2fdda2899bddc62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426669, "uuid": "4490d689-1681-4f02-867f-ab698eea6de6", "value": "T1CF052217B2D894B1E8BA3B7015F60BD31A36BDA11CB4D6AB7245AD4F0C33285E871367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426669, "uuid": "c2e33656-8483-420a-b7ed-f3719f552775", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426669, "uuid": "92e29029-0a6b-4fff-84b7-bb79bf4c11cf", "value": "24576:yySGT863VkARak0aXQ3bHr/Eq+6TgLXi0DOXNI+x:ZSM8QNRak0q2H4kTgLS0DqI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692426669, "uuid": "7a1f06d3-8c54-4523-a483-18de507ae830", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692426669, "uuid": "3d107534-ad02-4dc7-91ba-ee7f1a7a1dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426669, "uuid": "37243faa-b4e9-4fb1-a666-7dae6f8eeaa3", "value": "9a00e2b8ed3194fdd499965c2d63bb95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142d3368-3e55-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692424562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692424562, "uuid": "f9e995fb-d12b-4c62-a6a7-b120cbaa9b5e", "comment": "Malware payload (RedLineStealer)", "value": "11c7e5c965be3cff7410e837561e7e82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692424562, "uuid": "004e12e7-a808-4be7-beef-8cc3f6d7efaf", "comment": "Malware payload (RedLineStealer)", "value": "a1e21180b104f0b1cc05fcebd9a9f32c9820f7704693822df06c91d8ef7aad95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692424562, "uuid": "ffa1dc67-f57b-4890-af02-cd6b53804015", "comment": "Malware payload (RedLineStealer)", "value": "1727060d2778926d351cc12de25adc273c334257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692424562, "uuid": "dd26e70b-fb96-4691-b141-bc5e3ae5a79c", "comment": "Malware payload (RedLineStealer)", "value": "6cd0e6772202c24ab15a55de9ee792f372aff7fad1a6cf924bc7cb1a74e7ea74a1fb20ce094eaaa014d8e32daad20983", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692424562, "uuid": "305afc75-d059-44c5-9e97-da3b9da6acb4", "value": "T12603F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692424562, "uuid": "784f1c94-6be7-4c5c-afc4-1beebdeaffd0", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692424562, "uuid": "72e94a71-6bc9-4c4c-b470-2f1a5480d8ea", "value": 40929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692424562, "uuid": "f6a52ab9-dc6d-4e04-9dc5-3c064577f4b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692424562, "uuid": "90426efc-7023-42df-997a-fa48b5478a53", "value": "11c7e5c965be3cff7410e837561e7e82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55dda0f0-3e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692445288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445288, "uuid": "dabdacb2-221d-45db-a732-7fac3d5b16d5", "comment": "Malware payload (RedLineStealer)", "value": "33acbb49a01bb7dde4da1f0e572ef396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445288, "uuid": "52c10407-159d-422b-9945-630c69e6cb78", "comment": "Malware payload (RedLineStealer)", "value": "a2c6ee2151a4294788cca435654f9abf6d9ef513aa65397f89ae3fbe6aa70090", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445288, "uuid": "272ed8ab-1569-4c59-af06-c49b82eeccd4", "comment": "Malware payload (RedLineStealer)", "value": "f0c77d73298755d3b640f4319cce383e6366bcd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445288, "uuid": "5b772df5-1883-40aa-8e6e-33991dd080dc", "comment": "Malware payload (RedLineStealer)", "value": "5fadd243e73e7ee1a4eb125585f14c8bf7387f26e7d6114c4b0c36647ddb4aaaff305bbfb29b1342a1e5ab4936f1363c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445288, "uuid": "960000d4-ff8d-4b02-b748-627bc43a9746", "value": "T1A9252306B7E88032DDB51335A9F703C31B3B7DB541A5866B638AAC2F0DB26945872773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445288, "uuid": "f2c05fc9-38d2-46bd-81ae-2bd6a124e15f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445288, "uuid": "0425c515-fe30-4fb7-9607-3d2820b40d99", "value": "12288:hMrjy90EyYeZTlXpo6lJ97LiRZUj2msH3fcDqOt2QfVpnIsEiJZiw8DBNReXo3WO:eyOZPAc8KzVpI4ZiLi8zJw3aTs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692445288, "uuid": "665cfe35-7b48-40bf-957b-039d274635b2", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692445288, "uuid": "10f38356-cc9e-48c2-a222-238bedea2610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445288, "uuid": "d11f0e7d-86f7-45f2-a550-bccb4064c74e", "value": "33acbb49a01bb7dde4da1f0e572ef396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8161c9d2-3e4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692422168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422168, "uuid": "88cad49e-3283-4c3d-8ca8-2c7432d42fe1", "comment": "Malware payload (RedLineStealer)", "value": "8dce1487e7be5214a7d8cce0163bfa0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422168, "uuid": "fb038555-db6d-4f49-90fd-dc034b4c2622", "comment": "Malware payload (RedLineStealer)", "value": "a4315839661b319a9c132d0fd58f533a25a6815b0365a6aa16be8f5807d24cc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422168, "uuid": "c42680b8-523d-4cc0-adb1-beecb41abde9", "comment": "Malware payload (RedLineStealer)", "value": "cc79b1e57634142f761f7c34db972e0bf8530f91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422168, "uuid": "eed70e26-999e-45d3-8d60-25f5f71724dc", "comment": "Malware payload (RedLineStealer)", "value": "107131d33d4907427db18c1c1dcc44937f5e26ca7b46529efd6aa2ad1c204967856da8501b3dedb61f5b666a6b9a0c04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422168, "uuid": "829bdf1a-bb50-47e5-bab5-5f90a504f4d5", "value": "T1CD051352BBE48073E8F53B7028F613D34B35BDB26A7A976B260414A66C336D09536373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422168, "uuid": "70ff00ec-5592-4f77-a567-a1e57fc3daa2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422168, "uuid": "7b2ada39-9a94-4971-a0e3-626453bd1830", "value": "12288:qMrqy90zgH31yahp+c+iMvqMXTkp6foUwP3P85Rz9pYSjXF91pyZDUa0deNgCxTx:YyjHrMXTkpsEk53pY01pxVq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422168, "uuid": "4dcea458-5d30-46ed-8a23-b2a84c3b9ea7", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422168, "uuid": "41deefcf-ca89-456d-97e7-84f50e1f1510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422168, "uuid": "36d295e9-a15c-46b1-8fe5-870e0c52a421", "value": "8dce1487e7be5214a7d8cce0163bfa0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7939f274-3e56-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692425161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692425161, "uuid": "5690fa69-1085-43e1-b200-7b780f6934cd", "comment": "Malware payload (Amadey)", "value": "089e75816a6610c20929c8ea4fc3255e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692425161, "uuid": "7b0be6e4-17d6-4dc5-a9eb-75a94ee4bfea", "comment": "Malware payload (Amadey)", "value": "a444912b4f74002b2baf74df2091e86979ed630a05b3cf03089dae8933eb096a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692425161, "uuid": "7607f631-99c6-4ea5-bda0-b83ada69a379", "comment": "Malware payload (Amadey)", "value": "dc4dc424828f8f1ba2ecb36946ea6426ddaf5f29", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692425161, "uuid": "340eb960-c7de-4096-a84f-de5607c7a4c7", "comment": "Malware payload (Amadey)", "value": "b52e4b2a2dea4ebba09884a7af22ff7f448350283bef68ca48c03252c1a61683e8a2027313a3db25565729fe6704dada", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692425161, "uuid": "00253f27-14f6-46a4-b4f8-09db685840ea", "value": "T10B1523425BD48472DABA2BB59CF742D31776BE921C38C71B2740A11B1C729DDAC703BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692425161, "uuid": "2fbfc376-fd17-4002-880a-6f47c626b816", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692425161, "uuid": "6f277d90-469b-4aba-b4d8-9cbfb17505b5", "value": "12288:YMrAy90ZAntb3eSo0RnAhjnC1bZTKRu0hM0LRZD3Zj02a3LTViJpkQzt:IyVtzG5hbClZTKRaED3WHVisct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692425161, "uuid": "7175d1ec-c280-4588-9274-44578c32f504", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692425161, "uuid": "fd20ffc3-8278-4860-a937-5796542d6c43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692425161, "uuid": "a3c0708e-5d11-4619-9653-2b1ac5e7cb63", "value": "089e75816a6610c20929c8ea4fc3255e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d2abd2-3e7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692440780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440780, "uuid": "69d084f9-8a90-47a2-9349-a57f601589d8", "comment": "Malware payload (Amadey)", "value": "d9b9ad9e1bccfc9a3027d309246e451f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440780, "uuid": "b45d43a4-f106-4b2c-b222-ae031f006f10", "comment": "Malware payload (Amadey)", "value": "a647409c07ea6ea0636b4e5eac9253e7b86b1580da0ed14bc86734f12ab58b2c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440780, "uuid": "5b6e2c0e-7b59-4987-8738-c9fe35676233", "comment": "Malware payload (Amadey)", "value": "6883c6e7ab1aab7c0b6493e020e9ddb33debc665", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440780, "uuid": "73f8d335-3568-4d44-9536-30c1f01fb0fc", "comment": "Malware payload (Amadey)", "value": "d1083d2bd3a66ebd0a1448d99372d7e806c2f6d10e31e243ff79dd3b3e39204e97d2dfe9efa3ad4f77cdc2775a75a77a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440780, "uuid": "c0c5935a-5e82-4399-8530-19fd73d54230", "value": "T178052347A7E48072DD741B7058F726830F3AFC525974562B27CA684A0DB3B99E836337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440780, "uuid": "083ecc0b-6403-42c0-a292-1c667b0b0c0e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440780, "uuid": "e06b3a58-7619-4075-8edd-b2f07d9c8eb8", "value": "12288:gMr7y90+AxDSTvGZZTLMwiAtaJFiKpwe7Vh3KRpVXop7vwr+/WackDNWYxMpyqgy:ryKxDZ+k+f7VNKXVQhrBW+Mp7JZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692440780, "uuid": "21e19a60-7416-4f16-8a05-9ff5be250b39", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692440780, "uuid": "8fcdbd0d-9636-4446-b6a2-153c3aa24256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440780, "uuid": "322038eb-bcf3-4a3c-960c-85d0bc67b9cc", "value": "a647409c07ea6ea0636b4e5eac9253e7b86b1580da0ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ac4704-3e3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692413403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413403, "uuid": "f84e101f-b9ae-487e-962c-92a78f0286ba", "comment": "Malware payload (Mirai)", "value": "c8717429ecef0dd24feda79ff5a8c6d7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413403, "uuid": "8c1d57b1-af2b-46f3-a0b5-282dd83d8ada", "comment": "Malware payload (Mirai)", "value": "a6bcbf153925b8fe1df30042f838a674f655d43f1fe0f4630e011586f668bc36", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413403, "uuid": "327eb8d6-54b9-4af8-ad98-01d5dfe801fc", "comment": "Malware payload (Mirai)", "value": "862deade47bfe76daa08f9c408bd5e203d81f670", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413403, "uuid": "c2a95544-8540-4f4a-97c9-a49c1bfaf96f", "comment": "Malware payload (Mirai)", "value": "f730d56f02fdcfb797b3982ea8165e0cf892d7814abbda648c3e1e3f35af1352605c5681187560b729ee7adb4b21aedc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413403, "uuid": "5d9dc6d6-e582-4698-ae06-65c43b543d22", "value": "T165330262276D6AE191B05777FC33BC1AA6AC17E85C6B30963CF06A15A7C58024EF1782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413403, "uuid": "109411dd-4cdd-4402-bc18-49a84539ace9", "value": "1536:69O/ZMAXIxNUk0UGYLcPqF1aBexo4opKZbb:69O/ZNKygGYLGqFUF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692413403, "uuid": "c4584d61-7583-4819-9feb-19dc00ac2d44", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692413403, "uuid": "7c0cb261-0d34-4814-afbe-34d62be0190e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413403, "uuid": "96752e60-ad44-49b8-a7ef-3117c5f9486a", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416d0446-3ed4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692479184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479184, "uuid": "fccf4c65-ab3e-45dc-a11a-1f921b2f81df", "comment": "Malware payload (Mirai)", "value": "fc33b30b03d959ae587dc23e9b4fe5c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479184, "uuid": "2cb906fe-96b6-4abb-9f6a-2c957930a318", "comment": "Malware payload (Mirai)", "value": "a79f399e27fc4fa0b6db1011a07565e8067a61fde1abc38c0aa5f082233e2cd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479184, "uuid": "8b91224e-6da2-457c-8f71-534c77025d9d", "comment": "Malware payload (Mirai)", "value": "84cfd62b1d79785ddb962c07ee297e544191184a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479184, "uuid": "75188c3d-dc30-46d7-ba8f-ebf30bcbd439", "comment": "Malware payload (Mirai)", "value": "f45a4b9cd168e5fe48801167eb8790256f4c38b245a5c6fe87032b83d7249b669dda421293056f1f0e6021ae12ce0358", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479184, "uuid": "74687662-2995-4b5e-ba66-c701c5470074", "value": "T1E553E781BC41A629C7D11777FD9F559E3700A3C9E1EA32138C240BA07A8F94B0D5BF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479184, "uuid": "5899de20-6b27-4c92-99d2-9d3fb8697d8e", "value": "1536:GogI5uRJ7lshCKotdsVKQJdly33eZtQqQotS:GogI5uRJCQsLPy3w3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692479184, "uuid": "ed675a41-c466-4a80-ab68-b7fc9dc144d3", "value": 62900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692479184, "uuid": "8ddb02ee-548a-4768-a753-910371c352fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479184, "uuid": "14e15863-f27d-49e2-8e27-ef65842a26f6", "value": "fc33b30b03d959ae587dc23e9b4fe5c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119a9c78-3e3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692413391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413391, "uuid": "a3d7a615-2135-4b28-a451-1c203114684a", "comment": "Malware payload (Mirai)", "value": "7ed2b0e67ef30fd4cb65d1a5b59bb20f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413391, "uuid": "43555bba-9816-4a9f-b513-236b82608a92", "comment": "Malware payload (Mirai)", "value": "a86a698c0ac9d755095e84a8c89596991017d496ca14c34ca5de80355eda1c3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413391, "uuid": "4da57226-1db4-4dd4-af11-d05da19ebd63", "comment": "Malware payload (Mirai)", "value": "7a1d497767ac479651901fcd20f317f88e26fbc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413391, "uuid": "593a749e-e584-43a3-a41e-fb8f310d000d", "comment": "Malware payload (Mirai)", "value": "44e643be5e3694ec0d283ff34f16a9e73613addcdbe1adb7e30daed824a2b7c4388ff255e166daa79a5106cd5e84fd55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413391, "uuid": "dbf4a767-6404-481f-ba4f-0f03ed957d61", "value": "T148C2E1F63E777997DA290039389DCE339274E062D75EA723A240524D201717DB7329ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413391, "uuid": "3dab34ee-26ec-490c-a2fa-63a1067648ab", "value": "384:MG1DMwk8JPyG3GDZaEXVZVBy6HInRiWLRYh4Sw4cGJYeRzOFGBzd8QO4uT+MoNyu:HMwoDZLFbBy6HQHRYfeAxdd8n4uX90NF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692413391, "uuid": "98883088-b09a-4ffe-b729-8619ba5cc287", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692413391, "uuid": "377c9555-330d-4037-97a2-0d3aecd5be85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413391, "uuid": "bd2e8f6b-bd55-4ef5-bad7-a6f61c4ad7e3", "value": "7ed2b0e67ef30fd4cb65d1a5b59bb20f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434bc504-3e50-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692422494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422494, "uuid": "0bc6cecc-c42a-4475-81a3-9a2772df01c9", "comment": "Malware payload (Mirai)", "value": "e146006607633ba2650874a29cf31bad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422494, "uuid": "c235a4ef-700c-4567-9c8c-9d777b9a6579", "comment": "Malware payload (Mirai)", "value": "a94e32f8976eeb0cfe01a4579fffb37a3f13dbf6dcb93dcc352bab416b364409", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422494, "uuid": "fe67059c-dd1c-48b8-a86f-3642a19392ce", "comment": "Malware payload (Mirai)", "value": "daac751a552f4aa45db606302ff2dcd0f2d4a8eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422494, "uuid": "3a9df36f-6f53-4cc9-84ef-505b02df6a0c", "comment": "Malware payload (Mirai)", "value": "4c3bf88298191657175b36847e2903998b0fa03f7d8db05d56cecf52b244308aeee652ca08abaf72b3fc1c05fb95aa40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422494, "uuid": "d27d4180-40ca-44fe-ba5f-ec4598a46de8", "value": "T160537DBD866ECD65E0044AB8A8659D308B12BC0892332DF6DA468D71944FDBCFC197F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422494, "uuid": "14f5a0c5-e856-4ac4-a6d5-6dade2b61bbf", "value": "1536:paYs8eNYlOJ9dYfOVBlMXHiEyfs3l7Yy/q+m3IuCnU0:pONYlOJ9dYmV3M3Gf+lkUm3Iut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422494, "uuid": "f1cb86a2-f888-4fcd-9a6e-7282533482b5", "value": 66632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422494, "uuid": "8ab441e4-2673-4158-83b8-d1df903feebd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422494, "uuid": "d0f6f5c3-2156-491b-b3c1-58bb02fc602b", "value": "e146006607633ba2650874a29cf31bad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bd53bd-3e73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692437773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437773, "uuid": "3752e1b6-2519-4edb-bc48-246c07d90756", "comment": "Malware payload (RedLineStealer)", "value": "3a08662a14072ff62e64b89ea5e1e3b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437773, "uuid": "04d36d2c-81a5-4565-afec-164c999f60dd", "comment": "Malware payload (RedLineStealer)", "value": "a95a5a8d0200d481858fe98997fec1f793b4d1cb6882bed5e0450061bd92bbed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437773, "uuid": "7c5a3110-f69b-4048-86ce-aa56db5312c8", "comment": "Malware payload (RedLineStealer)", "value": "379818515800341929ce593605608735a7375a78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437773, "uuid": "7268a78e-afb2-4056-95a6-984e4732a04d", "comment": "Malware payload (RedLineStealer)", "value": "6186573bdcd2cc292fcc2977c0dc1fbf11e0de1d9f43db8d9e6846a2ed4400be77b0a8c02370b3c39a1ac6a17e721334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437773, "uuid": "0e2b1492-1a49-4d02-8ab4-e4d7272c62c5", "value": "T105051213BFC54063EAFA2BB144F913D70F3A7CB15C68579B2385A4561D33881AA7932B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437773, "uuid": "ede75586-cfa6-4de9-8921-3e5930fbd10a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437773, "uuid": "b10d7789-efa7-40fe-bfe0-19e08cdf3c3e", "value": "12288:0Mrby90ZMwrfjJS/JsHyIyNFcJux3Fb4PPW5i8Y6+gtSxnoqIisnFmkO:3y2Mw7jwxsHgcunb4Peg76+gtSduHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437773, "uuid": "361903ad-a427-4b16-b863-85626dda52fb", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437773, "uuid": "7f472f6f-2a9c-45ca-aed3-bfefe02e4bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437773, "uuid": "6c84cbee-9ea8-43c5-be5d-cd14bf2a180b", "value": "3a08662a14072ff62e64b89ea5e1e3b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2528f28a-3ea6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692459380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692459380, "uuid": "b6a947db-f5c1-4fb1-98ea-0cb54511a162", "comment": "Malware payload", "value": "2e79909bb6212d95a6149535ea8ea36d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692459380, "uuid": "a09065c3-5653-4a18-a688-0d3fb755ea57", "comment": "Malware payload", "value": "a9a1931b3dcfc1406c4410ed0ff2eab291a37f3d724f6b1f9f789d838fcf028c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692459380, "uuid": "33aa26dc-cb03-4ca8-a301-717a6d51766c", "comment": "Malware payload", "value": "dc32a0b30a3f28c87450c87a7e8af63f9282a1f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692459380, "uuid": "79bf826b-d1a2-491c-a561-4cf0bcd6ea66", "comment": "Malware payload", "value": "5ea81fc65afdc45eb2e30c96224234e0e53f4d067ddacbae267b7cc01c66cf7f35317bfd3dc9b7deba16f994c83fbe2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692459380, "uuid": "c89638b5-54fc-41ca-b38f-837d92cef5c1", "value": "T1BD736B1377E0C4B9E472063018B8C7215A7FBD226EB5DC1A7B84065E4EB61D4AE29F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692459380, "uuid": "af558439-910c-4684-9390-767f3266cbe5", "value": "3a9434f58b239851f54aee3bd703bbf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692459380, "uuid": "dae0b32c-6fc1-4cf7-b98b-e388cda2776c", "value": "1536:HKJpomswqZSjIhv/A0EpgcRTShAzsWjcdm5Om:1Gi/A0evUA8m5Om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692459380, "uuid": "7cedad49-1645-4b63-883a-0da2bb9f2082", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692459380, "uuid": "02f1473c-8665-4795-af33-9d66c5a0780f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692459380, "uuid": "0600ccc2-9f34-4930-98f9-7c17d5b12f60", "value": "wintail.