{ "Event": { "published": true, "date": "2023-09-24", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-09-24", "timestamp": 1695600182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3394fc6c-4a19-49bb-8656-723655e919a9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a91c05e-5ae9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695566771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566771, "uuid": "8acca8ce-c746-479b-920c-66704696c5bc", "comment": "Malware payload (Gafgyt)", "value": "4182f47d9d7ed43d6cd3f2b0037f5ef4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566771, "uuid": "4b151396-52e8-4c73-a391-30612f4b01d0", "comment": "Malware payload (Gafgyt)", "value": "01624a4e07b1ea99636436b97f86621e1eae96a0334ac782a10fb7608c8ebfc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566771, "uuid": "64f661c9-f9f5-4605-9446-9ae45ecc66af", "comment": "Malware payload (Gafgyt)", "value": "4596826ade8585ab5d5d296a41c0dfd857136b0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566771, "uuid": "b5fd2d5a-9afb-433d-9349-13893fa9712b", "comment": "Malware payload (Gafgyt)", "value": "839c3a10de7c4db04eb6233967949ed9a8ddedaf181fced77e7a8672f946d2cbba4b4aa8cef7bc8bcd8049a9f789e80a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566771, "uuid": "2c78cfd3-53a3-4b75-a485-ae831c81030e", "value": "T11FB32B45ED41872BC2D227BBF79E039D3B3A6A6497D7331169387EB41FC17982D2A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566771, "uuid": "9bb1e79f-acbf-4f84-9269-0d1d7c42fd62", "value": "3072:3go75GVOtFjFU32alD0CCLmcsrQPbV8fBul:3EEj42alDYLmcsrQPbV8fBul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695566771, "uuid": "066e09a0-5f58-4024-b580-04be54606f7f", "value": 112490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695566771, "uuid": "0bd569a4-ae15-434d-9fc6-3a91293737f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566771, "uuid": "fe2a71b7-cc3e-4356-bf66-66cab7e7de1c", "value": "p-p.c.blaze", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acfc459-5ab4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695544223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695544223, "uuid": "2b9f2582-0363-41d2-be50-378424c35960", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "050b0b207e4a3a7aa321765132ad669a", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695544223, "uuid": "653a9164-eee2-4b4a-a92b-efc5e88b3199", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "024ced681b7f53a81b4e21c5fd52a58720bd781db3cabd53fada8194d737c7bc", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695544223, "uuid": "a25df1e1-f29c-4a58-8851-8f2fb23a0600", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "fadeee1a131c8f9b993993447b3d0397909c2b1b", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695544223, "uuid": "68201f5d-9f2a-4025-a051-4dc1fe101cda", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "1756e4d8be45ab6eb4cebcc5c3485f0e4db11c5217ceb7f5bb71ccd09556c8e4601d24ad1f0687f9fc2b603169c33b2e", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695544223, "uuid": "5ff94da8-3b20-4312-a03b-e814d00620cc", "value": "T165349E01B4D18472D472153329F0EBB65A3EB9700B559DEFA7D80F3E4F206C1A636A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695544223, "uuid": "d2778d8f-ebbf-47f5-998d-0ed556837fcf", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695544223, "uuid": "5052d4da-896c-4518-a026-3064dde0ccab", "value": "6144:QK46fuYXChoQTjlFgLuCY1dRuAO+c4F2rcZYArw8y0:QvYzXChdTbv1buF1rmYArw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695544223, "uuid": "e4b05c00-6191-49ca-8fe7-49bfe515f6e8", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695544223, "uuid": "3a649d47-2c8f-412e-8d62-f4bc3266252b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695544223, "uuid": "cdde1c0b-c216-4c25-bd2c-42b81e1eff84", "value": "050b0b207e4a3a7aa321765132ad669a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ac2223-5b00-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695576740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576740, "uuid": "af1ce84a-dad3-4c1d-a668-9bb49b57141c", "comment": "Malware