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cca32ad-3e4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692422161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422161, "uuid": "1cd1d606-6162-49c1-9752-136d1761a414", "comment": "Malware payload (Amadey)", "value": "d99ab4d21eb141659c2bfc591ba7a9d0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422161, "uuid": "c974fab6-7445-40bb-9bf1-5f703924a5a8", "comment": "Malware payload (Amadey)", "value": "aa0c581b1c357290adcfa886ee3ad9240eff0c5586de4af965c0bc13fed3ed6f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422161, "uuid": "572f9778-e02c-49b8-b720-8b2624217e9e", "comment": "Malware payload (Amadey)", "value": "00b31b81b531457b0af17c830653d23fd202e735", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422161, "uuid": "4ddaed3a-d3ef-4a36-ab27-bb541ebeca55", "comment": "Malware payload (Amadey)", "value": "8a5620d538edbe39b3d67159fd074e2853d223706b0b8c3b1991c01d6a01beb1868d67d929782e5c35a8c4f2e0164991", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422161, "uuid": "d3c1d10f-caa4-4dae-b71c-d8a96be2a0c2", "value": "T1DF052312A6EC4073E9F51BB019F517D31B36BCB24DB5976B3780A88B48621D8D435B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422161, "uuid": "17c13624-2bab-42a9-ad04-9db41274bbf8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422161, "uuid": "c67b5698-3e7c-4b53-b560-2fd541ebec23", "value": "24576:ByRN5NiqR78eSqeKTdtFktIbO0wfNu8M/KZV:0j5Niq8eSqhHk86ubC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422161, "uuid": "299a5077-1ade-44ac-9250-9e3148db8845", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422161, "uuid": "417a4ee6-4a07-4f09-8928-3a8455ab5813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422161, "uuid": "a6f5d04f-1151-4da3-a0db-346a9a8a6ea1", "value": "d99ab4d21eb141659c2bfc591ba7a9d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0705838-3e7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692441682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441682, "uuid": "f1654e22-1f34-482e-b9d6-2991522f75f3", "comment": "Malware payload (RedLineStealer)", "value": "44b647121fc6a0aea90a4206a71b1773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441682, "uuid": "6a4cdc9a-5c9e-4f26-868c-727136e518ea", "comment": "Malware payload (RedLineStealer)", "value": "ac222d1b52084029a846cdc85b31c30a05057c1f6ce2b35bea40ccbd7d83c001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441682, "uuid": "f0dd635e-e765-4fb5-a04b-ba4803f23b54", "comment": "Malware payload (RedLineStealer)", "value": "8fd5041fc7f3809d33bb8e4e7459e4fe8c18b9ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441682, "uuid": "26c1d01a-9c1d-43a4-8020-5721d8204e15", "comment": "Malware payload (RedLineStealer)", "value": "41984e043e6ee36560381c860979bf2bbe95e1508961a0bdba75c2338cb685a4b5d683eb119f76a949fffe7d8c9f12a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441682, "uuid": "8025b9e2-0ec5-4843-bfe8-219827750907", "value": "T182252367F6E90477DDB02B3128F706530E3AFDA28D70525B374A582B18B3A84653277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441682, "uuid": "65bf6c73-9840-4be8-92a7-f5fc55213ea2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441682, "uuid": "ebc0c6eb-3767-4cb0-acd8-b93cf2ff5e76", "value": "24576:Jy0TyZuq8DX0lwtQ44/yzD+E2zK7ZpRqB:80QM06QQyu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692441682, "uuid": "7fbaeb5a-87bb-48ba-80c8-6a58a1f1783e", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692441682, "uuid": "a2798459-4d88-494d-914c-84a8efc97c97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441682, "uuid": "a84af7ca-76e9-4883-b0c6-0734c3d1b156", "value": "44b647121fc6a0aea90a4206a71b1773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072d146a-3e7f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692442579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442579, "uuid": "ec07da54-c1b0-49ef-aa87-8d46bd4cc4c6", "comment": "Malware payload (RedLineStealer)", "value": "3b18236d20f3fcdc6b73948643a03b13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442579, "uuid": "8527f363-31f2-43bb-bc1c-c410662bcb2b", "comment": "Malware payload (RedLineStealer)", "value": "ac448a6412a2d9dfd4aeeecf1d0e1a3a75d28d064d9ae547838db5a0d109c7d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442579, "uuid": "1a1ad76f-fdd2-42f0-9108-7349d9011372", "comment": "Malware payload (RedLineStealer)", "value": "85d924315c2ff160fbd60a103a1ff68d3e955fff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442579, "uuid": "822be7ec-7b9f-476e-8e2d-2ceb7f529934", "comment": "Malware payload (RedLineStealer)", "value": "499df91acc42889a8c1c653f2969b177fe26b51837b3148ad26f0da161c8c354c664ddcaac3d9f05d14d53a4a252fd44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442579, "uuid": "6efd55d0-74a1-47cd-b9db-00badecd5cfa", "value": "T1F723F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442579, "uuid": "3928cade-02e0-455b-9998-7396c4bdb237", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692442579, "uuid": "b3285122-dbb9-49a0-8967-69187d07b27b", "value": 46362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692442579, "uuid": "8ce69d79-6e67-4edd-9d13-84a0b9f42d0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442579, "uuid": "4a3c41f2-2636-498c-a1aa-b66695bce902", "value": "3b18236d20f3fcdc6b73948643a03b13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b146aadf-3e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692456179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456179, "uuid": "00e0fca3-37b8-4aea-b445-aa21b2d53035", "comment": "Malware payload (Mirai)", "value": "8f0e9d282e1ae27c86d003ec16dc6485", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456179, "uuid": "2143c22c-e300-4890-b315-58adb1829b14", "comment": "Malware payload (Mirai)", "value": "ac861fecc4a55162fe5536f9084dec732d9812f113747c043695ee804cc835ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456179, "uuid": "7c555f00-ef07-435a-89b5-ad15c603c660", "comment": "Malware payload (Mirai)", "value": "fcf0dc9372107ed10dcd71d7d3ea83e881157f27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456179, "uuid": "b01b4b7f-7dbf-4a2f-a67c-c339b4b9c9bf", "comment": "Malware payload (Mirai)", "value": "dcbda41de40d33bc7d8b33617082d8f6c3eb64ef2c8228400b3c4d0558e928e80c406eb86bae5235794fdbf8118c2bdd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456179, "uuid": "0fa80717-1206-4e9c-9774-49378bf8a026", "value": "T11CC2D0E17726ED31C420AC3DE53A4C8A3A51067C91FE393664258C399EC1A5B67B84F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456179, "uuid": "856b5ce7-cc80-4d1e-b08c-42c92e20b9d0", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrv9q3UELuG:PKy4qfqoeJdXWgeLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692456179, "uuid": "ff3b76b8-7eed-40ff-937a-46bfaa6bd4f4", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692456179, "uuid": "58e1f219-00de-4ff1-a2f2-a419ec4d48a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456179, "uuid": "1267f97e-9c02-44eb-8977-ea346429a717", "value": "8f0e9d282e1ae27c86d003ec16dc6485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de27353-3e3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692414351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692414351, "uuid": "e620cdb9-9093-47e0-83e2-a92671cc77c9", "comment": "Malware payload (RedLineStealer)", "value": "2ea586c4d5df0b9ea2458da10fed8605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692414351, "uuid": "8ce89240-d967-4d30-a581-775310edaced", "comment": "Malware payload (RedLineStealer)", "value": "b0cb6e5f50b883d51345923a513ca93354ecaa62b412c31c248772589733cc2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692414351, "uuid": "2fd53857-5d0a-458b-bbd0-eb620dfb4197", "comment": "Malware payload (RedLineStealer)", "value": "0a4eaedff9affffd82bdb8d97d9a876142e88176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692414351, "uuid": "e454810f-15cf-40b3-8a5b-ac687a7ecd81", "comment": "Malware payload (RedLineStealer)", "value": "bbec28cbc594b2d5b5bb552422cf0d6e6046d4205095f2c7d83aeed1749d01acdcda47cc2daff5c38510543b2be22404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692414351, "uuid": "66758a0f-388b-411b-972e-e5e194674ed3", "value": "T1C725239367E44933FDB1AB7450F402870B3AFDA14A34869B3289AC565DB2791E23533F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692414351, "uuid": "903df60f-3167-43a3-a3d4-d1f6751219e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692414351, "uuid": "f97d54d4-a390-4cd9-9a2b-149fd3f3ddaa", "value": "24576:zy3ZyN7DSYTERmWwxq8pTZqwS8Px0J8/y/yIzC2W:G3q1WmllpvS8p0m/uVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692414351, "uuid": "f8485b2c-e8ed-4b57-a122-73507b78d904", "value": 975360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692414351, "uuid": "669da768-3440-4466-8d8f-676e93aac654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692414351, "uuid": "88b14f48-d5c6-4a94-8d00-8268e1c19b6c", "value": "2ea586c4d5df0b9ea2458da10fed8605.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ccd67a-3e73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692437779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437779, "uuid": "e1bebdde-c48f-41f3-ad20-e3a6b819e690", "comment": "Malware payload (Amadey)", "value": "8ef0ebaa3b5dc0dbcae4fa07615ef639", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437779, "uuid": "8db8e12f-b2f6-4f43-8032-0a4f214cbdfa", "comment": "Malware payload (Amadey)", "value": "b0e12333e12e7d99f9f4d43c0b6545c79634569fed724c5086b642061ec61065", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437779, "uuid": "0f206449-965c-4774-84d2-2740e14ab4f3", "comment": "Malware payload (Amadey)", "value": "e1e72975b7c46549938298f8e4ddf0bbed102ea9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437779, "uuid": "8318b900-9b4d-4db2-bac8-7b89ed87e6f3", "comment": "Malware payload (Amadey)", "value": "c6cf6414decbc8838eb0f6a3b2c1301ada92f483360e41916fcc54e00da8185bba287a9a65921c0f107a3af31cba118c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437779, "uuid": "23a281a6-588b-454d-85f1-703edcbbf142", "value": "T1A42523D367E84463DAF813346CF603935A39BCA244F4970E4B8A5E9A0973AC4D87935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437779, "uuid": "d41aa364-48d7-477d-a5d1-c61812adeef3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437779, "uuid": "8e53a998-b20f-44dd-bb18-8cd725af9dcd", "value": "24576:jyxkLAFS2N1DU6MgiUnc/UVrts1Uirntj:2mghKAOYG17rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437779, "uuid": "28d51fe3-4d19-4713-ad5f-a6e8a26db9b0", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437779, "uuid": "83d72232-723c-4ea7-9d03-b355e5490481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437779, "uuid": "e90a3fbc-bc2e-426e-a67a-9ce5e4a84d29", "value": "8ef0ebaa3b5dc0dbcae4fa07615ef639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3de4fb-3ec6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692473486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692473486, "uuid": "b94c0d8f-e455-49af-8755-94f5e655b48c", "comment": "Malware payload (Mirai)", "value": "9b3325cedac1ca7e93bdcbe870ddc61b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692473486, "uuid": "9c53a3f6-b71d-4178-b4f1-fb2db12ab515", "comment": "Malware payload (Mirai)", "value": "b207bd899a5d4b4248ed97df06ca7c09876d7e4f187af4821c3814a7e41d9d63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692473486, "uuid": "8b6081a7-0cb5-4ce9-afe4-e1a14ae753d2", "comment": "Malware payload (Mirai)", "value": "fb4c83e1ed66f7044375444b246d6200d7768e6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692473486, "uuid": "e1a35c10-2ff6-48a1-af4f-c3b680f9164f", "comment": "Malware payload (Mirai)", "value": "518698e607ee36b2ae200a7748fb9c11a34d6f95b4343bd4be9b69dad0725780fa9f7228df829a27f16af99356e05a7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692473486, "uuid": "bba9f54b-ad3e-4a7e-afb7-721e0ad9f640", "value": "T1BBD307D7F900DEFAF80AE33748530805B130BBA245925E372267357BED3A1D91567E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692473486, "uuid": "43de57d0-5ded-4ad7-b7ec-e3daf5f2c9b6", "value": "3072:CCWHLgeBziqEMohXwPAnTz3b0VrjbiwLdyLwL9ydhXw:HW8T7hCAn3b4Ldygyd5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692473486, "uuid": "db602488-8190-4e92-ae10-447150c9bea4", "value": 140416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692473486, "uuid": "4ddd0a82-3f76-4d79-a854-0139aab39b5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692473486, "uuid": "a8958d08-3665-41dd-ade1-0cfebb973b9c", "value": "9b3325cedac1ca7e93bdcbe870ddc61b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72287c7f-3e79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692440182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440182, "uuid": "c42a0261-759d-4b25-94d7-40cc7987dd8b", "comment": "Malware payload (RedLineStealer)", "value": "650bb84be58ede733ed023e1f86c9f30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440182, "uuid": "dc9fb71e-13f7-4c2b-9a06-8bd3801c811a", "comment": "Malware payload (RedLineStealer)", "value": "b8ee2960aab380f5665e2e85c5b58606daa563339a528be856e6640dd6f36bae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440182, "uuid": "3672348b-88fc-43ba-a192-7d8c8fdd132e", "comment": "Malware payload (RedLineStealer)", "value": "0a1e433dde0ac3882392dd49356b1f54dc6d139b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440182, "uuid": "7127e490-a485-4ccf-ad67-191c800ec585", "comment": "Malware payload (RedLineStealer)", "value": "84b1cf257db7af1a0f00f31f89fbd33ca50092c2932803d9609af5f89bbbc6edb7024f6902fd1e98a1971a11a57f3602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440182, "uuid": "bcefe46b-ea33-45a1-8e1c-3d6329c18082", "value": "T1F4052243A3ED1676D9B57B7018F613830B31BCA24C36D21E27D8BA6E4C73994563236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440182, "uuid": "6485f69c-77d5-44b3-8ff0-b51d5589c106", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440182, "uuid": "775faca0-394c-44e9-945d-7bab6b796915", "value": "12288:OMrxy90XtDkDoqWfg5omLWx6N+PpPrx4Vn5pP9lrkO1Xzh2oelBJEVFSEcnFjn:nyDWY5WUNit415pPN1Yl3jxnVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692440182, "uuid": "a1c5d737-b46a-4e46-b9c2-fb1cb8488ec0", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692440182, "uuid": "5670e080-c4c2-42ce-bb69-abe95d82cbfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440182, "uuid": "0a186c82-6425-455f-bdf8-dbc17753a5ac", "value": "650bb84be58ede733ed023e1f86c9f30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee02d43-3e3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692413386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413386, "uuid": "e06ed431-ef9b-4aba-a88b-ac478360fa1d", "comment": "Malware payload (Mirai)", "value": "35b6bf8a6c23118be4e6d6e53d4b1e4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413386, "uuid": "ce4cbfa6-72fa-4b61-97c2-ce81a7fb400a", "comment": "Malware payload (Mirai)", "value": "b959b73abfeb3a0d02e520b9a8ff9640880cc44a9b438582c2c96a4559ca60ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413386, "uuid": "9060f40c-647f-4c42-b550-e4b527d0acb8", "comment": "Malware payload (Mirai)", "value": "9b0933548e07ac7dfd788ceda995c626fd701166", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413386, "uuid": "34e14d61-010a-4eb5-9052-1107cbdcdfe1", "comment": "Malware payload (Mirai)", "value": "0269db4b9cb004c79216ed0d128e13e07716c0f5c38810071d255df8dafde6291eae8d4a8c68e6b19371aec639211d96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413386, "uuid": "5f4fe4a9-69b2-4da0-87ca-0f57e26d9431", "value": "T1C8D2E11CD95CBD05C6AD3EBE51CE56B5398C70C0635DB98E17228408BB1AFDBBC071A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413386, "uuid": "41279dac-39a2-468f-b6c3-1aa2c5c3be4b", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNv4RJbiWUL:1bDs06t4BEub4sU/MbUYmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692413386, "uuid": "02d1d955-0864-4399-87a7-9a6d4bc8ae4a", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692413386, "uuid": "c6b56916-3dd9-4804-8ca4-7aa03e02c01e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413386, "uuid": "4d9a7ed5-7e7e-46d6-8739-5a0af4253e7f", "value": "35b6bf8a6c23118be4e6d6e53d4b1e4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c7df1f-3e89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692447083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692447083, "uuid": "decfd02a-8cba-4d61-96f1-6a69bb854441", "comment": "Malware payload (RedLineStealer)", "value": "e26214c95391693dbeb195f3505175fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692447083, "uuid": "a6d541eb-cb60-4df1-9380-98f78c757a74", "comment": "Malware payload (RedLineStealer)", "value": "b9cbbed3e5ad1281b2b3bb2c419932676fe8f3029a3ce541b1ea54a07cf5df3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692447083, "uuid": "31bd1a89-3931-4bea-930a-c6a98194b9a3", "comment": "Malware payload (RedLineStealer)", "value": "158dea72e582db690adef0f214c8d51ed49b6ce7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692447083, "uuid": "e5b4c97d-edbd-43f4-aae7-58c89efad987", "comment": "Malware payload (RedLineStealer)", "value": "d35a3ea1b6f22c5caa834a25fefdc026cd25e066677811d8af27e8c72ad4e1058556a027c0659b1a4158b4974a1a3504", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692447083, "uuid": "2f441ffb-c6c3-46b2-aa02-0492b15a3938", "value": "T1E6052212FDE49072ECB0A7705CFB13D31E367CA19938925E23946D1F1873A80A9757AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692447083, "uuid": "43095ca0-e5e9-4a2b-80a1-7fc238736efe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692447083, "uuid": "1ddb26d1-aad9-4429-bc38-d171411a2078", "value": "12288:HMrzy90htJhjrc9sm+9l874/mVspWwsb8TdrhvtQZXZOpHPbY6qay8yz:4yQZrWsPl874ob8BdeZpOpvbY6Fjyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692447083, "uuid": "1057a767-b123-406c-9c46-8014ba001a51", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692447083, "uuid": "6c6ed852-ef2c-405e-a72c-b03cee051c0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692447083, "uuid": "c7b492d2-7528-4ca4-b226-02aa9abe5fa9", "value": "e26214c95391693dbeb195f3505175fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66836db8-3e5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1692427707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427707, "uuid": "4ad58ef7-0bcb-45ff-853f-446fe0373b54", "comment": "Malware payload (Smoke Loader)", "value": "bd0ffc2e1a9f0f13c8778fbe043af0b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427707, "uuid": "7ab70401-8545-4af1-be71-2406cde13928", "comment": "Malware payload (Smoke Loader)", "value": "bae93cf5e0de35c574ae5c2d78ae5f7929c1f944e885624009972146f85eb1e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427707, "uuid": "14bbacf2-c3ac-4e04-a4eb-819e853c18a6", "comment": "Malware payload (Smoke Loader)", "value": "b45f1b45b4ea3b8118eec41497e097b0cb3e6fbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427707, "uuid": "ceec390a-69d8-476b-a11e-701970c7e239", "comment": "Malware payload (Smoke Loader)", "value": "cba7647c6ff33b63526663a9b6c5d069c962bd6bbce3c3df3793955591e1ed4b7e452a5b76536271fc1886cf45a1fb01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427707, "uuid": "c6d0287d-8e45-4708-949d-ddfc3672ebc4", "value": "T14F24C0337AE0C032C55B55F19564EBB06A6E783287A0C54B77A807BF7E317A15B3A306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427707, "uuid": "a5ba629a-9952-42e8-8e0b-2d233fa2f693", "value": "e9c0bae0408e0bafadfe55650c235281", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427707, "uuid": "4ce55fb5-c8f1-4f68-9ca0-826bcc98595f", "value": "3072:pFCcgLex7JOKS41sh/RR2Hyh0PLQLxrObBKJEUMOaSpzgwfZAz5ckD9yOA:XdgLu7w54SZRKMk1KJEUhJgJqkD9yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692427707, "uuid": "7ebc4d3e-032b-4c87-af64-1003c903978a", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692427707, "uuid": "b0450803-9951-443d-8ffe-024461e09d14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427707, "uuid": "faceeb90-83f8-42aa-87b5-95ecff3d6e93", "value": "bd0ffc2e1a9f0f13c8778fbe043af0b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9de621e-3e68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692432974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432974, "uuid": "6fa936d0-7c8f-47bb-a78d-326cf8e51dd3", "comment": "Malware payload (RedLineStealer)", "value": "c68f1c2735bc2eb43617059a2ee7c1a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432974, "uuid": "fe09aeb3-9b86-4f09-b238-488fd6e02d2a", "comment": "Malware payload (RedLineStealer)", "value": "bd6fa9eb4342f8cc775a8a63bebcec033e42cfe859871a920738e3972e8f40d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432974, "uuid": "f8e88480-8140-400c-901e-a203aa132ca7", "comment": "Malware payload (RedLineStealer)", "value": "12068c72838a053eb94458815756ba2d5f830e4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432974, "uuid": "c47daa5a-b640-49f3-b65e-f4c7903f0b94", "comment": "Malware payload (RedLineStealer)", "value": "f87eb793e00ea098c5237c9d4cd66010e35d3fca93915a3cec5a19cd41a18a065460541ef08695acad9bba6b9801e5e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432974, "uuid": "d674bdc2-0352-45b5-92e0-35f19aa28ee9", "value": "T1D8051306A6E480B7CDF4477458F602831B35FCA29D7C536B2391A9694CB36C498B9B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432974, "uuid": "d2be4231-dc0e-4fb3-8efd-798dbdf710ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432974, "uuid": "024350b8-b113-4670-bab8-28ab7af0c76c", "value": "24576:zyvXwuJt3d7yKNNFdXucTjfoZPgzhUExDLfm:GvwuJt3dLDFR/THL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692432974, "uuid": "3e175bd8-e06a-4cc8-8175-9db0e98c31a7", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692432974, "uuid": "5bd035b8-833e-48bf-9dd6-c6c8ee330bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432974, "uuid": "c7ce25cd-aef9-4953-8fde-427468315625", "value": "c68f1c2735bc2eb43617059a2ee7c1a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f176146b-3e7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692441684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441684, "uuid": "82d48e58-5987-498f-b9ff-4a2089d53191", "comment": "Malware payload (RedLineStealer)", "value": "a42d7831533c98c182e29666bc57afd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441684, "uuid": "ff78609a-daa4-4260-bb71-450303c35a06", "comment": "Malware payload (RedLineStealer)", "value": "c09af2c1cef1f819c0da5a4d4524b3ef166aaf1b5528081eda8464bfdb9e2a99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441684, "uuid": "578ea32a-0428-468f-835c-fc1c4e960077", "comment": "Malware payload (RedLineStealer)", "value": "a646d19cb0589c84c5d87d1e9589b1c8ff8991e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692441684, "uuid": "042d28ea-8e57-4772-a9b2-104b8ecb97f2", "comment": "Malware payload (RedLineStealer)", "value": "dae9a9afb254673cb3c6c81969bbda9bdea7c519a343e034c197d7c3ca4a8f7dcdecd9b726db355316f9f7f83d3b2a66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441684, "uuid": "95838d6f-d5a5-4d05-a057-01e0953c3785", "value": "T1B505225BA7D68472DDB4677018F707830B39FCA108745A2B279E6C2A1D73698F53233A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441684, "uuid": "f11657bd-a263-4da1-bc5f-46f05743ac76", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441684, "uuid": "2b919915-9524-42c4-9be2-10355de21daa", "value": "24576:ZysdUN8NWifSIG+8474PKO3cf5yjYh+Hmp3lu:MsdUNOWifSh+84sPKO3cB3h+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692441684, "uuid": "79b12da4-5e36-4f90-a4b6-dbceaef77d3b", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692441684, "uuid": "b73a69b3-e257-48c7-a1c8-a2be709da377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692441684, "uuid": "14c03a9a-8274-4b0a-8ff0-a056eba1a2bd", "value": "a42d7831533c98c182e29666bc57afd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1530d3c2-3e3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1692413397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413397, "uuid": "16f7bfaf-aeab-4056-8885-db508267b213", "comment": "Malware payload (LummaStealer)", "value": "35b823296152d234d2a6a9999df3a462", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413397, "uuid": "1078e5ff-4f5c-4b29-8f75-2c00464dbe2a", "comment": "Malware payload (LummaStealer)", "value": "c28bc925e3bad21b524eca44b846ae271a0435e9735c9624ba6404d8125401a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413397, "uuid": "484fefc0-baea-47a6-a97f-a2c1dc1fc2c7", "comment": "Malware payload (LummaStealer)", "value": "c07c47772f2f2422bf223c85099d560f9b06bbd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413397, "uuid": "20d2c5e6-aaba-4572-b30e-ad8c68d2010a", "comment": "Malware payload (LummaStealer)", "value": "92e2d568b5b364e7b0375d7071a0cae499f15e463728b9f44de8048009b362545ae16fcff84b28d9ab4ef59c03b7d0ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413397, "uuid": "593a3f95-701c-44ea-83b1-bca6b28548f0", "value": "T1528401227AF1D072C69B44319829EEB5BB7F613259F0948B377907BD5E306C2A62530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413397, "uuid": "91431a0c-7a60-4ab7-8d3b-c0ceba23c3b9", "value": "fa3a94445d38caaa6c88b60d7635d589", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413397, "uuid": "d32b0ac8-5f0e-4d02-b996-12f64250ee5f", "value": "6144:S3LKnUPk4DpZc8YBpOMuCGLDp3IrI28Wt2MnEkq8BP6FQXYNY:S3WnUPk4D3YDOMuCGLDYI28WtckFBPAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692413397, "uuid": "15b71b6e-277c-4afe-a212-c3a0d5221966", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692413397, "uuid": "404d9791-33d6-49d6-97c1-d3e5d474dc68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413397, "uuid": "c8338550-eab3-46d5-b998-7d1641720807", "value": "35b823296152d234d2a6a9999df3a462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39899c9-3e8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692448532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692448532, "uuid": "a40a542a-780a-4889-bb93-28f48118ec67", "comment": "Malware payload", "value": "8a32373253b4096ca072b85f0e476ba8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692448532, "uuid": "bfd6db03-40ed-48e5-87e2-0d8c6b36fb67", "comment": "Malware payload", "value": "c2c29a35f3202b750d2bdc8eece7f4a117bdddade7238941d92f7e8ef731d000", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692448532, "uuid": "c5de9fd1-e9ad-4603-af4b-af66f1f046a5", "comment": "Malware payload", "value": "7dfb890f6c03025312ed38f5e1d6d3e675f0d8c9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692448532, "uuid": "12b2ac1a-1ae8-44c3-8960-bd90984ef6c9", "comment": "Malware payload", "value": "9af2cc0c28bf0ce135d8df3342db40a7fd62830d0eb56a94d87060bcfacdacc1da541efc5b85fbd00a6e109b0679fe19", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692448532, "uuid": "1117a705-b94a-4e25-9191-ea7305f4743f", "value": "T1C8A62357F72CD42FC977A433CFBA522211A90D498683BB237915B21C2AB79849F49FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692448532, "uuid": "cfc13e43-ea1b-4687-958a-ea606fa76fa9", "value": "196608:gQ2Jq/geR6QCRmVomHGfX8gTFeqalhODkSIjYm1VUbHlVR9HUGu:F2JqFJCRLmHGfX8umggrZmjHUGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692448532, "uuid": "22fc89e9-68bd-46d8-9af8-ad3e9cef8ef8", "value": 10207431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692448532, "uuid": "161b49d9-f539-4a63-8718-87b2f07faac6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692448532, "uuid": "db9b0f19-b32b-484c-abb1-e22acaf03acd", "value": "com.filemaster.nx.manager.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c35673e-3e74-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692438078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438078, "uuid": "286ca37a-a45a-4196-9339-8ffc65e3cd6b", "comment": "Malware payload (RedLineStealer)", "value": "c22e329f0415acf01ea836f63574dce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438078, "uuid": "0708d501-b386-4167-b9ff-8b3fee7e3b84", "comment": "Malware payload (RedLineStealer)", "value": "c32e18440e8bba489fe895eeee8b060c8910daab747f83f4496e33bdff6b3fd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438078, "uuid": "2f2f6f15-2bd1-4070-930b-3b74b458d316", "comment": "Malware payload (RedLineStealer)", "value": "ce81c5d39cdc713076dd5089d17c28df8ff4f3d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438078, "uuid": "ec36ed9c-5a82-4f11-a40a-a0dec8854d74", "comment": "Malware payload (RedLineStealer)", "value": "1f50ba1ed7ee2bd4eac81c7c1ea684661169219284eeeaa17a2f3888796f2251375e35250f85c3a358298e6c2b6747fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438078, "uuid": "b7f03c11-f964-40a3-9dd2-e11169a8ba9b", "value": "T15725224787E44137D8B2173418F316D30B32BDE39878935AA798B86E19B3B84957632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438078, "uuid": "b0cf2751-8626-4bab-bbb1-010379776162", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438078, "uuid": "fe7e6687-066b-467a-8209-3a37ae629176", "value": "12288:KMr6y902LuhE3NQRHBc+S/4ma0+iBZeK1XYmcLmZpiEX6YyD+zZOApZF48V9hpTF:oyxLnNQRH8BtZp5pIApbXnPrGSICn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692438078, "uuid": "3a51865e-336c-4dd2-9a81-6b03cff324ff", "value": 979456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692438078, "uuid": "4ccb3ab5-62a5-4835-a76f-cf60f4806290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438078, "uuid": "720a2bed-c24b-4f01-a533-19ae2526a6a6", "value": "c22e329f0415acf01ea836f63574dce4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b2cb67-3e24-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692403679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692403679, "uuid": "16fccdfe-3168-4351-8e5f-14e004656347", "comment": "Malware payload", "value": "0873780720fd754eaf235d73916adb56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "zbot", "colour": "#E1A420", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692403679, "uuid": "d4586e78-cc32-48e4-9e41-842cc7dc0bbb", "comment": "Malware payload", "value": "c44a22c3498393a89472f0cbc49d65813ce190da040f41b66acd042669652e5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "zbot", "colour": "#E1A420", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692403679, "uuid": "b72a8a0a-3112-459a-a8a1-d11252d8ff60", "comment": "Malware payload", "value": "49144dbbe672b2eb5ad37690889e9fa50e486497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "zbot", "colour": "#E1A420", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692403679, "uuid": "95a15e6c-56e3-4e9d-a3ab-7cea3eb29ab7", "comment": "Malware payload", "value": "0a9728d379c85e1ad7562cdb89b0f71a39436e717ca5312d7ff657131326e94f0f3646e20f0ddccda8fa18626912365c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "zbot", "colour": "#E1A420", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692403679, "uuid": "28a312f5-1e2c-4348-bf05-eb6830480619", "value": "T1543311BBA1ECEE67D2C546728E29E1BA1289BE4D4F162333386B3F1BF4375020B54515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692403679, "uuid": "daf89878-d627-416c-a664-8672b6d4d42d", "value": "bb2c8eb3054ba7f3e7e488a127249ddc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692403679, "uuid": "3c56ed2b-9f9c-41ce-a0ff-46093f8537af", "value": "384:irEqWWO2kBRr0ZmJ8ZbhhVdVszow6smgbfRv:p0qBRQZm03dVwfmIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692403679, "uuid": "b09dfa04-356e-427f-b5b3-67e510a48532", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692403679, "uuid": "02ee1305-7771-463f-9268-88ca4c7e5631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692403679, "uuid": "3c0c0ab8-81a2-441a-9403-0710f3792c9b", "value": "mcwsazmq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97c4ce2-3e5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692428275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428275, "uuid": "6441ca58-fe4d-4207-aa74-2ffa1e893e16", "comment": "Malware payload (Mirai)", "value": "7b340154e7505a1f269ebd8aa90ac97e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428275, "uuid": "28f43e8d-0fdd-4f71-b2e0-909cc8dececf", "comment": "Malware payload (Mirai)", "value": "c480f04390cbd96aade9fcb3f453456c544c9b181a12055b019b4f9fde0868bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428275, "uuid": "51e58fc9-7c47-48df-a521-37e6e0004440", "comment": "Malware payload (Mirai)", "value": "ff3b95f6ebe3a51cf2ade2f4cd25b733bdc7b818", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428275, "uuid": "36c61509-5c03-416c-83f1-28b3acc4672f", "comment": "Malware payload (Mirai)", "value": "bfeb837e32e92d06c17e999a7f2baa8f512a9f6cade96307749e95fa69e1a514b40324846e2d327d929ba7f72feda343", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428275, "uuid": "a67e54d8-fed8-46f8-aa72-e34792370057", "value": "T139538D75D11DAEA8C0414AB4A9198E704F13E4C046733EFBEA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428275, "uuid": "8c0f6dd7-7134-41e5-a0dc-25195e3835f2", "value": "1536:ragXV1f1Fl/wtkLyPQauiufs3Ii7O/qyD6EZeCc:r57f1b/wQHf+Iiy6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692428275, "uuid": "02622486-effc-4bb5-bb47-73781d98181e", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692428275, "uuid": "350ea0e1-7a91-4607-bbb7-6409fc87b913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428275, "uuid": "26cd9ec4-2319-45e5-ad19-ae57098d6699", "value": "7b340154e7505a1f269ebd8aa90ac97e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f1b4bb-3e5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692427872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427872, "uuid": "ec987b4c-6618-4227-a650-6499a16b8f62", "comment": "Malware payload (RedLineStealer)", "value": "be96448505abe9bf263c0622d12ff04a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427872, "uuid": "5976a62c-c6e8-4753-8bc9-b9e4e1704024", "comment": "Malware payload (RedLineStealer)", "value": "c4d6d54df9c501f97a71300c5aa604d6045698935850c64f3498e430121f141b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427872, "uuid": "00a9cfb8-f0c2-45ff-8923-a7141dcf8268", "comment": "Malware payload (RedLineStealer)", "value": "2502c273702e1a9678b7e9b776d11bfd00ce6a44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427872, "uuid": "c2ed8291-ead2-44b2-a52d-7a5f5666e8fe", "comment": "Malware payload (RedLineStealer)", "value": "f03b8a6192393b380e6dd97fbac64455a03dfee938b401298fa759280b235a4d2587435045d24a09b917e4593ae56dfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427872, "uuid": "9fea9e6f-c52f-42c8-9f0c-bdd4ffe38581", "value": "T1040523A39BD89577DCF12B301CF647C31A36BC701878A7662342218A0DB36D5A97276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427872, "uuid": "cf042fcb-0a7a-4ce9-81cd-e9a09ea4d074", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427872, "uuid": "479615a4-3e59-4266-80e3-09f0a57adff5", "value": "24576:ty/NVHRTenjjyEsQ10uqkNm59oT6nKPVWQI7w:IVVxsjjyEt1RJm5g6nUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692427872, "uuid": "5b7f8ca1-1cbf-45c3-8b8f-e44a19af70b8", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692427872, "uuid": "59d0d923-fb8d-43f7-a2b0-7aceaf46c487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427872, "uuid": "c5a108fd-200f-4179-b9e6-4e67b262456d", "value": "be96448505abe9bf263c0622d12ff04a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdaba0b9-3e78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692439879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692439879, "uuid": "356e8802-4d8d-42e0-a50b-6a1df4b2d130", "comment": "Malware payload (RedLineStealer)", "value": "d65c8e319db4237f2163b4bbccf11cd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692439879, "uuid": "d36fff54-8d41-4edd-b32e-be32f6822ed7", "comment": "Malware payload (RedLineStealer)", "value": "c7b2121cbaa2ae20d6bf81443ba4a3d8a0fd3db2961c154884e1a7b88fce51d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692439879, "uuid": "e789f8bf-8672-40b2-b5fd-791882624788", "comment": "Malware payload (RedLineStealer)", "value": "64a71a2fdcbf46ac94dc632c0be40e0327869474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692439879, "uuid": "08163d0d-f447-4602-8bf1-fc120d9b3772", "comment": "Malware payload (RedLineStealer)", "value": "94579ea7a6b8444addf73e4557389034d7a652182220a3b8062fab713e6f3d868990c16dec72e808dee35f5ca715a185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692439879, "uuid": "612f2d20-d379-4d80-8ed7-ea3c024d069e", "value": "T1F2052253F3C85032DAB61B3024FB06E71B36BDA14D74C72E2381585A1D77A88A93677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692439879, "uuid": "19d48108-2710-4453-b5cc-10f20fc4d728", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692439879, "uuid": "6f1d0bfa-31c2-4904-8235-a4ab3b647848", "value": "12288:RMrXy90wDFvpSeEBnvTiH3z6HtsBEax5YfGJlqK11jq8JC7d+QIpysxR:2ybJvo7nvTFNsBEaH5JlqOhq6QIpDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692439879, "uuid": "8dec573b-0c5e-4dc3-a5c6-d22b0559feab", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692439879, "uuid": "edb4f4a3-c6c1-470d-adbf-3b3eacc38c5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692439879, "uuid": "1455c257-234c-48cb-a87e-0ae539d835c7", "value": "d65c8e319db4237f2163b4bbccf11cd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8d94fd-3ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692469839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469839, "uuid": "322ba27e-f238-4468-8b73-3d82fecfaef7", "comment": "Malware payload (Mirai)", "value": "44cca619b3734779b81d76ccf249a2ae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469839, "uuid": "914cfad3-973a-4f7e-b254-9ba02c0f4eb4", "comment": "Malware payload (Mirai)", "value": "c7d73a16c82f20d39c1a04db29c054afe0f03f318b8bb4fd92b4422791f2a7ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469839, "uuid": "56b99582-9d38-4a1d-be52-70763432f11b", "comment": "Malware payload (Mirai)", "value": "e53385cdd80f701f967dbdc2f6ef3c97964423fd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469839, "uuid": "f57b287a-713e-48e0-b62b-7c99044feafa", "comment": "Malware payload (Mirai)", "value": "5a8ad108cb92cd4f0bfe5d18fb1a79b44e4a467e50eed9836326658d5fc5dadf88c929dee1c98198c61976c628dfb245", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469839, "uuid": "b8454111-6d59-4e54-887e-8f6e3f358909", "value": "T193736CC8BA83D4F1FC6309B25137A7728773E12A546AEE42C729AD35CC92910E72735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469839, "uuid": "a38e1a65-a477-4941-80f2-68669782b820", "value": "1536:ui0zOxnGToKB5KATI4i2lpdtqNUlISjot0Y9Ceya:f0zkncoKHS4iOLt6UVjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692469839, "uuid": "09f3be40-683e-478d-94ee-8fe90cce49cd", "value": 80232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692469839, "uuid": "02bf29ed-5a92-4729-9ff0-99bd829c44b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469839, "uuid": "ddcb539c-7183-4abe-a7ed-e8c3c861fe4e", "value": "cundi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb96ac2f-3ee5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692486691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486691, "uuid": "28e435df-fd6e-4b26-8324-ca91099a05c4", "comment": "Malware payload", "value": "b3c6024705a0df8f4de9557710004fbd", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486691, "uuid": "c7f2396e-d900-448e-bc22-8c4d3fc0788e", "comment": "Malware payload", "value": "ca5fbcf6a601b2a8d57accf212530e8c6d2091815de8424788b7ad63014c902d", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486691, "uuid": "34b35722-250f-4fb9-92e6-57f58234d97c", "comment": "Malware payload", "value": "91a8e6edba8a68cb158936630da62b316b4eafe0", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486691, "uuid": "1c243815-9af9-4dc0-9fb9-87fdf0dd5856", "comment": "Malware payload", "value": "25c46f54dc0d77cf15d5686b401f6d275ac03caa5d458b9dad8a84c3bb009b183644a9d4752022df9be3d3d967bc0f4c", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692486691, "uuid": "dc10cf03-949e-4df7-8dd3-2b16e0370e03", "value": "T178C533CE08C43FBDE14DAEB4148F9EBE8256BF10A6F1B7D1D975A0211AD61F899C901C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692486691, "uuid": "cda8e12c-647a-4e0c-8035-5710cc27a0d2", "value": "49152:7oYnUTewTW8sL3HYZucJ34vR7B4ezGJZBORR7ZH1FkOMb+HFisO:73ngewTioocWvxBiSlZH1eOmwFiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692486691, "uuid": "924ecfd2-473b-48f6-8366-1e9d632ee851", "value": 2553342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692486691, "uuid": "f538e9cc-2d75-4695-a65e-e0d632b4282c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692486691, "uuid": "7a3d3874-e8ef-41c2-a80f-e981096fb83b", "value": "extensiontemper.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115996d7-3e63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692430570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692430570, "uuid": "efcae1b5-cd3d-406a-96cc-b50e81e376d1", "comment": "Malware payload (RedLineStealer)", "value": "998a042cd6758a60fac960e94317a7c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692430570, "uuid": "afde7de6-e435-4ea0-98ae-5669f4aec80f", "comment": "Malware payload (RedLineStealer)", "value": "cd548c0325b705433f187863cbf82e6faf23a7f2ce62c4cd7870739612fd827b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692430570, "uuid": "83417a4e-c40b-4e6d-bc92-5d9766c8588e", "comment": "Malware payload (RedLineStealer)", "value": "4b21fc6ecdd0d1e7ebf67748970d60f076072a49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692430570, "uuid": "67c2bb17-36d3-4c2c-95b0-182fe73c0a76", "comment": "Malware payload (RedLineStealer)", "value": "204ee916e8be2f9e6b81333028e8180f68223055693cf38b64e20e9c25309915dfef893e4c3c7e17fd9912589caddf49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692430570, "uuid": "dceac2e5-31dc-4970-b7c2-acecb7c0b82c", "value": "T172052392F2E18123D8B627B55CF612D30A397CB259AC937B6B88948F0C73241E57176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692430570, "uuid": "fc8ea771-ef4d-4c6b-8464-a04474adfc12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692430570, "uuid": "1b7d42d0-c144-4fe5-b90b-65beba5a5180", "value": "24576:uyQ1p17n6B7TOFSIQQDXIEDfUh9LEqC1vNAk:9CpMT8SIfD9u9w1HA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692430570, "uuid": "2859da20-a46a-4cdf-af80-dcf6103a795a", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692430570, "uuid": "c4a75aaf-2a3a-43b8-bb4b-0031e0f3bf6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692430570, "uuid": "d1624a32-65d8-43f6-af48-edf9d49c3ec5", "value": "cd548c0325b705433f187863cbf82e6faf23a7f2ce62c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0919bc-3e44-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692417356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417356, "uuid": "b26d2b2d-8dc8-46f1-bba2-be4a8eaceb08", "comment": "Malware payload (Amadey)", "value": "98d467ac2a9042234ab94559be7ca537", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417356, "uuid": "91a996be-426e-4191-9a8d-0220974766b4", "comment": "Malware payload (Amadey)", "value": "cf4303cd2b3d31386f9fab9baec4b0899bd5d14499a5cc92a3f288dc0c4f3499", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417356, "uuid": "544c3e85-7ddd-4356-9b02-5d019b02fb03", "comment": "Malware payload (Amadey)", "value": "3aa9e01a25cc9283606cbed56fc8db6aad16c94f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417356, "uuid": "115cf5d1-4f67-4f96-b7e0-6601202cf069", "comment": "Malware payload (Amadey)", "value": "10a56816f140cab0cbe2e41bfe7411e05dc26aa3657c083d8f73462c1d7f7458d009d6a4ab97e026b3213f29c1edefd0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417356, "uuid": "b086e428-19d3-4106-b240-e30455a45970", "value": "T187F41207B2E48072E8F4277048F707971F39BCA2EE7482BA2B45985A0DB2584D5757BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417356, "uuid": "b13cbc13-62b5-4bb3-9b08-1adec197a87d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417356, "uuid": "cc7cec3b-1160-41c3-b000-ea083f09c035", "value": "12288:xMr5y904he7nGRS6d3arId5grDPpbvQNpO/xGZ7Q3RnuJkSdQOcfP6H49o:IyZsnx6dqrLDPpbAGxGl4UkF1fP6uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692417356, "uuid": "a3c0d47f-5024-4e23-94af-273f493e5d4c", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692417356, "uuid": "f5a54da2-c999-4859-946e-e578b2c272a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417356, "uuid": "5942aa49-d62e-4fd0-ac42-108f5729fd97", "value": "98d467ac2a9042234ab94559be7ca537.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda34b4b-3e7f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692442885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442885, "uuid": "86a64e3d-85ee-41cd-b002-fc11fbb657d1", "comment": "Malware payload (RedLineStealer)", "value": "d304f1cbbcce2063c063842bc062f90f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442885, "uuid": "479e9cd9-7d5a-4790-9b43-694a337934ba", "comment": "Malware payload (RedLineStealer)", "value": "cf44de3e5a7caa54430f94c1b9082e964cf4d12523e4225ae45446d7ba0a5fe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442885, "uuid": "e12312d8-4755-4b37-ab7b-af3c65e61b82", "comment": "Malware payload (RedLineStealer)", "value": "03fa59aa64ad3ee2a480dee34fc2676be86f164e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442885, "uuid": "77a5a48e-3086-4a6c-badc-2e3d886d5662", "comment": "Malware payload (RedLineStealer)", "value": "cdfc1a232331433985c13b5d918733d68093ed6c9ed62ad3a2a63fdc8cac276db7a3f7df8a05a23c3196f07e498af8df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442885, "uuid": "4ee5ca7b-08e3-4b13-8a03-f754f5531ca7", "value": "T1E7051296A2D85036D8B31B7049FA12871F33BCB16869C26B6745A45F1DB36D0EE3433B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442885, "uuid": "f0bfb9e9-8e1d-4f85-ab22-c6c3ff034efe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442885, "uuid": "df9fd4d2-35c5-4bd8-9c58-4781022ce098", "value": "24576:Ry3e/W/D2z6QcNBelNMY1U+ikt8LtJhTbN845qQel:E3e/W/D2SroMr+t8Lnh3N83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692442885, "uuid": "cf7849cd-4727-43e2-95d5-2f7a01f6430f", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692442885, "uuid": "a02561a2-1dba-40e1-b94a-8f439cd75754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442885, "uuid": "cb375a6f-1ec5-4af7-aa41-f491197d56d5", "value": "cf44de3e5a7caa54430f94c1b9082e964cf4d12523e42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38948f82-3ed7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692480458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692480458, "uuid": "77ea1ee8-033f-47be-8c56-f47060697a3d", "comment": "Malware payload", "value": "e35d508aef7f018999a7b2d60d043795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692480458, "uuid": "93e35e86-06cd-4962-a684-a68280b9af4a", "comment": "Malware payload", "value": "cf59bb0d65b42fbd66968ff5b7c97e0d5ab2aff46e672f12f701a22bc9ed904b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692480458, "uuid": "70874d4b-5cfd-4117-a0f5-97e0ead4fba9", "comment": "Malware payload", "value": "7bdd2f352486f3cd240a936ceaeb545eb08a1eaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692480458, "uuid": "1adecf58-edda-423d-a942-fed9fb503fb9", "comment": "Malware payload", "value": "304477f4375f13a6fb9d56ba8876c23555532637fa95053150aece7cfb48c47849a55e8842e6ae6fd580919897a45dbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692480458, "uuid": "b0eb010c-4041-4882-a101-cb63c01f2b99", "value": "T10DA5335AA3E82161E539077688F3230BE6F1BC648B7922AF13C5D63F1D23AD67571702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692480458, "uuid": "bae51373-1d50-4f92-bb33-b39b0070a331", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692480458, "uuid": "fd8c8332-b892-4417-a51c-f75d72b8cc71", "value": "49152:/sesd+yXDBfhcNhlKxQaDIhtRUN8BF9JJyfxUFOrhIZGnMvQD:SdHTBfhcNhlKDQUN8BF9JJyJSjOMvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692480458, "uuid": "2cba4e8e-eabc-43ad-877c-a391e208b7bd", "value": 2167808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692480458, "uuid": "a0b2a8fb-a77e-4f1b-8118-17829e533aa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692480458, "uuid": "3433ca17-4c80-4166-b304-e1726fde404e", "value": "41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a0654d-3ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692469848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469848, "uuid": "0cd9c59e-191e-4d81-b0d5-a4cd9e867aa0", "comment": "Malware payload (Mirai)", "value": "da501794df50ab2e2884f1188296b870", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469848, "uuid": "53ecd4ec-185a-4f6c-93b4-7e676bad7054", "comment": "Malware payload (Mirai)", "value": "d191d96fcef7cf4eaccae1c6e95346e8caed7434b845708696753bee654ec163", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469848, "uuid": "266a4b96-fc67-4ad7-a5e5-e28b9ba51e56", "comment": "Malware payload (Mirai)", "value": "7a91a3999bdf838dd14be22480bb8ed80f58cb93", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469848, "uuid": "aedefeb2-6ed6-4ce4-b14c-6ebb661b6bbc", "comment": "Malware payload (Mirai)", "value": "e05d5af1ab45dc568517507671fe8d1ec4bf598e8e122e5f9458f67bf19de3e70bcb44060238af0ff8c068ec4650109a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469848, "uuid": "3820b76b-1b18-448a-8766-16fae14ed299", "value": "T1D5F31A46EB404B13C0962BB5FADF42513323AB5497EB7305A528ABF43F8679E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469848, "uuid": "188cf9a2-820c-4424-84d6-df246c56a843", "value": "3072:qJquOt1Y7AkbaGkrpWRTdxEUHm846/szDDohM/RqpbpF:COt+fbaGkrpqTrmz6/cshM/RypF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692469848, "uuid": "7e5c3d3d-c4c7-46e0-847c-fdff12de3db9", "value": 168068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692469848, "uuid": "65dc7dd7-3c36-4769-916f-98a4cb5aa9c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469848, "uuid": "cc31c280-09e8-4650-ac20-22fe371ab010", "value": "cundi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4623b9f2-3e59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692426364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426364, "uuid": "c1ec650f-d0c9-4abb-8a2a-3043415ee479", "comment": "Malware payload (RedLineStealer)", "value": "69e1639327e116d58a660467f84d0f56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426364, "uuid": "b61cd6b8-0281-46e0-b9fc-f28a519a8bc5", "comment": "Malware payload (RedLineStealer)", "value": "d1c62612ef8537c583b8b4d5d07b693661f08884e87fbdbf1708af0b372c838f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426364, "uuid": "4c8d4e93-5b6c-4236-b7ca-28b379693f78", "comment": "Malware payload (RedLineStealer)", "value": "4caed5b5ec4cdb71095fac8c93721d603fa69e4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426364, "uuid": "c1d4a4c1-659c-4615-9140-7fe39a164124", "comment": "Malware payload (RedLineStealer)", "value": "64e79a2cc252c914d73931e017636e84a567a9a2985e62700aa761569c3c131568fc87a6d87a4336371790e88f3ffd16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426364, "uuid": "ebd290c6-0e38-4408-8048-40713a6313f9", "value": "T14A051243EAD88072D9F52B31A8F212D31737BC90AD78D39B5245B95D1CB2144E9B633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426364, "uuid": "8d40a238-2565-472b-98d0-fdca9e779a66", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426364, "uuid": "e97ad8a4-b2b8-477d-919d-8f101061e425", "value": "12288:bMrXy90+kds5ZQVgByAfAji4+gSMw/8M0AQgFkfdTRFy8Tt5jJDXK8a3hlzhXJzY:4y+ds5y41EiCeEM0AQoORc8f4x3PI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692426364, "uuid": "aa9592ba-c2ee-49c2-a0b4-ca6678e4b094", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692426364, "uuid": "1095a79b-bdd6-4863-b663-bb7df4c0c4c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426364, "uuid": "b516a7b8-a145-47d4-90af-73b370e08e5b", "value": "69e1639327e116d58a660467f84d0f56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e127550-3e4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692422163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422163, "uuid": "03ebfb83-5e36-456b-8051-d8e567687743", "comment": "Malware payload (RedLineStealer)", "value": "b9c2221414422c7a0e0be245661ad5d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422163, "uuid": "16341c07-ba91-48a7-b093-b32fbeffc39e", "comment": "Malware payload (RedLineStealer)", "value": "d611bac5579b09a3b7ddd234871ecdb22ed1774ef626c2ee0a8b0031fb371d84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422163, "uuid": "f78da1fd-0def-40d2-87af-212c5deee358", "comment": "Malware payload (RedLineStealer)", "value": "332cf49d4dd274218723652d64e75fa717237a52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422163, "uuid": "b0d6f038-268b-48bc-9bca-cce9319679fe", "comment": "Malware payload (RedLineStealer)", "value": "b8b97b299ca7d0997c7c8556a3c5abb13b42a77fb55680166cbc2499142cbaec5193e1960074ee98433f07e6b6576dcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422163, "uuid": "18a19ea5-e6ed-43aa-a3de-04079bf0108b", "value": "T169052293B1D45173EAB6277194F707D30B327C625828D3AF63899C1A2C73641D9BA32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422163, "uuid": "5c88cdac-5700-4846-9695-a7c27eda09f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422163, "uuid": "b485b764-de65-466a-abf2-b8c51ff6d186", "value": "24576:ByTwT2gI+rEgpF/z2G14GGmzW3MYQFfxOu1iqmtTJlLpF:0w2gbpxz2GqSi6FfxRA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422163, "uuid": "e9d96147-096c-481a-9d4a-b87be7b4546a", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422163, "uuid": "f17a3458-96a2-46a6-9e78-7098d4f72f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422163, "uuid": "99f906be-1789-44a4-a238-9ac3fed441fb", "value": "b9c2221414422c7a0e0be245661ad5d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7b96bc-3e60-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692429675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692429675, "uuid": "5eab388e-cc18-4d81-ae53-72a881ebe950", "comment": "Malware payload (njrat)", "value": "24296b9382142dbef1bb666bfe2d7bc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692429675, "uuid": "ee58dcd3-1cca-466d-95c4-a3fd8c8de2a8", "comment": "Malware payload (njrat)", "value": "d70939125a2c4e4c37bf1004494f36d00c84303995a75113fb3a48aa4dc0b1aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692429675, "uuid": "0d73f667-d46f-4479-b319-65a9b1348c76", "comment": "Malware payload (njrat)", "value": "8efaaea385d6899b85e42a82fc5eaef46080ccef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692429675, "uuid": "947ae3e8-328a-41d1-bc3b-ad075b61849a", "comment": "Malware payload (njrat)", "value": "b34d080a800411e181c2d9fb05cf021ec138ac25dcc7738af399356c6204cd4f6e40a44a0aa70377ecce7c1214a8643d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692429675, "uuid": "8cdae86e-21c8-4a9d-9f4e-87c3b71bf95f", "value": "T17703194D7FE18168C5FD1A7B05B2D41207BAE04F6A23D90E8EE564EA37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692429675, "uuid": "3b0af686-6558-4f55-a7b0-cd09e39f5ab9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692429675, "uuid": "3efb529a-2707-4638-910e-91f86804babe", "value": "384:U7gKCiMQB63fbw6ZfrZUy8f8UvXsgiN8JGrAF+rMRTyN/0L+EcoinblneHQM3epL:fQ0DwODZX8f8UU180rM+rMRa8Nua0nt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692429675, "uuid": "fce2cd84-5ab9-4853-b52f-c8ce286c93ac", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692429675, "uuid": "c9e14ba4-a6dc-4995-a72c-7cbecc190db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692429675, "uuid": "2a995925-46d4-4a78-9a3e-76941643f04b", "value": "24296b9382142dbef1bb666bfe2d7bc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7c3b01-3e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692445385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445385, "uuid": "f8ce5b2f-8143-4605-95e2-78be84308cd9", "comment": "Malware payload (Mirai)", "value": "82f81f53bd9e8b1450956d65ccea6b08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445385, "uuid": "25a7077d-0c40-45d3-8597-1d2a5caf0c04", "comment": "Malware payload (Mirai)", "value": "da9d1461b47c7dafc158df483db5082638cb7f2ce754227b0c9932cf5a55cc08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445385, "uuid": "fb297fa9-8913-424c-9e0f-babafaf6c4de", "comment": "Malware payload (Mirai)", "value": "74dd96dcdc5f8a0fbb43eae61b2aa55b5ea917d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445385, "uuid": "9068fd69-e4bc-49ee-9f3d-6476f2e96ccb", "comment": "Malware payload (Mirai)", "value": "5a7e648ee05a84bda4adcfafc98e6d9c703cf58539500c5e778d604a0d15d79d623d3ec42840638bb81f4fde65dc9827", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445385, "uuid": "690b3181-0bb1-4cd6-b240-dd7b1d8882c3", "value": "T1A7E2E014B60E9865CAA6747BCC24824FFB8A4FFB58FF712B2261472C50E5A0211F79C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445385, "uuid": "731d295a-0962-480f-b589-7a0a5b1d4d00", "value": "768:O83lxPcOu2LHi5C7p6lLhReYMvHbRHk2YRO70xItC3vW9q3UEL5U:zlxFu2LHi5gKhReYgRH0wYEC3DLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692445385, "uuid": "2646808c-aa83-4cf0-bff8-cf556caf67dc", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692445385, "uuid": "ede1cde1-d384-41d3-95ad-4e8ed9541768", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445385, "uuid": "7843c353-c128-429d-b6e2-66cfe1acfa7a", "value": "SecuriteInfo.com.Linux.Siggen.9999.15532.2834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd01708-3e59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692426670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426670, "uuid": "5217098b-63e3-4362-a8f9-0be97675c40c", "comment": "Malware payload (RedLineStealer)", "value": "d13dc16e0c20dc2b6daab1b44d09800d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426670, "uuid": "16d7dce8-c759-4400-8213-c8226432dcd1", "comment": "Malware payload (RedLineStealer)", "value": "dac48980f629d46e2cbdfb38cf233c5d7b9daa75d783be5bfeb75cb3288c4d25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426670, "uuid": "71c04153-fa31-4861-82fe-2bc69fbb224b", "comment": "Malware payload (RedLineStealer)", "value": "4f5eac5fca86ff6b5cbaa2697900036d78261e75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692426670, "uuid": "7c37661b-072c-4cb9-abda-2d3dbf66251b", "comment": "Malware payload (RedLineStealer)", "value": "638d81069207dd681d2eea2a939b25f37a100a4b716bb7d19116ce09d8cdec4e3928d3fd9f0717a5eda1715d2e71d1d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426670, "uuid": "ef7ce756-c620-407d-b585-2def7d2a9f84", "value": "T1030522DAA7EC0AA3ED751B7028F553830B357CA34D68931A574AAD9E0DB2680743133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426670, "uuid": "ca47bc1d-c0be-43c0-862c-fdcdef67e8e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426670, "uuid": "8524603a-1ddd-4569-936f-e86dc8c3d39a", "value": "24576:wyOi8TfsIrtIbuUmofu8W56AUpJkv++x:3rCRI6Hwp4++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692426670, "uuid": "14794813-9b6a-4bec-82d7-49b6ca787c18", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692426670, "uuid": "8007e6a4-5e1f-4f6f-90b2-2c3bcae44dfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692426670, "uuid": "95031fe3-ab06-46ef-8f0d-ef591bf87ae6", "value": "d13dc16e0c20dc2b6daab1b44d09800d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdd7f8e-3ed4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692479177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479177, "uuid": "10a06f79-28b1-4f43-9e58-d9d4e6b386c9", "comment": "Malware payload (Mirai)", "value": "1c1af303c5eaf527b61dc041a5dc8b15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479177, "uuid": "b150c4ae-742a-43ec-863f-377a3d4253cd", "comment": "Malware payload (Mirai)", "value": "dbcee4ba11e61797bc1a38f0a8a20853aeb976956bdcdc79d3fbdb82f9c03a00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479177, "uuid": "2c33daf3-fa9e-46f9-98e2-84976eb658fe", "comment": "Malware payload (Mirai)", "value": "73a3784b80929dc1844473607886d122933f0150", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479177, "uuid": "a2e984be-8a1f-4810-a4aa-c64bedb07951", "comment": "Malware payload (Mirai)", "value": "bd3b557769ec94d48a5331b4099a6b7b63825a293339c5b9fb57aa09c1486b9259396c42f81bb6406ec7382a73ec1ac3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479177, "uuid": "18bc2002-7244-423a-a751-74a31efd6252", "value": "T17E932986BC419A11C6C61677FE2F108E331257ECE2ED73138D245B707B8B91B0E6B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479177, "uuid": "d75c185c-d3f8-4dd9-bea8-f01b50fbcd31", "value": "1536:XhnRcUWoXufJ4Au8YKzvIMJ5zVMcOPaUl9aFmLbRMIiEg188Qxc/5SYG:EUW+lAuGhhMRS0awg188Qxc/E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692479177, "uuid": "4aa939fa-59fc-4b04-bb2b-00a558981de4", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692479177, "uuid": "63d9d1ea-5ec2-496c-88f3-9f2d5920712e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479177, "uuid": "27b8b69b-b89b-4363-aeab-a579607bcfbb", "value": "1c1af303c5eaf527b61dc041a5dc8b15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae293e5-3e2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692407152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692407152, "uuid": "f6581131-4283-4b85-a895-a41085449fa6", "comment": "Malware payload (RedLineStealer)", "value": "1ba18356c03fad5232fdae6efb217d2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692407152, "uuid": "ef67f5b6-e273-4b82-b8cb-9b8840409b7b", "comment": "Malware payload (RedLineStealer)", "value": "dd18bd70d8ffe4caf2ee06ec2d6192b761ff4c44c1c70140044ece91a1fff601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692407152, "uuid": "452b0b8e-5014-487d-9496-6c31424bef13", "comment": "Malware payload (RedLineStealer)", "value": "1269d8e565d8298ec27035011deb0dd9632d453a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692407152, "uuid": "8374551c-460e-4a34-8c66-a7f74a5bb379", "comment": "Malware payload (RedLineStealer)", "value": "66b59480633f40e1d2ca5acf10d316226488cb7974f0cea402c3b290d1f8b2d5d44eb1de5ed4bb0c4112a92a8bcba494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692407152, "uuid": "854a95ff-89c2-4259-a3c5-f1ae5ab09995", "value": "T16E23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692407152, "uuid": "b8b5bdce-3f38-4ca6-a035-ff7d579e0d7e", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692407152, "uuid": "76388608-4100-436a-8698-02bb7b178b9e", "value": 46103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692407152, "uuid": "a5c20d34-aa4a-4cf6-88f0-4bed30ed8ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692407152, "uuid": "7266de4a-f689-46fb-9e84-f1ca2b687b3e", "value": "1ba18356c03fad5232fdae6efb217d2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3417b783-3ed7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692480450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692480450, "uuid": "1de05aa1-cbb6-48c4-b582-cc4a8dc79bb4", "comment": "Malware payload", "value": "9cde8ee2cdcee3107ec564954f1c7d50", "object_relation": "md5", "Tag": [ { "name": "64-185-227-156", "colour": "#79BAC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LunaLogger", "colour": "#B0DCF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692480450, "uuid": "7a1594a3-c908-4876-9b91-5837c3ef90b8", "comment": "Malware payload", "value": "dd5f218690a6fb8cb222deb531c1d4abc4334039a8b51fe0c368ef7aabbb7270", "object_relation": "sha256", "Tag": [ { "name": "64-185-227-156", "colour": "#79BAC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LunaLogger", "colour": "#B0DCF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692480450, "uuid": "b98a3335-433e-4e79-84c7-2b8c196a2edd", "comment": "Malware payload", "value": "e6fd5f8213f366cc40c7244169a81ea8d1e1f702", "object_relation": "sha1", "Tag": [ { "name": "64-185-227-156", "colour": "#79BAC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LunaLogger", "colour": "#B0DCF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692480450, "uuid": "00939b31-4254-4576-b7af-84e155e8a6d3", "comment": "Malware payload", "value": "a6eae8bef437cc8054d41cd4fd6466b1382e460e3b6d7ad00ca92a4b5ad69722e58d623c3121c8f4228e2c9365df9971", "object_relation": "sha3-384", "Tag": [ { "name": "64-185-227-156", "colour": "#79BAC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LunaLogger", "colour": "#B0DCF9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692480450, "uuid": "0218f7d3-f500-46cd-ae2a-a75d9b0f821b", "value": "T146E6330F66611CF7FEBA797A9CE7C010D531F85617B0E74B87A401068AEB5924C7BEA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692480450, "uuid": "16822c7d-b053-4215-a615-aa6a3cbabc63", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692480450, "uuid": "5e5da559-be40-437b-a5a6-2574a98cda3e", "value": "393216:vhd+GLvOPhiBGCKkRz5+amJZxKpAVYLa:vhd+GLvuhepz5LOSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692480450, "uuid": "acf9cae5-56bc-4215-95a8-a64f94f4509b", "value": 14109279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692480450, "uuid": "f15ecf20-bcd6-447e-a45e-b487fb2ba0d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692480450, "uuid": "900958b6-a63e-43b1-ad70-9aa5acaa2cc7", "value": "Five Nights At Fidesz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b91e73-3e73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692437772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437772, "uuid": "165110df-5cc0-49ca-b5e4-156c7cdef637", "comment": "Malware payload (Amadey)", "value": "32101f9a1d452ad38b97ba8e17f57b6d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437772, "uuid": "1462ce30-cb4e-4db3-b66a-b75f4e5307b2", "comment": "Malware payload (Amadey)", "value": "de9e7ac8ecb0658998b36df6a2c2ad2a5cd20cf047990e28b28c67a9c964d77b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437772, "uuid": "e492d340-9b7b-485b-a31d-c0558af5195c", "comment": "Malware payload (Amadey)", "value": "9e55e650a673a8e73126b5496eaf68253941ba6d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437772, "uuid": "e68040c8-f21a-45da-9f51-aa28f4896e45", "comment": "Malware payload (Amadey)", "value": "b7d82e67c568522a10931a0584370d83577258945473ca987ee7d364e579fdcee43b6bed8b2989ecdb51c1560f494dcc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437772, "uuid": "ac9495fd-4638-4956-832a-26ac271913ba", "value": "T15D05225A9AD940B3DDB92B30A4F703C70B36BCB108B5872B378568894973AD4F635327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437772, "uuid": "6eaebd92-5955-4862-ac77-dbe2c49a1d07", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437772, "uuid": "26c01038-077d-4091-ba2d-9bb2a093b4c0", "value": "24576:kyunXBDaC0sFiE7ZxKlZaHN7nIV1SV4plr:zuXXNiENxKlZaHWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437772, "uuid": "5f5ad585-0844-4cfe-9976-aff30f07c0c9", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437772, "uuid": "05e04b09-f6a8-406c-b7df-c75843b2e700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437772, "uuid": "283557b5-76f6-4c4b-b61e-359587f10059", "value": "de9e7ac8ecb0658998b36df6a2c2ad2a5cd20cf047990.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c47609-3ed4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692479264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479264, "uuid": "4bf1a15a-84df-4b2c-b5ae-629f1cf3d2c9", "comment": "Malware payload", "value": "d0fcc47ea3b8e25c3f3e9c560e185a45", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479264, "uuid": "8b534dfd-55a7-4edc-afe7-2254dd518dd0", "comment": "Malware payload", "value": "decab5c7e9a8d42e09aa6df39385c95dc603285374a76d8c8e08a025bb7e1dd9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479264, "uuid": "57e50105-78fc-4113-b342-3db933e4dda4", "comment": "Malware payload", "value": "1cb17e320552e0fa7181845211f479a083eae0ba", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479264, "uuid": "2e9a994f-a6c5-45f2-9a5c-ee10f3a0fc95", "comment": "Malware payload", "value": "b9268dc3dc85c3f5dcb68c46e4d13129072539959bcc142d42854da1129eeef0ddc3d7afc0c6e8d58fb5152b4d6f72b5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479264, "uuid": "0289f6d4-e357-4eda-8b1e-8a27eb335884", "value": "T166C52357F2767C6BC931C1312145123E506B4E28DA42F79E3A8837A974BFEE88BC16C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479264, "uuid": "7887c57b-d3ce-411a-a163-03d529f15a9f", "value": "49152:MQz7ZttfcLKcBEVx3vtKo29/iDSKuljw7w63OoOCVjZRZiMdOfnJHxMpV:7nZtKLKcBcxFK59EupwxVj1iMGnwpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692479264, "uuid": "adad1888-b8f0-498e-9d68-6965a3512a1e", "value": 2744568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692479264, "uuid": "358016dc-0067-4949-87d0-0931b2140853", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479264, "uuid": "e20dc4ca-d5e6-41e6-a438-99e7d8cedb6d", "value": "adl.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c009c306-3edb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692482403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692482403, "uuid": "84bac89f-6108-493e-a410-dfe1f255b989", "comment": "Malware payload", "value": "2bf32e6afc36c17217edee167bbacb3c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692482403, "uuid": "7f91d0b9-4145-434d-88bd-dcc05ed66ab5", "comment": "Malware payload", "value": "ded1d6a2d847784916a203876a66a476d737ec5ab1370ab9395cab5200b79af7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692482403, "uuid": "52bc8d72-f25c-443b-ad0f-335d73bc0fef", "comment": "Malware payload", "value": "2269540c5d890e1bf4957b31475b3759afcb6e55", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692482403, "uuid": "46d18baf-bab2-4b57-b025-54a7140cfcda", "comment": "Malware payload", "value": "127aac181138bb3c51b2da8e500a76688e6447190c7dee52473bb8bc5b19946c3b8d55f2a2bdaaf392ca8f072318ae11", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692482403, "uuid": "e9a06601-6abb-4166-a197-d0b42e6d0338", "value": "T123A32903DA60847EC48B93761BDFC6225623F8B90731621B63C4BEA92F169D9DE5D343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692482403, "uuid": "d1536c09-bfb3-4e6f-a891-3f096981e345", "value": "1536:QhfT9WiC3txvWtfEo5vXJM9wypej++3h2EgL7nLGPTms5TDUMHYr/:QhjC9wtsOnuejjh2EgL7smITDfHYr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692482403, "uuid": "480ef5d6-327c-4854-b01a-5243356a97ab", "value": 101269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692482403, "uuid": "70b818dc-757c-4685-92a4-2d1d0d13980c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692482403, "uuid": "dd037b63-83bf-4999-8cd0-db88c8118cc6", "value": "rebirth.