payload (MysticStealer)", "value": "f0cb7180b76f57d1242f13198344bfa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576740, "uuid": "8b50e1dc-aa33-4c14-9f2d-18cb69e7d6cb", "comment": "Malware payload (MysticStealer)", "value": "0321ff9b349c1bda3dbb56c61d35ebe56ac8ac9dfbb6206048bd9b8153538d88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576740, "uuid": "a5cb191a-2851-4056-98f9-23e5d6964f1a", "comment": "Malware payload (MysticStealer)", "value": "b8faa649b3af44174d43a8871e84d57a223c6302", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576740, "uuid": "4dd9b8d8-c9aa-4acd-a25b-1bbe319e0bdc", "comment": "Malware payload (MysticStealer)", "value": "96a6ccbd69732ae37aa171772e1de01fb900e56983a08c22abf3c7dfd54b841330b13757a14a6d7de40736b17b413faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576740, "uuid": "6879782c-64f6-4c0b-a298-fb47da6966a8", "value": "T1BC849E0074C49432E033533E46B5EB7D997DB4220B115AEFABE4756B8F206C3D6379A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576740, "uuid": "c7fe414d-9c0a-460d-9f83-0bdc06c95241", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576740, "uuid": "41990a6b-a2b6-4eb7-8209-8bd04870ff97", "value": "6144:lNAhUOqW5XJ6EDOpvOCm5MNuAOEaMjNy7hsU1XXaFc+Bs8YdD4ZJsgqwh:lNmdqW5sEe2uuydxyrBXaFFBpZspwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695576740, "uuid": "afbb3222-bec9-4c75-b3ae-3eb89af03e0a", "value": 405880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695576740, "uuid": "eb3f40fb-c04c-43c9-8406-8a59a334edda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576740, "uuid": "8695a635-a8ad-4f12-b6e5-9e1198415e1e", "value": "SecuriteInfo.com.Win32.Evo-gen.17524.19634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20895d7-5ae8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695566703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566703, "uuid": "15a58745-b17f-44c5-a6fd-d054649bf714", "comment": "Malware payload (Gafgyt)", "value": "8d4ca7ee2e6b7933c6144c2b01e9c1ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566703, "uuid": "ced0eb61-91bb-45b5-9460-7275e1e2023f", "comment": "Malware payload (Gafgyt)", "value": "045a0e109d566f27021ab20aa6c7ceb29895a5b8512f5de0c4bdc4282971e5f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566703, "uuid": "4aa1c8e6-6210-4d1f-8568-0edab07576bd", "comment": "Malware payload (Gafgyt)", "value": "8a0ccdabcc401dace328c823641f998c75c39bf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566703, "uuid": "a0fbf432-2a97-4a0b-93b7-ae9c71341aa3", "comment": "Malware payload (Gafgyt)", "value": "db19479b159f4fae206b04de838674d187e35684c60e79078d144771fe772ee2a15f9d02be885a4d50729f88944fe088", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566703, "uuid": "bfe35283-7c7f-489d-91f2-b7ef3c7e29ee", "value": "T19FD3942E7E21BFFEE26986310BF35F708795219236A19385E26CD7181E7128C1C9F794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566703, "uuid": "f4d43e27-a1ed-4601-ae46-9daa54ed41ea", "value": "1536:Xv62u+4zrOy+D1X/n70Z2rKiEuWx72vdhOeksI6U/TontmV/mGo+hFCHhnfuel:fZ+Nx72vdhtJUcs/mG3hFCHZfuel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695566703, "uuid": "0282563c-36e0-4dfe-966b-cf80ac3ba0e7", "value": 133003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695566703, "uuid": "1fec0c1d-e5df-4c75-8903-f5828ad2158c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566703, "uuid": "72429d51-ffec-4d9c-8b9a-8f0e6855926b", "value": "m-i.p-s.blaze", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f9aa37-5acf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695555682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695555682, "uuid": "7787b422-c1c2-42d0-9600-b23e15102c21", "comment": "Malware payload (Smoke