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5063ad-3e75-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692438397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438397, "uuid": "0a1de557-9b6d-45af-a1f5-3988baa03dc2", "comment": "Malware payload", "value": "81081b3f5183e4db203658d33ab01057", "object_relation": "md5", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438397, "uuid": "e949ad4a-e47c-4405-ac2e-8daf9236a20d", "comment": "Malware payload", "value": "dfaa8c11a2d0702907e2d7fcc10dcdf8dd79e9efb96fa0a24c957df19994a022", "object_relation": "sha256", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438397, "uuid": "441e08f0-2065-4ca0-bdb6-87e30ff814a2", "comment": "Malware payload", "value": "dcb18079ab1f3537ed4805097e5c3eaf7f6f9946", "object_relation": "sha1", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438397, "uuid": "d3aad6c2-d1f9-45c7-be8a-04da8bd88b99", "comment": "Malware payload", "value": "e5c6bd19741689d6c07836147f994827fb73c1d79af0bbc9eb4e7a52d48b3588d4df2c95a8581aa7b5baeddb738ecbd4", "object_relation": "sha3-384", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438397, "uuid": "8eefb2df-074c-449a-a5ff-e58a0ce1ca4c", "value": "T1F0F37D02A7E88132E9F61BB05CFA13930B3ABCB2AE75C35F2645559A1C726C0D931777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438397, "uuid": "7716fd79-7546-4fca-a4ad-098aaf21bcae", "value": "bc70c4fa605f17c85050b7c7b6d42e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438397, "uuid": "dd883303-a742-4a58-98cd-ae07310a075e", "value": "3072:5OFRQGCIIm1xK5GWp1icKAArDZz4N9GhbkrNEk4fH7YEHT98OP:+QGCIImcp0yN90QE7fn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692438397, "uuid": "25f541df-6223-43e0-8ecf-1ca02a263ec4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692438397, "uuid": "cfc79270-7140-4209-a38e-52839720e241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438397, "uuid": "0abecd18-9f34-4fca-a931-dca28bd3f9ce", "value": "Tumeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e96745-3e76-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692438977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438977, "uuid": "528340e9-acc0-4a2a-a7a8-be7d120c2e60", "comment": "Malware payload (RedLineStealer)", "value": "391d1c3497889222df046eabd0bb0321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438977, "uuid": "7a24e027-46df-45c0-b61f-70b32e288524", "comment": "Malware payload (RedLineStealer)", "value": "e004a8f20ec23a53c6af9623d3d681aee4648312ba26c516b555a62109f0ef35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438977, "uuid": "64a6f976-2f3a-442b-af9d-d3197895d758", "comment": "Malware payload (RedLineStealer)", "value": "cd0fdd007aae630953d3312b9192b49f0e38838e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438977, "uuid": "644a80c4-487b-4824-9c71-62811b905c3d", "comment": "Malware payload (RedLineStealer)", "value": "8f41d49360f4a533b86f016dbca79b418796a97dd385c5da27e8322cfef3aa753ec1d066c73cef12aa930ebe4b8f8e22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438977, "uuid": "e8b88082-6d07-4b6c-bd97-60e1fdc1893a", "value": "T1D5052303E7C95467DD792B3058FB129B0B38B8B25874876F2788A56E18B25D4F43933B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438977, "uuid": "2fff97f2-c27a-42ab-8cd0-15e0c07d1440", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438977, "uuid": "11a9aa09-be44-4e54-aee2-309dc88f6013", "value": "24576:Iyb/GK0moicHful8Zs78KKvEuAsBolpCv:PbfzotHfuGZsYKKvEuAsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692438977, "uuid": "0c3805f4-e7e1-4a72-96fb-a5099cd4dd83", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692438977, "uuid": "e9a63e6b-bb9d-4ce7-b7b5-c97c51f92e1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438977, "uuid": "e58552dc-510f-45a7-b838-cc9db6b11a8e", "value": "391d1c3497889222df046eabd0bb0321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52bc9084-3ee4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692486085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486085, "uuid": "366d7d0c-81f8-42dc-82c4-e408eb3b8dbc", "comment": "Malware payload", "value": "04c5e1d07c51b549972739f9b5faad59", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486085, "uuid": "a389c628-a3c7-4318-97ab-0611de3f5051", "comment": "Malware payload", "value": "e0452b81b45a3a36dbabe7522d5ca942635448283f32c35f05d13990480a21ea", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486085, "uuid": "3710688c-3a46-45bb-a4e1-8251f103c227", "comment": "Malware payload", "value": "392d0eb99b863c4f86ba19e74dd50716ebc4717a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692486085, "uuid": "f1b46026-17c9-452e-8a23-f140d9a9305f", "comment": "Malware payload", "value": "f6f6992c4859de83d6b0d5602009778bba03dc0887bc63570301202494ed0c2a8d6574e0afafa2c4f2c44e69912a2ed4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692486085, "uuid": "cd3d857c-0080-4626-9af3-1335ed7a80b7", "value": "T18206AD87FB989C2ECC7720B18A6E537262275C058743DB836E44372C29B76E45F69BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692486085, "uuid": "ab209da6-b594-42a8-a4cf-74ecc2960f78", "value": "49152:goqRjbNSAyKbTrB2vkeMSEZj+eO+Ozms8iudNIqp/7gLCrBTe43:gzjcAyKjbeMSWj+eO+OzOiWbgLCrBTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692486085, "uuid": "d0edf85b-8583-4cb8-94d7-fa60cd75e2fa", "value": 3673662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692486085, "uuid": "fa3e3508-0729-4d9f-9f5b-d37a02bdd04f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692486085, "uuid": "19a3bee5-839c-4fd6-9094-dbe595a98383", "value": "adl.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ac2669-3e4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692422172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422172, "uuid": "2bcaf685-7d4d-45ed-a8e9-7ffef0aba9a7", "comment": "Malware payload (RedLineStealer)", "value": "b05eaeaf2ee519f68538f51ea4105f54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422172, "uuid": "a87d01e1-3b53-4bbf-969f-a7eddebe0341", "comment": "Malware payload (RedLineStealer)", "value": "e0478335705150f63ba2f93048519df3ce5de9c820514c3fe3a2e9e367c1d808", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422172, "uuid": "3be44d0b-1185-4362-a0cc-ae97017e5443", "comment": "Malware payload (RedLineStealer)", "value": "300756c895e7f2d4645254ed7c82378471590b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422172, "uuid": "4f1e1ab4-555e-4948-8d9b-063068f6340b", "comment": "Malware payload (RedLineStealer)", "value": "172bf03573d9b9cd3b691edff76127534530e7a9198499c23d8de85f0d6977b11f010c1c2a43fa84ef90435aea1350f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422172, "uuid": "fc9504e1-c3aa-4091-8159-c32ef3d6d85d", "value": "T115052203E7E89436DDF5177194FA02E30F39BCE249B093676349A9591C72284AA71B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422172, "uuid": "3731484e-2102-41c4-83da-8087185d5e1f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422172, "uuid": "55ad2e0f-d4cc-4576-bd33-02dea0500cdf", "value": "12288:9Mr/y90BawJNgqyke0ushh7vSGD/5NkZlE/n4kSS76Q0SwlYET+a:WyyIqXQUSGz5NkZ2QW+uETB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422172, "uuid": "eb659ff4-8e7d-4346-b8ce-4cdcbdc2e685", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422172, "uuid": "276acdff-b512-4706-90bc-581ad5f08aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422172, "uuid": "9552fb60-5223-4838-889a-7ab468af34ee", "value": "b05eaeaf2ee519f68538f51ea4105f54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf2976d-3ed1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692478209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692478209, "uuid": "03437d62-9a41-4b8c-ae0d-7ced6ec918bf", "comment": "Malware payload (Mirai)", "value": "f8c8976d855988b13db41bd6766abbdd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692478209, "uuid": "50aee227-1d95-4141-bbc1-27b5e4a84692", "comment": "Malware payload (Mirai)", "value": "e06a74ee55d4260e2ccac6a8abf6c671bc8ee890f1d6a1ae59efbb826fecb972", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692478209, "uuid": "cd8bf938-eca9-410f-bafc-b8e9ab57905c", "comment": "Malware payload (Mirai)", "value": "7d194730ebdffec7c977668f30daf46d31da8d4a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692478209, "uuid": "0b4db383-b7b8-4a96-9da9-266674513ede", "comment": "Malware payload (Mirai)", "value": "b73a780ea014a7a135d721f93110b431df07e45f3a5570d6eeb6f7dd704434c30bfd906c103c98b7e7d251bb4ab83ffd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692478209, "uuid": "35fb8748-f9a9-4ebe-8e1c-644568d634c4", "value": "T12D832981FC41A622C7C11777FE5F018E371553D8E2EA32079C285FA03A9F95B0D67A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692478209, "uuid": "e7d134fa-80e1-4e80-9149-35391da29207", "value": "1536:NySHwrZKkRozEsK3GU33eZtU5SWmyPeTriW/SnvL:NySQ9Koa83w9yPe31KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692478209, "uuid": "1fe88ef9-4d4e-44f2-93e9-d49eeb4bb827", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692478209, "uuid": "9e7aeda6-89e8-41dd-b680-79e960a310c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692478209, "uuid": "2705da15-bac2-4837-bd42-319fa76bbed3", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915ded9e-3e25-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692404156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692404156, "uuid": "79c5f002-00db-4462-8217-feb7b5611dda", "comment": "Malware payload (RedLineStealer)", "value": "8f07ddd1163f8567e0569b0d018143f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692404156, "uuid": "5a3d385f-c267-4598-b946-97f59733df26", "comment": "Malware payload (RedLineStealer)", "value": "e0f1c92ea6932c2a1a7de7f1da8d73f470dc2159f6f7d1e7fe483f697d6dee58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692404156, "uuid": "dc612bda-6568-4f76-8169-e9055e86eff3", "comment": "Malware payload (RedLineStealer)", "value": "5445589b970df7b97660040bb88325582c9fc6b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692404156, "uuid": "90a173f4-7b3b-45b4-a0e3-390545c74075", "comment": "Malware payload (RedLineStealer)", "value": "6de55de8556ae5819676d43b1c94d92ffa83efe5808a65f7c0ddc745245a0ca9e6d540f403e94189049df9e3339ccfd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692404156, "uuid": "d67f900c-3042-43f5-818b-839343177e34", "value": "T165F41203DAD88432D5F92B701CF70BD31F39BCA6AD7992262785A84A4C72980F635777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692404156, "uuid": "94b7948a-5f2a-4559-bb6b-2a6ba95f31d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692404156, "uuid": "b79e21db-e6a1-430c-9d62-41939a4661f0", "value": "12288:qMr3y90ZgEIdX8930qvmL89YFzl8vBcVULSpNSGvJAxPaLooIG7ZukgylhPcx1wd:dyA1IdM9EU9Yx+QqxPaLooIUokgy3PcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692404156, "uuid": "1a5b563b-c6af-4bd2-b186-2c543f8d1767", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692404156, "uuid": "83816db3-ea97-4f9c-93e1-76e3c034fff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692404156, "uuid": "660db520-3a86-4044-9b63-f23cfab2721f", "value": "e0f1c92ea6932c2a1a7de7f1da8d73f470dc2159f6f7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25380bd3-3e81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692443489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443489, "uuid": "cd564104-2575-4f30-8fc7-fd417d625d6a", "comment": "Malware payload (RedLineStealer)", "value": "629c3b9bae76e2f3dd5a14cebdfeb635", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443489, "uuid": "b3911cc9-3227-42b6-ab95-d37f6f760fca", "comment": "Malware payload (RedLineStealer)", "value": "e1c417cdc500c29e12ee68d5bc4e52314d045031b5380b7854b4b34ec9ea0abe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443489, "uuid": "5185ef75-c4cf-4f85-afb6-b12652ccfb43", "comment": "Malware payload (RedLineStealer)", "value": "7c32c0dbba1dc28b33d61647ed1cce57414fbd34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692443489, "uuid": "38478e12-63db-4b57-826a-eedbd91bc47f", "comment": "Malware payload (RedLineStealer)", "value": "a3880f1df27a70d46824046c4d1c0096d1f375d39ef4743581501d93cabd6fd5d9747866fe26acf619653194159c58b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443489, "uuid": "3e33e710-fb48-4d28-b98d-906ac7a29349", "value": "T1F594CFD8A3AC1022FFFBCF682C606F54E83991205FBA6554C2EB08D956B5CD5F02925F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443489, "uuid": "2fa65696-155f-403a-a739-adf0e21eb453", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443489, "uuid": "1d39a0a7-4af1-460c-a6fa-aaff049e96ec", "value": "12288:dzYTt8BnSF8E1GDaeb2BHWGEQurA37lADGwe6nM3p2:dzBnUtGd1AyDY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692443489, "uuid": "d2ff53a5-9d24-4fc9-b097-5ae848951ff7", "value": 435712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692443489, "uuid": "0d3e0295-9774-4342-8802-4a684cc4c9d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692443489, "uuid": "14888823-5990-4321-b0bb-e20b647066e6", "value": "629c3b9bae76e2f3dd5a14cebdfeb635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8a3307-3e65-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692431421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692431421, "uuid": "ce062427-5631-477e-9f70-90915dec91a9", "comment": "Malware payload", "value": "01543c78685b048951b158ae245e1700", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692431421, "uuid": "bf0dfa8a-c94c-4080-ae7a-1be89dbe7cc9", "comment": "Malware payload", "value": "e1e516d807879e473b4756722a2db81598cdb05e789c281b0f4ed0440c94cc69", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692431421, "uuid": "41d92c46-2488-4efb-be4a-be2383e30f13", "comment": "Malware payload", "value": "1609828628140ab8beebc397f86fa278709271d0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692431421, "uuid": "9d07120b-1be6-436c-a839-44879af8b9c0", "comment": "Malware payload", "value": "5e19afbb70ae278dc42cabd00623242cf333ecaa819fcb231985eeb08a045c045b181b7da353e1deeeec49a08dba1c9b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692431421, "uuid": "4bfc2d6c-bd78-40f7-bd8b-7b8eed7803c9", "value": "T1FC5423A274DEB390F0AD99B0DB3502272ABFA9214196CEFF9182762DD771E66430057C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692431421, "uuid": "b1ae9f8e-dcca-4bd7-9c74-f915e86776f4", "value": "6144:oTx3sB09ptgPU/vvrFUt+d68P65sv/DLE7yVLQ6PZaBXwy+eQ1lSsAyLWE:od8B0PtgSvRrHP102VVZuXwyN4x6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692431421, "uuid": "3e298456-f556-4cfe-9297-44ea0be2e4f1", "value": 289730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692431421, "uuid": "931493ba-73fb-4f2a-b6b0-e2e2de0e3fc6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692431421, "uuid": "a01d1270-7871-4120-ba94-ea7ca1a6133f", "value": "chrome.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2563a0b0-3e67-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692432322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432322, "uuid": "10d50641-f812-43fe-945a-50ce6c88a597", "comment": "Malware payload", "value": "0f59218c9fc87e44acedeb39dffd5459", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432322, "uuid": "77b04731-21ce-4152-9ff0-fba3191fb8fa", "comment": "Malware payload", "value": "e49fc62edd505ad8b811e6ea38506ba62676716231ed09f29864528e17502894", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432322, "uuid": "e6b16a7e-a8d4-42b6-b972-761d1ac94df8", "comment": "Malware payload", "value": "b8ef833213a5b0826fb6fd625c9fa3967bfffab2", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692432322, "uuid": "fcde9d04-53cf-4c46-b7d0-5075797db28b", "comment": "Malware payload", "value": "b8460c4e796a9906a642da4905eecc37cb6f02e9f978bc6bdf170618c94d4d32dfedf701bb73e6511885149b82b8d363", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432322, "uuid": "49e69a48-cbbb-4520-9a6e-69189ad75096", "value": "T1EA8552F51A549E7BAB0A3432A07E595EC2690FCDDCE6247C1C11BE6443376BBE2112B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432322, "uuid": "0bc2366e-e0e7-4ae8-a316-7d514225c4f5", "value": "384:SbsHZUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUf:SbsHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692432322, "uuid": "1c30f071-8d02-4916-bb10-927244616870", "value": 1848871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692432322, "uuid": "40a0dc29-dc2a-4317-84fb-4e4ad45706c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692432322, "uuid": "691b09c0-11fc-4cfa-88a5-f4bc1034f670", "value": "DISRUPTIVE_AGENCY_FACEBOOK_ADS_JOB_INVITATION_AUGUST_2023 0.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0110b54-3e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692444983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692444983, "uuid": "b0095f72-6570-4b02-922a-e4ed3df78575", "comment": "Malware payload (Amadey)", "value": "277e4c316af1a20ec91554b9dea65a15", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692444983, "uuid": "af426c6d-e0a1-40a2-9296-2f0a69263189", "comment": "Malware payload (Amadey)", "value": "e5f5dd1351fc046439bb7d556519711007fcef1ed039653d6f5b22f60053449e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692444983, "uuid": "1836ea6b-3a46-4399-ad29-7ed0f71e2e2e", "comment": "Malware payload (Amadey)", "value": "0dbcb78e62ad0479e53677cbbe112c5a35366efa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692444983, "uuid": "5a8876ed-5c61-43a7-89e0-d80edc16356e", "comment": "Malware payload (Amadey)", "value": "61d8a76a2fc2ef81fdf4a0cc9128ca9dfe5ca32fd4824d33b73856fef432ad86db80245f57eff0255fcd8c83b4bc4d96", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692444983, "uuid": "53ae02c5-f5aa-4bbc-a201-9ffc41b2a989", "value": "T1CC0522475AD89032DDF927B068F713D31A36FDB08978976A2786A5290C723D1B93133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692444983, "uuid": "2e82c36a-cadc-44b1-844b-5ba860d004dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692444983, "uuid": "677bbf43-a51a-49e7-8957-a260dc870828", "value": "24576:9y+ZHpwITkr3DLgJXl7WUK+VG8nfnOMjtu:Y0Wr3XuXlSUK+VGSOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692444983, "uuid": "d884f5c9-5007-489f-93fb-ae5919df7663", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692444983, "uuid": "cc93bd17-633c-4278-9a8c-9cda2bab421d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692444983, "uuid": "e4318a43-741a-4236-a564-ac999225dcf3", "value": "277e4c316af1a20ec91554b9dea65a15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faea01c7-3ed1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692478207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692478207, "uuid": "62f9fc33-7f7a-4a3b-b0a0-53afb3426aae", "comment": "Malware payload (Mirai)", "value": "93ed78580b0453176c15b1071ddc72a9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692478207, "uuid": "1f678dd4-97e1-41b5-9076-b999993a63da", "comment": "Malware payload (Mirai)", "value": "e69d803a1daf6a7a691df0cb0322a9ac6345fa62669dcc6bb72f66fb19ce9c8f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692478207, "uuid": "d25c5630-7311-4aa1-8645-132627bbe058", "comment": "Malware payload (Mirai)", "value": "7f1db59086b6db534f7eeac428acb02247abde62", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692478207, "uuid": "ff875a4b-3984-4331-b6e3-e32643d5359d", "comment": "Malware payload (Mirai)", "value": "ac27972308e4bd3f23fc3875aafbd6399535845fa92df2b1cbeb857b4287ffeb7b9678939dd6888c2ba711cb91f3af3c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692478207, "uuid": "aa2244fa-51d9-459c-80dc-2730b48e93fd", "value": "T1F7F33C46EA418B13C1D71776FA9F414A33229B94E3DB730689286BF43F87B5E0E17909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692478207, "uuid": "d0b2fb71-76fa-4f45-b03f-b9c08693703d", "value": "3072:dUW6GNytuhMwYh4uaWGLKWdwffuSFYEJPdslWM/9OalM:dDVytRLSuaWGLKWefDDJPds4M/9OalM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692478207, "uuid": "dec799e7-d4d7-401b-a55c-9f1a16f833f1", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692478207, "uuid": "c5d3d4c7-0568-4786-85d2-a26ac7fc1eb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692478207, "uuid": "bc19796b-74b7-4a4a-80d6-0a7ae67f5aaa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1944e60f-3e47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692418558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418558, "uuid": "9a18b58d-f6ab-4759-8cc3-94174d7d52c8", "comment": "Malware payload (RedLineStealer)", "value": "54e0ffce308836a6f93be379da0af762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418558, "uuid": "4bc06868-594c-40c6-bbc3-c3ab87b77465", "comment": "Malware payload (RedLineStealer)", "value": "e6b839b34e53364803297851665fc38c33601222498b873eddcbb88832d75c54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418558, "uuid": "530fb5b5-cc57-4699-86d8-15fc0e90d0e4", "comment": "Malware payload (RedLineStealer)", "value": "f6690090f45b7245d8a3f7503f2f6de7db783abf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692418558, "uuid": "3341384f-92a0-402b-b20a-cf9002ffcb5c", "comment": "Malware payload (RedLineStealer)", "value": "26f9c8863a7c50e72c4df2f929c10d5b9347f8c103c2726c39316b2385318c6a4b9a2709c61b0327cb237309a07f2ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418558, "uuid": "544fc65b-355b-4b96-8d2b-b4484c1c5612", "value": "T1C8052206A7D99072DEF62771A8F313D30735BD959868C767678258AA0C32AC0F6B1337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418558, "uuid": "8e25c814-0420-464a-b044-6059d41f978b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418558, "uuid": "f4fef966-c32c-40cd-bfd2-a1baa12112be", "value": "24576:ayhOieg2tSPtxVXT76IKE7Ok987Z8sYqFYoqvNoJfo:hIij1PtnXTWIKE7Ok9U25o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692418558, "uuid": "d6cd3296-bc35-474a-83e4-de7ccffd350b", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692418558, "uuid": "4d4d031b-0a2a-4d9e-badc-93e18037f3b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692418558, "uuid": "2a0e226c-d58a-4cbd-a551-9b97f7cbeaa2", "value": "e6b839b34e53364803297851665fc38c33601222498b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9f8462-3e97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692453004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692453004, "uuid": "7f5572c0-623c-4cb1-81f2-16e996aab4b6", "comment": "Malware payload (Mirai)", "value": "a81275acc5f7f3d38c04d1c26d213d13", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692453004, "uuid": "957aab07-c537-41f1-8f37-77540a7404f1", "comment": "Malware payload (Mirai)", "value": "e6cfc4a896974456dd9b59fe6e8d38feb41dedc4aa95f773ee7b80546a64d54a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692453004, "uuid": "3571be21-9e3d-4e86-a775-a93350de5bd7", "comment": "Malware payload (Mirai)", "value": "4d507d29574bc8b4c66c5938eb87a49a6e2f76fd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692453004, "uuid": "bd394882-5d99-4205-b618-c73a3b32a9f7", "comment": "Malware payload (Mirai)", "value": "8bf8db1dddaf0695552af4765f1c5bfef5331ee69704acb9660763a5ceb1e35fa6147513649d693fbc6f34ae4b8c098e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692453004, "uuid": "08cce479-3ac0-4a06-b6d9-38069fbd64bd", "value": "T130A2E159BF1D85CBC832293955E9EAD21252FC71F2ECCC492A40C15FB4A33A96474F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692453004, "uuid": "0f7e2a62-fd10-4719-b0fd-7660a69f8401", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKm:k98o08kxofBE+ZkXaqGbp2F2TWul0c57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692453004, "uuid": "71bde208-dfb8-4dc3-95f1-119c29664d64", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692453004, "uuid": "503f7834-1716-4737-b6e9-98bde5ed1281", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692453004, "uuid": "cfa35f83-62f4-4078-8ef6-fe8651601a86", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095616de-3e71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692436570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692436570, "uuid": "25ba4226-6fde-409a-afba-7d8b6586ccb4", "comment": "Malware payload (Amadey)", "value": "b16eac991271adce4376697a890dbde7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692436570, "uuid": "80432a20-6f90-438a-a28e-498fc29bcb5d", "comment": "Malware payload (Amadey)", "value": "e6f4582ca97e1d65944f1bcd8fad22756efb52325b98baefc782668a470374db", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692436570, "uuid": "9d198293-fbf4-42a5-90ab-18ad9ffa0fb4", "comment": "Malware payload (Amadey)", "value": "9282af4ba6433f3e15fa16a79b3b437b7ca4a025", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692436570, "uuid": "26cc459c-24cd-4c53-b421-aada119a0efd", "comment": "Malware payload (Amadey)", "value": "0c33bb2e8ed375209ff4219621e949eab7683646dc00d218e2d97ab596d5311493a14577521eac5e66095a033d66ce39", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692436570, "uuid": "e27ea9c5-10a6-4be3-ac11-c7ae2acbc0fe", "value": "T1E9252326A7E8C173DCF0677068FA07931A3A3C525D79A76E7381596E2DB3490907332B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692436570, "uuid": "1bc0dc06-7076-40d3-bb7d-52581f02f74f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692436570, "uuid": "90116083-a5d8-4598-a542-ab8a3b2875ba", "value": "24576:syTW03C8mGdJ7cJiVRao70YupxrqqJ0O2fIu89B:bC/Gz7cJimocxtJ0rfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692436570, "uuid": "b5efb06c-4d61-4bde-bf8f-ee625fd5e9e1", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692436570, "uuid": "0911f17c-e885-49fb-b2bd-0519b26b85e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692436570, "uuid": "6017c725-7e69-4b46-bd1f-e2ec9a78d3d8", "value": "b16eac991271adce4376697a890dbde7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18bbde2-3e44-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692417605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417605, "uuid": "6d33c1f5-42ac-40d4-adc7-c64efefd1f1a", "comment": "Malware payload (Mirai)", "value": "d9b9dd8efd96b30360746891f1c21228", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417605, "uuid": "d7a5cc00-fd10-43a5-b9dd-b62922ef4b6b", "comment": "Malware payload (Mirai)", "value": "e785ecf276e1a9544b339312e65d61a736c01e707ace2069dda401d94a36e247", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417605, "uuid": "c2a34e81-adeb-4f87-983e-5117012d359a", "comment": "Malware payload (Mirai)", "value": "dd1132d1465b51b1f73e675efafb087ae0cfd423", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692417605, "uuid": "ec4494e4-2264-4d6a-b080-ef65518955d9", "comment": "Malware payload (Mirai)", "value": "c46e79f388d8c09de1e19bd45618c824c24b36336a409f12a023d6daca240dcf432463dbbbcbbb40dd60cd1ee5b5c81d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417605, "uuid": "1e21b4a3-7254-4772-85d2-e09b60139052", "value": "T1E433F279936219EBCBA54C336830890518E6BA3F53F276EB3B5D4ACCFAC5554339404B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417605, "uuid": "5fbce39c-81bd-4426-858c-cf4bb8050ce6", "value": "1536:jKEndpp7jZpvd2BkTlaF2wd1LbJZPud4E:j9jpZ3YbwK1LbJcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692417605, "uuid": "c54b64a4-4831-4500-8c12-cc5969a25c66", "value": 50848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692417605, "uuid": "edefffbd-dd57-4723-b654-f0886a530bba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692417605, "uuid": "dafc91a2-cc76-463d-875f-08498cc782e3", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c905dfd-3e39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692412685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692412685, "uuid": "e3ce6531-d7ff-45b3-a11d-20e47ef1abe8", "comment": "Malware payload (Formbook)", "value": "005d9f5b11d83c49a300daf9efa8e9cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692412685, "uuid": "8158e0fa-120d-46f5-898f-63f53d9ed416", "comment": "Malware payload (Formbook)", "value": "e7c6065d235655ee2fa7871ee73a8d14b4f88b87351de7752a4c9569739b667d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692412685, "uuid": "af212b3d-9e5f-4c61-abb3-25400b4550a4", "comment": "Malware payload (Formbook)", "value": "ff6b5a53cbda91e35ead5bb89e73dd8ea34dc2c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692412685, "uuid": "5993a399-a305-4212-b5ee-6f7d3dda2e40", "comment": "Malware payload (Formbook)", "value": "951dafbb521937b7e815078ba0a729aa9d28d368713019d2a696ab385fb818bd1718615ec71802b29c6bcb10898b9d82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692412685, "uuid": "0e4a28bf-bc3b-46eb-8d54-bc77490227d2", "value": "T109E4E04137FD2A47E5BAC6F956B8221083F57D1A6024E3CE1DC220DA29F1F415BA2F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692412685, "uuid": "81490310-ab2d-4441-bd8d-910f6aed2ae2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692412685, "uuid": "2a86bd4a-96c9-48b3-9cd5-b5afa83539ed", "value": "12288:TymHFFDijMv5IXQHsy5cimMtzhu/dRpzFh6obAnCzx7pqB2LBPk:+mXMMvk2sQ3zh0LzdboCzx7pMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692412685, "uuid": "8f60deb4-777e-4b80-9674-5d06c0a37811", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692412685, "uuid": "a4f02da4-8b86-40c6-a782-c2b46a6c0538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692412685, "uuid": "53aeeedb-bc0e-4a4c-b801-e975d20d91dd", "value": "SecuriteInfo.com.Trojan.Packed2.45584.2534.18451", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab73adbb-3e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692456169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456169, "uuid": "8a85faeb-058c-4faf-98c4-041d09bd33f2", "comment": "Malware payload (Mirai)", "value": "4f32984fb801ba368f92d91eaa88be0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456169, "uuid": "1a0c1a9b-8792-442b-adfb-ee5d29f8c0bd", "comment": "Malware payload (Mirai)", "value": "ec5605189ce99da5898503ade0c8cad2ac9b824f76e12760c0187ba48c83ed7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456169, "uuid": "c465586d-7e3c-4bc7-b108-a1d6d21a2bd0", "comment": "Malware payload (Mirai)", "value": "4694a42081a30b1ccb6ae33c68cecfb10a016772", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692456169, "uuid": "1a67b8fb-7b68-4933-84fc-6c1f823fd3c4", "comment": "Malware payload (Mirai)", "value": "02d80f5e0a0a29993465851d96c616a1625461d4a78f85ff6e3f7bee5a364b3ae336e8b4ee171882445257847f17d1f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456169, "uuid": "760b5a71-0ba2-426c-989c-c3f641f11843", "value": "T166336C36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456169, "uuid": "12970e48-9235-42a0-879a-0845732ca977", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692456169, "uuid": "3f24bc47-6e6e-41ec-810b-35b543c5bde6", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692456169, "uuid": "7c59b407-707d-41be-9cef-3a4ab27ca3c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692456169, "uuid": "565a754f-cefb-4b60-9648-84e5a1e6416c", "value": "4f32984fb801ba368f92d91eaa88be0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9ccd9d-3e7f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692442884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442884, "uuid": "7f1f1605-0877-4944-83ed-85c6e9f5969e", "comment": "Malware payload (RedLineStealer)", "value": "9844591837b1f2619155e29c306dff0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442884, "uuid": "70c79561-cebb-4a10-ba58-9b7eb7debc6a", "comment": "Malware payload (RedLineStealer)", "value": "ec6e08c281ff76c4b4116bf5dda6d7c5e7b83e98a82560c4c36938937556e46e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442884, "uuid": "5da4fe8f-899d-4726-927f-c9ed0eb94553", "comment": "Malware payload (RedLineStealer)", "value": "abf7abd58509d55369edd34ec7284a3fba9c95a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692442884, "uuid": "79373948-1d1a-4acc-a441-fe70b2517d13", "comment": "Malware payload (RedLineStealer)", "value": "83885a3f6b5223cb7832fb4973a10b1185adfd0ddc195bacd950af61bc3fc5e310c83724bbd8f949b5875caf52f38b4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442884, "uuid": "a1a32de6-d5b8-42ca-b3a4-6b2f8aadaa16", "value": "T156052356EBEA84B2DDB11BB064F703DB0B317DA048B5872B3697501B0A72ED4993037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442884, "uuid": "a879f7dd-964d-4c62-af77-b0abe00cd3d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442884, "uuid": "d5ff0bfc-ff04-48ef-9520-7dab9b22156b", "value": "24576:cyn3b8LVfF8dGmxJAKWqSBOjDrcnxXbbDUpvwEn:Ln3AUdGmjAKWqSMonVPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692442884, "uuid": "0addad62-970d-4a8e-ad75-42bee4adf8bd", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692442884, "uuid": "852baaa8-d33b-4323-8a76-85d408e7baab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692442884, "uuid": "e6ffa14c-28be-4b21-b4a8-b644afc158a3", "value": "ec6e08c281ff76c4b4116bf5dda6d7c5e7b83e98a8256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71255a20-3e79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692440180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440180, "uuid": "7107a372-8e93-4819-a83a-93e4d86d97bf", "comment": "Malware payload (Loki)", "value": "37ae53ead74452038b0c77abd3302258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440180, "uuid": "0a5a5218-1a3e-49ef-bddd-bb6bfa8a313f", "comment": "Malware payload (Loki)", "value": "ec8c114e9c0bd6154bd58396c72fabe79e2ffe70dea761cabc98b35186723360", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440180, "uuid": "4905a319-86f3-4e3f-991c-33b927838e2c", "comment": "Malware payload (Loki)", "value": "a94fcde275f0cc5a6257591681eff73949006d62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692440180, "uuid": "32357415-80ee-4b0d-9fca-50d066fd6e10", "comment": "Malware payload (Loki)", "value": "309f786d0bcf4e97f100294f7f004e01b5b29c11489c805f51733af3d2032c9c469278533231b0d0dd8e9604f1444ce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440180, "uuid": "5a88c398-54a8-4bca-bd70-0c108d29393b", "value": "T15FC1F919B7CCC676C5BA477409B3830063BEF943AD17870F28CA069D6F32B64C59B6A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440180, "uuid": "71f307c5-31f3-452a-a114-30f2c4295e39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440180, "uuid": "6906c29d-9827-49ea-8ebc-2bfaeecf68e0", "value": "96:1EKnowbuz1quz1Sluz1nj3x/64PVDUtLvNv8ScpF/kVzNt:1HnoY0q0Sl0npVV2Lvh8JKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692440180, "uuid": "1685d8bf-34cf-49a3-8cc9-2d6257406c62", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692440180, "uuid": "4d253e9e-11ba-4a18-8c02-8e8a73430afa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692440180, "uuid": "9ea9a9f8-ece2-4d83-9021-04b6cf8d137b", "value": "37ae53ead74452038b0c77abd3302258.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e232406b-3e73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692437793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437793, "uuid": "94d3993d-975c-4e17-ad21-355ef7fbd2d1", "comment": "Malware payload (Amadey)", "value": "f6bc704ce4c20d211c03c556f8e82de8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437793, "uuid": "8e62e228-3df3-433f-908d-209982e9ddf0", "comment": "Malware payload (Amadey)", "value": "eddfe85e863ca2557c1bb5fed5f7ec713ad31d5a2a33511a7686648d2791d509", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437793, "uuid": "4ea936c2-88be-422a-b58f-97f26a151996", "comment": "Malware payload (Amadey)", "value": "0ed179eaecde8db7369705fd20223b5b4effa8df", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692437793, "uuid": "81c82f50-cdb2-4de3-a1ba-002b46206727", "comment": "Malware payload (Amadey)", "value": "e0aa1ec0da024cb608eee56e22ff3c8786d48de2e478b6de3eb66e5f280ef48be6ba9b132ec13b35c603a7ae0970eca3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437793, "uuid": "4d7db116-0f05-49f1-a71c-6341b54fbe86", "value": "T16F052202F3D89022DCB1277168FA07C71A357DBA4DB9923B6784E96E0C72AC5647037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437793, "uuid": "5cfcf592-eed1-4197-b01a-cd141d09ad9f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437793, "uuid": "e6ecc68e-d164-47d1-a583-63a39cdb0c88", "value": "12288:mMr5y904hRdJvQwnP3x1KY2mSEbrfBgvr1gDEHLGK5ErYyid/VfdvmP7Ct:XyFdywPh1KYowfBgMEH6ZrdidtfpmOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692437793, "uuid": "c950cd05-92a4-4bb8-b4c1-eee2cb1670dd", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692437793, "uuid": "4f388572-4137-41a1-abfc-902b322ac459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692437793, "uuid": "b97119aa-865b-487a-bf6b-cb4db353db50", "value": "f6bc704ce4c20d211c03c556f8e82de8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e443dae-3e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692445383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445383, "uuid": "8f2b3293-9f42-4d47-a089-e65dd354cf2e", "comment": "Malware payload (AgentTesla)", "value": "09556daa40c156cffd798069a7de6a6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445383, "uuid": "8b168153-8b98-4cea-9f95-7761c036fdf6", "comment": "Malware payload (AgentTesla)", "value": "ef3d3d5b989b883d8cef90f1e2f40c1c722037390db0bc735a552510c7867394", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445383, "uuid": "728ce444-7e3f-4971-ae6e-5e950337b3dd", "comment": "Malware payload (AgentTesla)", "value": "a5c3b8c99978abf607524d692c7b4fd16fab1285", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692445383, "uuid": "bb3e84dc-a4f9-4631-93c4-822cc6839f3f", "comment": "Malware payload (AgentTesla)", "value": "c1370a04d7dea2fb2c70a16577e3144c5e5d580c02b197473726bed8f8aa6a097a664730311ee5957e9189337115eab1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445383, "uuid": "76501788-14f7-47dd-8d1f-e0d08f94391f", "value": "T1EF25BFA025A74629E85AD035A4D0E4057FACE302BEDBA70D1C56F7D24507F922CEA7F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445383, "uuid": "d72d3a9c-00a4-48a6-a74f-fdf9c27e7d1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445383, "uuid": "f282e126-4b3d-4385-93c6-9fb66ddfb9d3", "value": "24576:Ah6m8rTMI/AEDLemwZpVukItoPEJzdsRDq:2tI/5DLeZZDfIbJzmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692445383, "uuid": "2a1c9ef5-1e95-4229-a0a6-031b5f02db1d", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692445383, "uuid": "d958b1de-22a0-4b17-a8a3-b6eeb90f0398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692445383, "uuid": "74bc1345-be07-46be-bd75-f3b7261459b2", "value": "SecuriteInfo.com.Win32.CrypterX-gen.22770.13743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a323eb42-3e5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692428238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428238, "uuid": "febdf963-ceaf-4670-afb6-fa2e9298d467", "comment": "Malware