Loader)", "value": "5e5725300ffcb1ef8915a7c535bba5df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695555682, "uuid": "07cfcdf2-4cd2-4a6e-a488-b034a5b86089", "comment": "Malware payload (Smoke Loader)", "value": "04d0906653b1dbd99e258c1af3c76869801e1d513038d614427424a6987c6532", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695555682, "uuid": "76f24ad9-c26a-40fc-ac08-480aa5c674cf", "comment": "Malware payload (Smoke Loader)", "value": "11f2c358773d494f43392d0a6c94762c6ac1d38b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695555682, "uuid": "6fc32965-9002-43df-b9c2-b3aef54a9784", "comment": "Malware payload (Smoke Loader)", "value": "ae9a5e803622def0eb34fa44be7c036d4c35dd5503b7c4ebe90a58a74bf004fa6342569ea4f5756384523f8c7555f4b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695555682, "uuid": "2b482fc0-508f-41c3-a924-e5479c711fac", "value": "T1DC34BF8174D1847AD072153209F0EBB65A3DB9700B615DEFA7D40F3E4F302C1A6BEA6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695555682, "uuid": "c71e503e-fd9c-4976-aab8-ced8442dcc60", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695555682, "uuid": "8e048bc3-75bb-4813-8983-ba4cece7cccb", "value": "6144:v946fuYXChoQTjlFgLuCY1dRuAO5yI3IHLN+bw8y0:vqYzXChdTbv1buH3I2w8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695555682, "uuid": "1d071ed6-c34e-4a6c-a3ad-def7ddec8d2a", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695555682, "uuid": "05cb8e7b-67d2-4acc-b56e-5bc67fbc76b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695555682, "uuid": "02607c6d-2ac8-4e7c-a363-0b63c7f062fe", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.9962.11193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b7a602-5b11-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695583996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695583996, "uuid": "75b2ab7b-f8dc-4e98-92f8-688cb81cb78d", "comment": "Malware payload", "value": "b7838dbc4f4ce8fc22c489be3a722521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695583996, "uuid": "51dceaaf-2bb2-4fcc-a3d4-dc04683d4ad1", "comment": "Malware payload", "value": "05471dc58e71d0cf565722a23c6503e19aab894db28f61553bf136b37b896899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695583996, "uuid": "156bf726-ab91-495d-9569-57ee1cfbe456", "comment": "Malware payload", "value": "0087cbae214dde96961f150ab1ee57a04efcca74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695583996, "uuid": "e36de49d-c287-49ca-b97b-f942c5460eeb", "comment": "Malware payload", "value": "ef5046d5dd9363668d43f1005c569b08700c254463914f80a320e52eb9017f28598033c78fa215dd42b40d198c989e0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695583996, "uuid": "0373933d-e5dc-4dbf-aa84-a826c14b92f9", "value": "T12444AE01B4D18472D472113205E4EB769A3EF9312B515AFF67A60E3ECF706C1A731BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695583996, "uuid": "6bba81be-0e0f-4aa0-9ab0-6b9706bcbc0d", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695583996, "uuid": "a5392e4a-21ce-4a8d-9b86-97d2f837949a", "value": "6144:mRKvcMQ+j+5j68KsT6h/OCy5UKuAO1gHyoHs1/iw6:mRKU7+j+5+RsqGhuEXjw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695583996, "uuid": "c6dc5e16-b79d-4e09-9d91-60496143ffcd", "value": 277368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695583996, "uuid": "f9ed28f0-3bc7-4a02-8aad-9f6214b7479f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695583996, "uuid": "dc2d4156-d5e2-463c-9f65-890b30e75192", "value": "SecuriteInfo.com.Win32.Evo-gen.20394.20073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ef604e-5aca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695553440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553440, "uuid": "4037664b-e8f1-45b5-966f-5907368bf148", "comment": "Malware payload (Mirai)", "value": "9d3959e821db9067b6c1d1f6aa4c64c1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553440, "uuid": "6e70f466-430b-4706-a05b-fd05390e94db", "comment": "Malware payload (Mirai)", "value": "07a1139a1ef257fb3c3e3a59ef0baa8eb1e8f889290368d537dfbaf57150fa4c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553440, "uuid": "72ed1ea7-c895-4fc2-84b8-a78cd776f398", "comment": "Malware payload (Mirai)", "value": "83cb0fa083d3ea643abb8421cf5e35e2e9cfbe4c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553440, "uuid": "f704a9cd-0f33-4f5f-a6df-3643f065bf70", "comment": "Malware payload (Mirai)", "value": "9b4eb23a5c16874bc0fceb94a2293a19102e3b2cabe94581d30705f56b76a4e21b83007626ef4b26fe07e6515300a91d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553440, "uuid": "20b5dd42-0128-41e6-8f59-f4ecce300a78", "value": "T188F3A95E6E338F6EF66C873147B74925975923DA22E1D684E2ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553440, "uuid": "945bb816-1181-4ee4-b408-d1d16509298e", "value": "1536:9MHVOd39edSAZTZtZdNKGd7sUeN8slP1j6TfNYoDF8T7GE9CkK:9MA+hZtvNK+7sR8sTgYo58TKE9CkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695553440, "uuid": "7fe173da-d07e-4e37-8553-c8f68fc7f00d", "value": 161416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695553440, "uuid": "04fce85b-e3b0-4817-b185-0132f5f3280e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553440, "uuid": "87331a9e-bda0-4227-817b-cf66ebfae82e", "value": "cundi.mips-20230924-1103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924c56eb-5adb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695560959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695560959, "uuid": "061522c1-66ed-4c2e-a6e2-854ecfc78ee0", "comment": "Malware payload (RedLineStealer)", "value": "44ac7f2fc213654a84bd9406e0ba9e2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695560959, "uuid": "8f6f206b-6dc3-4fac-b8fe-059fa5afc77f", "comment": "Malware payload (RedLineStealer)", "value": "0a05ea3f0b0429c68209691009a703936a558fdde0b270366b7d4b296e2ea6e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695560959, "uuid": "df2f1ebd-477d-4ba0-a129-cbc28316557e", "comment": "Malware payload (RedLineStealer)", "value": "4ccea375b1b19eb1bacf4482835b499e9cfc24d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695560959, "uuid": "d10123a9-ef84-45e3-a053-3ea1e3f9e2cf", "comment": "Malware payload (RedLineStealer)", "value": "8427b9e7eb4dbdb5a9c6f5641ee146d5f532d6706c1c51be5fd7e0c0dff07479cee713979bac5e4dd38665b2b1f83bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695560959, "uuid": "4199e07c-db68-468e-8ce0-8dd0360f332c", "value": "T17C946B1027A9C4F1D0632536D9E0CEF1793BBDB1032F5AFB53E68A377E6029681641A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695560959, "uuid": "a2064909-2a0d-4148-9163-681ae3f607fa", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695560959, "uuid": "df22b7f6-c34b-478f-93d7-ea3cbfdc3a2f", "value": "6144:r96hvxIcPJL8+5oprOCu5yzuAOGhr1Ld2Il85CU8MRE9Hwxqwq:r9EpIcPy+a6uu0h1Ld2IiCCawowq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695560959, "uuid": "7806f79b-fb68-46cc-b3f9-812f0690db0e", "value": 422856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695560959, "uuid": "4bae8ac2-12fe-485e-9c40-a53e9b5f5819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695560959, "uuid": "319ee74c-1f4b-44fc-bed6-ab460c59039e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7773a6c-5ae8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695566658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566658, "uuid": "1ad4246f-54c9-4728-a3c1-6b60c7f747d9", "comment": "Malware payload (Gafgyt)", "value": "01814124e110aa06db97a6538c91697f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566658, "uuid": "1d8015ab-2077-4e14-83e9-d60b7fe00aec", "comment": "Malware payload (Gafgyt)", "value": "0b44d94f8eede7b52a4f9465922baf36a4f119e12718b1dab0660fa53b56a4e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566658, "uuid": "9d0553bb-53c1-4350-a0d5-0ca0622b43da", "comment": "Malware payload (Gafgyt)", "value": "7c7deb0d14af9abd8a342502b741e936c8741005", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566658, "uuid": "3ea8ba69-4664-4911-ba2c-d095ca85792f", "comment": "Malware payload (Gafgyt)", "value": "4bf1e8c950c90bf74aa72d2d483dea3486ed61018e0f41f4cf2e40e0dec48a9a72ffe3e0053c1f2735dfd9b7d35442ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566658, "uuid": "83fa66c5-0c3f-48c6-940b-f3e3ba0a143c", "value": "T19CA31A45FD40872BC2D227BBF78F429D3B3A5A6497D733116A346EB41FC17982E2A121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566658, "uuid": "83da4a84-7819-4554-bff9-f46798144791", "value": "3072:ksoH5GVt6YSU+a60nDRwYGAmvPqQphwxfZol:kUJSnp0nDLmvPqQphwxfZol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695566658, "uuid": "fd8a15a6-9825-40c7-8e27-c84eee33ab7f", "value": 107208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695566658, "uuid": "f285511c-8366-472f-9451-e2c9621504bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566658, "uuid": "c985e4ee-3b01-4073-8661-c4af11119a7c", "value": "a-r.m-4.blaze", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5362f7-5ada-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695560630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695560630, "uuid": "86d59f64-b11a-4c48-8446-fa8a47f995cc", "comment": "Malware payload (RedLineStealer)", "value": "c5e74b6f24f013ae6bdb55e2fd000797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695560630, "uuid": "afe15309-d4c6-48ae-856b-414f2578f25a", "comment": "Malware payload (RedLineStealer)", "value": "0c2b53fe884a1527b856d6ae76dbee8d160797c78cbcf8641bdfa66328879ba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695560630, "uuid": "8ca00adf-b294-4385-a50d-6463c7ae0857", "comment": "Malware payload (RedLineStealer)", "value": "886b9b040ae2417e0a4fa03e9f2afae0a8b9e048", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695560630, "uuid": "77683f78-683d-4aee-971b-ca739eb88e85", "comment": "Malware payload (RedLineStealer)", "value": "2966dc625262e4453222ca7062e4457fe5820d16711c7ff53c92a6e3b72b69e9dcd7ba942f3e1e5df4198400848f5917", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695560630, "uuid": "f58ab86c-f817-4e28-85e5-60503bd34f29", "value": "T1A5948D01FB83E770C225147C06DC9E1948AEB92106F4B5DF9F8CC86E5AACD81627E9F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695560630, "uuid": "a357e9e0-9f29-47a8-9647-ae690c7d4908", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695560630, "uuid": "4de31985-7ab8-478d-bcbf-895788e50359", "value": "6144:Q9whvxIcPJL8+5oprOCu5yzuAOt1Xzd0BXPs3lGKaVq1A/2i9iJ+fES54bgrSc4H:Q9WpIcPy+a6uuX1XzdukMrSsz9c0Mwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695560630, "uuid": "b2725e8c-e271-418c-b3b0-8bb2b70f9500", "value": 422856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695560630, "uuid": "6e1e3d2d-5ae9-488e-a00c-3de307e886d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695560630, "uuid": "42e8ec61-e689-40e3-b9fb-6a413d035a61", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e54c48-5acd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695554786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554786, "uuid": "b900bd43-7ac4-4bca-9ff1-6a51e6e2f82d", "comment": "Malware payload (Mirai)", "value": "ee671fe41338e9d83e3383ddf05fe640", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554786, "uuid": "004d5542-fb37-429a-9d16-483bf1701e70", "comment": "Malware payload (Mirai)", "value": "0ce1925fca4e656957cbfd47c919572fb677a76d726773ee528451d3c3654878", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554786, "uuid": "8340198a-5d46-4fd2-bd6d-ad2dbf90b8d7", "comment": "Malware payload (Mirai)", "value": "e0aac082fdcb6b06a3044d8cacb35c8531fc2b3b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554786, "uuid": "ef33e955-c3ec-4cd3-ae73-2583ba59e75d", "comment": "Malware payload (Mirai)", "value": "07652dec988d633c90bbee75ec4a5e696732c04db5bae223db548a28b2a49c3c129b4844aba57d64a7a35ce831e9424a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695554786, "uuid": "be235773-199a-4be7-9784-2bc47ffd2369", "value": "T1E1D32A46F6408B43C0D22775BADF825633239B64A3D773059928BFF83F8679A4E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695554786, "uuid": "5b1d823d-fe75-41c0-8050-f0e9ee618cf1", "value": "3072:I69+3AaxK5b+imBSyxavBbnj/NM/9x+J1:ILAaxK5b+imBQJbnjVM/9o1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695554786, "uuid": "2c483cc6-f6d6-42d3-b28b-f40eacb94d18", "value": 138767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695554786, "uuid": "a57325ea-2e72-4c6f-aebc-3c0ea1928836", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695554786, "uuid": "8a06932f-ca40-4267-9725-0f948aa6106d", "value": "skid.arm7-20230924-1126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b870f733-5a75-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695517214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695517214, "uuid": "240d6c7e-6994-42de-9078-a755493a13be", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "0d49730dea92b7893ecc6079c0de1808", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695517214, "uuid": "4e0e67ab-b581-46f4-b9f2-1312e4d05bf3", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "0d38f4106acc9aeb83eb0c7017753de04dbed5d7313b649bc02d5ee5f99c146a", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695517214, "uuid": "124a4f29-8d6d-4a9e-b265-cdf5c7c5dbb4", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d2d003d5a155800b9f681371bb3c277573443374", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695517214, "uuid": "9c17c8a3-0f7a-43fa-ad91-cc6c3dcec43b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c403e52b9a53baac6d88517fd509d4d8ef94d412c181f3a63f610ee60d598a572f2f87626589453b318de345e808dbd5", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695517214, "uuid": "6a9af131-bd12-47e0-94ae-855f36555147", "value": "T139349D01B4E18472D472153209F4EBBA5A3DB9710B5199EFAFD40F7E8F306C1A631E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695517214, "uuid": "eaca519d-4776-4011-baff-0c41b517ff5d", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695517214, "uuid": "7e224853-b722-49db-83c1-a404e8e1f38f", "value": "6144:m846fuYXChoQTjlFgLuCY1dRuAOAci7rzhw8y0:mlYzXChdTbv1buDurFw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695517214, "uuid": "d82c0d7e-c59d-45bb-9dcf-ee0ae6c5a337", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695517214, "uuid": "ee4c1b5d-7cea-46be-9849-b26eab6679ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695517214, "uuid": "2a417b46-c452-40b3-b881-9d2732159edc", "value": "0d49730dea92b7893ecc6079c0de1808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b26b15f-5a71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695515447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515447, "uuid": "0c4b3ad6-8364-4c3e-959c-b368c185eef7", "comment": "Malware payload (Mirai)", "value": "47c6cb7f3fbb553249cdc4a46666ad8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515447, "uuid": "6eb03f34-c4d7-4f36-89a9-2ffa2f3ed074", "comment": "Malware payload (Mirai)", "value": "10cc39f9d2b5bd58ec98eb96a67878bedb14374ee3ba9bc0d5aab999d4d97f81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515447, "uuid": "baa09484-4235-400c-9e75-2696d398fea0", "comment": "Malware payload (Mirai)", "value": "4777ff062c0e9fbeff65d90f18d2a4a569e1e3a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515447, "uuid": "b7a3108d-f86b-4097-838e-9ef18772f5ff", "comment": "Malware payload (Mirai)", "value": "6123a90c1eff6ab0a4d5108f7e341eac88ccace41ae23b137d6f64d8f9498d7867ae366410b556390f3144d27363e611", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695515447, "uuid": "5c6fc091-11ae-4a5d-b927-20a53d690365", "value": "T116E2E846B850D157C8C50B36BA0F43993B329701E7DB33029A1BBFB19F07B2E5E66258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695515447, "uuid": "3005b4ac-b1ac-4925-9c6f-46c9f08a498d", "value": "384:sHQxg+hMPU2JN1g4NRPGk3eQS6G+FBKHppFx4exW56/Tn+CFLbAT0njUSVf:sHEg+hMHNxu+eQFHKHQB+n+a80nIIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695515447, "uuid": "61d38c07-443b-42e0-91f1-0073f9b0c94b", "value": 32604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695515447, "uuid": "c3a1cd19-d8d2-49f1-af57-cd253f325a17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695515447, "uuid": "fa32b7d6-0481-46f8-8ac4-8206b00ec25f", "value": "SecuriteInfo.com.Linux.Siggen.9999.22009.32460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34dac835-5acd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695554789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554789, "uuid": "a2dd1ffb-055b-4a57-817d-3ba93151c8a0", "comment": "Malware payload (Mirai)", "value": "bbd2ca57ab65481960aa81db91c0636f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554789, "uuid": "1a956c0c-84b1-4104-9258-b22d1b10f040", "comment": "Malware payload (Mirai)", "value": "111bf5d59b4e28e2c56b0970aa03e81c39196216a9f5e0f49bb7975f1c2da7a5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554789, "uuid": "8bf5b2d1-2f5b-41d7-bac0-bb8cb96f5398", "comment": "Malware payload (Mirai)", "value": "467687bbd78dd23df2a68897953e00f02bd17a8b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554789, "uuid": "1a65e64d-1cad-4645-b15d-0b2649f79d1e", "comment": "Malware payload (Mirai)", "value": "30964c33caa9145a5ac8edcc85f800769f8881043ce2d9a8b65a67383b60ae612d2b9dfe4417de9bdb21cf716b39b1cb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695554789, "uuid": "52bb6914-e516-4632-ab51-27959b072e38", "value": "T1AE631A89B9D19A16C6C1117BFB4E438D372B13DCD2EE7307D9159B6237CB9AB0E2A011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695554789, "uuid": "25b38740-3516-4729-be9a-abe4f1d95604", "value": "1536:+rw3i5MDKF64BeggLZ0aQAP/A02lAjqv2dWCwY:+rwoM+6+dg6aQAPMfITwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695554789, "uuid": "ac38e083-672a-48f9-b4f3-529f7d12d6fd", "value": 66856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695554789, "uuid": "ef660479-defa-4913-843e-72a870147e64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695554789, "uuid": "5b33e9f0-7225-4392-b934-818dd5ece679", "value": "skid.arm-20230924-1126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb32676b-5ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695558558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558558, "uuid": "34b4e33d-9ad8-461e-a3de-732e212768c6", "comment": "Malware payload (Smoke Loader)", "value": "153ba5fe543a8c30e2d99e31f2160a5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558558, "uuid": "4d1c0ffe-e74c-48ae-8f20-561c0afd7bca", "comment": "Malware payload (Smoke Loader)", "value": "11b587c3476c94adc8a5556916fc94e76178e8a8392430fe5bdec5a3dcd814c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558558, "uuid": "95d7468b-34a5-486f-a815-d7cd597e7674", "comment": "Malware payload (Smoke Loader)", "value": "0de3735da8be69bd44d29fb6f184b83b2646da25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558558, "uuid": "8a0204c2-dadc-418e-b936-698898e90437", "comment": "Malware payload (Smoke Loader)", "value": "85883cdf37ce596eb5347e65daaeb333fc8a90f0160b349bc095b5a9ceb7a2fb80a314e33450163049e03908bcb916d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558558, "uuid": "bd52b002-13c5-4b96-834a-61c455843aa8", "value": "T123349E0175D18C72D4F215320AF0DBBA5A3DB9200B579DEFA7D40F7EAF206C1A631A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558558, "uuid": "8e935fa1-042f-4348-886d-4a0054bc55d8", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558558, "uuid": "4d73c8e6-fcf9-4796-9549-4b8423e9e9ae", "value": "6144:pz46fuYXChoQTjlFgLuCY1dRuAOHhlJ79/cSw8y0:pcYzXChdTbv1buhp90Sw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695558558, "uuid": "a8e1d9d9-3385-4e88-9f6d-643af20680be", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695558558, "uuid": "1217cfd7-5a70-483a-b91d-170a07478d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558558, "uuid": "e86c28a5-5890-4ad4-ae49-5568c23678dd", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.2177.10204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fa9080-5af0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695569743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569743, "uuid": "209a6766-e8ba-44d0-b83a-3013a3276f2c", "comment": "Malware payload (Smoke Loader)", "value": "7432d72b3ef6bcedf49f0ab6654a4dbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569743, "uuid": "d5e9fdf4-70b3-4020-9714-10965e3164bc", "comment": "Malware payload (Smoke Loader)", "value": "12c0fb06a2dada74ff465cac07e70ac5282c34cbfa85f4fcf56e72b3ccbf67b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569743, "uuid": "0377a341-823a-4931-b8a0-9da455eb92bd", "comment": "Malware payload (Smoke Loader)", "value": "7842e171f89075a47d5a6ca11cf88717c2107422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569743, "uuid": "749c40d8-99b8-495e-822d-c486c305750c", "comment": "Malware payload (Smoke Loader)", "value": "19de6288d597f2b413573aa142a06e6af8a8313c2da612b3ca4bc1e3372c499150821ddb8975fafcae3b2e75de3ba4e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569743, "uuid": "44d51d35-3b94-4ca7-bf52-f3f4374fd509", "value": "T17F44AF00B4D18472D4721D3209E4DBB65A3EB8304B555AEF67D40F3E8F707E2A7726AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569743, "uuid": "fae010e0-34b6-41c3-97ee-5bea05fba6c4", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569743, "uuid": "4a10e5e1-168b-454d-966e-ae81ddeda93d", "value": "6144:cRthrJ+j+5j68KsT6h/OCy5U9uAOLAKArIp+2qw6:cRDN+j+5+RsqGGuiKP+7w6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695569743, "uuid": "556a598c-d49d-4550-a9d8-4f1bea638818", "value": 277368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695569743, "uuid": "9726bae1-2120-4b91-b0d6-7fc215f900ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569743, "uuid": "4215100c-9066-48fc-b8d9-9af282d3a7ae", "value": "SecuriteInfo.com.Win32.Evo-gen.17382.18558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a27601-5abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695547806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547806, "uuid": "43427556-58ba-4ea2-8606-92f67ce55b2f", "comment": "Malware payload (MysticStealer)", "value": "d905f8a73292606811420d53e5bc4629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547806, "uuid": "28705bea-7f65-41f9-b52b-6bf62a91bd7f", "comment": "Malware payload (MysticStealer)", "value": "1609e8b7a3a241720c2972771f848aaffc7ca107fc6cda77703e07e7fdb83b73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547806, "uuid": "dd7c0917-5b38-4db1-b95a-e0c7e69bda24", "comment": "Malware payload (MysticStealer)", "value": "10c0a78f343198325e3008625ff3a4a98daa20bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547806, "uuid": "c7729045-ddf8-4d20-a120-fa00025d9110", "comment": "Malware payload (MysticStealer)", "value": "13626bd7f70e0234f31333798c0abc2c10cfed8319c05537e8bfc2b7230beb9e4fd57e1e3d72dab4602b8a03d80c0409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547806, "uuid": "48422733-0c46-4111-9dff-022ebc77cfd7", "value": "T11184BE1170A183F2D162383237F0B7F14A3C786C57571DEBA7D01F6E4A2E6C1E62A696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547806, "uuid": "77bb89d1-b299-4503-8374-b748242a9b44", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547806, "uuid": "d192baec-0ce0-4641-9d91-959337ece8fc", "value": "6144:Ak46fuYXChoQTjlFgLuCY1dRuAOowoWFJyZU7rHQld2ye7zLnLRKA/zGpE6lqhwE:AtYzXChdTbv1bu4mV7rH/ye7vLRKWZ6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695547806, "uuid": "5bb925f0-1c16-415a-ba82-45a76cb26490", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695547806, "uuid": "32b58ffe-1eeb-45cf-bd52-4c537241331e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547806, "uuid": "eb018312-30bb-4d74-88cb-c834e08eb027", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.1900.7995", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2d4980-5aca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