payload (Mirai)", "value": "bf31b06b28736dc1735c0288d24692b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428238, "uuid": "b8dfe84b-bee4-41ed-8401-7dd74bdcd153", "comment": "Malware payload (Mirai)", "value": "f29b3dc302b02597fe561091cd71939020c1e9e606abb8d7ec752a2bad8d1f79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428238, "uuid": "4e6a2dbb-87d7-4cbb-9747-f89d90f52bae", "comment": "Malware payload (Mirai)", "value": "90725a64a03db11af0b50aa669d544e83afee4f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692428238, "uuid": "495f719b-2641-4719-b4bb-03e553cf64a2", "comment": "Malware payload (Mirai)", "value": "9750edf323798c0a243dc24f4a372fe5be9485582bce023a81121f4a60fe0c2baa49ca0fb13ee45131eaeafa467d1d69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428238, "uuid": "adbc7377-9e90-406c-b563-f0a7ba22a91b", "value": "T183D2D0AEE4B481C5FD4D5C3E808C3FA10E5AE681231BDB5667128C4D5B37C57F26A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428238, "uuid": "431fd917-0f6d-4268-aa74-bd955328e876", "value": "384:e8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjTA9RWGVCz0NvH:jMYHb62x4ahQ3CfdwLj9WC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692428238, "uuid": "01f85229-41f5-46ba-851d-5a4955bd98f7", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692428238, "uuid": "e914b27d-07a8-40c1-92a5-92c020b9c716", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692428238, "uuid": "d1b0a81d-ae77-43e4-a6f5-33e56ee221d3", "value": "bf31b06b28736dc1735c0288d24692b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bde7b3-3ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692459213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692459213, "uuid": "67d02b99-c76f-4b65-82ba-ba54189e547e", "comment": "Malware payload", "value": "867ce4c1c762bec122674c8874eb7fc3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692459213, "uuid": "add92015-9b06-4cc9-b581-23f49179ecf6", "comment": "Malware payload", "value": "f459416f91305ef8ff6bbbfa1a7f017a1da3c0efa4a892468818eb867aa020d0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692459213, "uuid": "8e067627-4f3d-41c5-add8-14cbe45cdd1b", "comment": "Malware payload", "value": "a98531a2c2c3e924da579aa4e5cddde1d0978b6c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692459213, "uuid": "9930ba83-66e5-42a6-8445-b4927108da88", "comment": "Malware payload", "value": "8cd6ce5a72047ba33474e4a029e29aa91ea34f00af6a620b83d0d3ae69420ffcb66a43068e0529fca147b11e7d6bc162", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692459213, "uuid": "badcc466-0bd0-417c-b3bd-0c9801ca12dd", "value": "T18D65BF42F5C340F1C4493270702A7B2FDA3D67044B2599EBE3E42D66EE603E256FB696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692459213, "uuid": "93542dc7-0ee7-423b-a4c9-2f6356397ccc", "value": "12f9017f7f8e235223d21864526d7aa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692459213, "uuid": "19ff1066-754a-4b77-8b98-ddecc657aff0", "value": "24576:hGdvPYqSgcCCMgEfTHhsYbqKTVKlP1n3UMhKOkpwXjHA1rK8e9nL37m53Bxd:xq73TTbqhlniKgY8e9ng3Bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692459213, "uuid": "e76fb2d5-e200-4c49-9d4b-884d0f7a430a", "value": 1432064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692459213, "uuid": "d3a90f61-5765-4357-b796-39a132f8fd1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692459213, "uuid": "d6d18902-5f1a-4ba5-bbd4-8edd3538a525", "value": "Osiris.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7cb1b93-3e5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692427870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427870, "uuid": "37fb6bef-4327-4cfb-bf2b-709de315bf20", "comment": "Malware payload (RedLineStealer)", "value": "7fc3f19da42f23f45755c8be466fc9c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427870, "uuid": "a1550345-3487-4579-9739-7d526f6a875e", "comment": "Malware payload (RedLineStealer)", "value": "f52876b9a89bef59abc92c8ba50f638171fb69717f714107719f881c43b69902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427870, "uuid": "796626af-5320-4f0c-aa03-d3d6f47557da", "comment": "Malware payload (RedLineStealer)", "value": "9f88d3ee7ff5ab13c4ef31de924f9e526148176b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692427870, "uuid": "beb4327b-e280-4e7f-b0a6-a29e3356ca92", "comment": "Malware payload (RedLineStealer)", "value": "02489267bb774f234748d80dc0492f490510a4f62e0a6de497f55460717948b80e5f0abc90ee6d6d7c91a4211d37de0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427870, "uuid": "2a5cfce0-ecdc-4b3a-9b6c-63b1625158ff", "value": "T148051253B3D80472EEB6277258F613C30B31BCB348B89767278298AA1C735D8A475767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427870, "uuid": "69f61e05-4679-407d-921d-545514772eeb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427870, "uuid": "59236c6c-3d80-4db6-8823-327d9a9aa924", "value": "24576:ayz3UT3z9KLx9jSDx23Awea+2xUH+hjOXIgRtN:hwT5KlJzFX8wap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692427870, "uuid": "1a1fecdc-ba74-4877-9dfb-44e495285fb2", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692427870, "uuid": "e65217c4-bfea-438e-9122-87f5c68130e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692427870, "uuid": "37fbe78b-ea16-47ea-9966-c1a06d498e73", "value": "7fc3f19da42f23f45755c8be466fc9c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f319a169-3e6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692435674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692435674, "uuid": "77ffdcf6-671d-4c75-8210-9f5e30916cda", "comment": "Malware payload (RedLineStealer)", "value": "10326458ed6615c8302ab3110635f441", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692435674, "uuid": "3d77aab9-e147-4c56-83b8-d527fcd0eb1e", "comment": "Malware payload (RedLineStealer)", "value": "f6d608f465613e7d7e5137d1499b1c01c4a50a2a89d34441d3acfaec65b9e500", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692435674, "uuid": "dba7bb54-b720-4c54-a0b0-c4ba66b2eea0", "comment": "Malware payload (RedLineStealer)", "value": "0a86ee52eba977b84326b5bbc1f3c4598ea00733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692435674, "uuid": "17b7da0b-1b65-423a-af74-0f5b59c44492", "comment": "Malware payload (RedLineStealer)", "value": "ea5d62f7d8c6de352c46b85e3d9c1470b4970c8210dd630c5358e0147ce3bb7d16bc1fa7338405f82fe0949cd28e5313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692435674, "uuid": "17701973-966e-4a5b-bc03-e45c37a6d739", "value": "T1BFF41212B6E88072E8BA27700DFB1B8B1B35BC215D78437B6346945B8DF3284997537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692435674, "uuid": "11a265aa-9a38-4a69-b870-03516835ba3f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692435674, "uuid": "214e6185-2ffc-4ada-86f8-483e5d1e14bc", "value": "12288:6Mrqy90lC+/bmgZaY2JkytjXh1fvTYDQXXQoIRubnBVbZX9gh7+pcnhJySy:gy469J1t91kDQRxnBVNsq1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692435674, "uuid": "1bcdc430-6bd4-465d-8896-83b8030e63f8", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692435674, "uuid": "7e31afcb-159c-4aec-9ac5-035ce1e2be5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692435674, "uuid": "c9af2b68-a8fb-4ae5-a357-425cd608b275", "value": "f6d608f465613e7d7e5137d1499b1c01c4a50a2a89d34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f55b89c-3e75-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692438378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438378, "uuid": "5a176e78-0537-4f5a-a9a5-d57b7a1023b8", "comment": "Malware payload (RedLineStealer)", "value": "0dc22da033929e555009ba8174a8e119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438378, "uuid": "7b0943ae-53db-44e7-aab2-886f2df45f66", "comment": "Malware payload (RedLineStealer)", "value": "f9217673ac585a27f5bddf72535796326a267afcc6f8408ecf25b07b382f6245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438378, "uuid": "b11c7962-c885-4664-a82d-eb4851cfa5de", "comment": "Malware payload (RedLineStealer)", "value": "bc961a8bb6044180614acc0099722e1458a7ef66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692438378, "uuid": "26f156d7-383a-4c3d-875a-978347b9b799", "comment": "Malware payload (RedLineStealer)", "value": "00c4a679d639e00ac02009b5d8d8f810801a1d891448f74943ec6130ba45009c44ff146cd8fce55ebcc90c9517a3e63b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438378, "uuid": "dab34a77-8748-4143-92b9-217a7b695b53", "value": "T1CD052312EACD91A2DCF41B7168F30BD70F347C7188B492AA2F55951F0CB32849939BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438378, "uuid": "79a4080b-0a8b-459d-bfa3-d969d66b4958", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438378, "uuid": "76cf7aef-f93b-4ab4-b025-8161272404d9", "value": "24576:0y9PG7arF9Y/Y3cDfxkvYmCCwJ2dpTBP:D9PGmrF9Yg3WSvYz/J2LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692438378, "uuid": "bf963f1f-2aef-435a-b29d-bbb583e2edca", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692438378, "uuid": "e52bb672-3de0-4be2-a85b-8971d013edbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692438378, "uuid": "8dc74842-2788-4740-9320-ae4b6fd81bad", "value": "0dc22da033929e555009ba8174a8e119.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360de5a5-3ed4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692479165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479165, "uuid": "fb31b274-909c-4a09-85a2-2d764079572e", "comment": "Malware payload (Mirai)", "value": "15ff474b410d1d2bf2ca9f4aa6d8109a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479165, "uuid": "e7930ed5-78ab-4029-a547-9f1da96b8dfb", "comment": "Malware payload (Mirai)", "value": "fa51534af351c6398b5d55e024760e0299dd019abda9fb8c4db742dabec28d0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479165, "uuid": "ab4dbdb6-0eee-49fd-9f69-3d5435efc40a", "comment": "Malware payload (Mirai)", "value": "c000d8d3b529f65dce1ff72a7d95f3bedac1f778", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692479165, "uuid": "65539f07-4982-418d-88ac-86e4cabaaec1", "comment": "Malware payload (Mirai)", "value": "d9fe16a285b8279a03fa41f34d5770a0209e5836083f7b7f16ba1903f061a9224a604082577162797e99d7754f4268a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479165, "uuid": "e03089a0-9a71-4972-81f0-c9fc2a42d821", "value": "T1AA73AD33D1686DA8D0664B75B9988E309B23A28416937EF6D794CB784013EECF509FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479165, "uuid": "873508f5-0689-4bb9-a94c-fe2b180c866d", "value": "1536:9aD/MEGvbwt+i7EhH6pn8C/0rrnmF5lrKkNGIkFgCJl2c:9OkdzeEhap0rjklOkQFgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692479165, "uuid": "62957b45-b4fd-406e-98c3-d24de1497b92", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692479165, "uuid": "259b9f57-0c6d-4213-8fb6-63e29103e842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692479165, "uuid": "11bc2ec3-0045-4dc0-b93f-235cff4e132e", "value": "15ff474b410d1d2bf2ca9f4aa6d8109a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d2ea59-3e50-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692422500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422500, "uuid": "0c51e15f-ef72-4849-9b50-b00499c7e820", "comment": "Malware payload (Mirai)", "value": "a127ccd5342a8afbf8c711ed22b2f401", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422500, "uuid": "0f27aa65-b54d-4299-bc2c-e7ea33aeaf74", "comment": "Malware payload (Mirai)", "value": "fa8225b0352ca6c766b545ba02e4f86eff9a5cb9ffe3519a698b9bfecf76daa1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422500, "uuid": "79bfc645-0bed-40e3-9a8d-f3ea008e42c8", "comment": "Malware payload (Mirai)", "value": "9ae5dfe3e4038138622e4e2b70e7171b060bb167", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692422500, "uuid": "a8095099-b0ef-4d85-a481-42812b755b85", "comment": "Malware payload (Mirai)", "value": "2bc7e9cf3a3499037af35bb382d2c66e91b7f81baf82a112057858209823e688e89fdbb5295eca2c1ef8ce63bde2893e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422500, "uuid": "3fab0d61-034f-48c3-9ae1-e5a31479bc63", "value": "T176A2B059218A1C72C731967648B68DD2775206B8E0F63363BCF0C98DA68641729FF6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422500, "uuid": "be54e8c7-2921-46d1-9eae-c4fa7364c3cd", "value": "384:ldLWDkLLe8jUBxUgYFC1EtOvfav6QWhj8hHZfa7t1jTr3DRMjeLFCWAnhymdGUoL:vWDkTjCanCbQu26MgCWQs3Uozavq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692422500, "uuid": "68b5b7ef-9117-448a-8127-008802ccc264", "value": 22524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692422500, "uuid": "c407469a-143e-42ed-bef2-f1ae06035bb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692422500, "uuid": "c493654b-0e3e-48b9-a843-3c7be1f94c42", "value": "a127ccd5342a8afbf8c711ed22b2f401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858c6eee-3ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692469850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469850, "uuid": "2841a5a1-4307-4f7a-a590-76d182750e25", "comment": "Malware payload (Mirai)", "value": "34c82a0d7bfc6b9b284af942179a68e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469850, "uuid": "a9e41360-6dba-4add-b767-42d542e94eaf", "comment": "Malware payload (Mirai)", "value": "fbfac6e6fccba029bdd1123089a378c84e5fd9516e34f6aaeb380e84e97813af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469850, "uuid": "5362130c-f666-4ca9-b255-5df34dabc5b8", "comment": "Malware payload (Mirai)", "value": "2cfb35d532ee31c331c82f031e0f8fd27c22af2b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692469850, "uuid": "a2fcf5e1-c8aa-4442-81ab-8e5e0986633d", "comment": "Malware payload (Mirai)", "value": "f4f484b181193a6247f99e499e4e144899f8ca85fd3756d37a5c3411c53006dc9f638585caaeb712b3f72927ca200857", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469850, "uuid": "b3ee8e35-6b1e-40a0-87bb-5274f876ee13", "value": "T14ED3F846F9819B12D5C151BAFE0E124E37131B7CE2DE7302AD246F747B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469850, "uuid": "7b286d31-cba4-418d-85f8-8e074a199b6e", "value": "3072:nbIUhps1ZXW2Wogia4gWlXBXCB1s5sky:8yIZXpWoDaCHU1s57y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692469850, "uuid": "55db1d9b-1938-4065-9193-c84d899410ba", "value": 131900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692469850, "uuid": "43cab8a0-e8dc-464e-9c89-e8919a0c6e34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692469850, "uuid": "f9c78a63-9c09-4508-a586-949a356872c6", "value": "cundi.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b61a8e-3e2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692406251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692406251, "uuid": "9696a20a-d767-4af9-91c6-1dba09e2ea7b", "comment": "Malware payload (RedLineStealer)", "value": "c2e6a0cd38852e0fae3a96c1edd82e39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692406251, "uuid": "8ee48724-2587-48ac-9a8a-95e77dc8c260", "comment": "Malware payload (RedLineStealer)", "value": "fd1ff5ee04e0d17596a0848ca67f5c93093e66242b4a370b996da341df90c605", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692406251, "uuid": "9019b746-b49b-4608-b68e-0be0beed579d", "comment": "Malware payload (RedLineStealer)", "value": "fe341a9418e7bdca4c79379f5531ba59f5b92f53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692406251, "uuid": "e65c4cf6-90a9-490d-9705-3006520e0ca3", "comment": "Malware payload (RedLineStealer)", "value": "48debc85fbf642d50c788f52dcd6a8abc15ad71648da78731af61bcbc681c6f59decdcc1bd33738a81d9f8bc8517f1b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692406251, "uuid": "a43bde52-ae31-40a3-a5b4-1ebee4270d26", "value": "T184F41242B6E84063C87567741DF311834B36BCD249B99A1F2796B89E0CF3A94A93137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692406251, "uuid": "5c76d1b0-1806-40ac-bbf3-e16b18912874", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692406251, "uuid": "79534736-3916-4366-a6ae-3554030cfbc2", "value": "12288:oMrhy90wGPvwGhG/W+rCC0f22K+zPUHk6L3/VZ64UVRS77WQOi3yroYu:ZyD69hUW+r500QPgk6zjUXS77sXr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692406251, "uuid": "965b1149-6c14-4284-9eda-8e1a9b6e0b92", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692406251, "uuid": "00c64d41-21c2-4064-b0a0-e85253e32189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692406251, "uuid": "75f6cd55-3d70-47ba-98e6-4c283e8e6696", "value": "c2e6a0cd38852e0fae3a96c1edd82e39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b102fa9c-3e3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692413658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413658, "uuid": "1afe42e7-c044-459d-b3f2-c785ab367354", "comment": "Malware payload (Mirai)", "value": "d20bc7b187a6c54a2a2f2548a69a5a5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413658, "uuid": "f6d66d06-48b2-41c4-bb70-72327461445c", "comment": "Malware payload (Mirai)", "value": "fe5088832e5e80b89399de48759d7a28feb8d66042bd3939b8fd51b100d42556", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413658, "uuid": "438aaac6-f83c-4fd5-add7-1ea9002a0086", "comment": "Malware payload (Mirai)", "value": "acc42acdfcfcaffdcd954ef8ede52beb30d076af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692413658, "uuid": "1b9b103d-8c71-49ac-be3b-f10a598073ce", "comment": "Malware payload (Mirai)", "value": "a87232efb131eb1bdc6aae4c1ce8aea8367ec58461737eb3a7deeed1c4fd782d1612ef12137638f509aa13a3bee76b86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413658, "uuid": "fd8b2592-4d75-4394-b457-5e1c8fd29a47", "value": "T187E2F153D3725052DE783AB2F96E49CF2B7D4B6CC67B70A216155628299B0534E3C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413658, "uuid": "49353490-2ae8-455f-8a79-63d876d057f0", "value": "768:koiWiO031vpAPbrVWZK3XVGxm9XcvJ9q3UEL5Ig:korm1vpALgUJcv8LL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692413658, "uuid": "f152b5d5-6006-401f-9927-c3e556b4c6de", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692413658, "uuid": "5d68bb91-935d-4776-9cd0-62917618c5cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692413658, "uuid": "9d004d6c-9b1e-464c-92ab-6c3e782c7bd7", "value": "d20bc7b187a6c54a2a2f2548a69a5a5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }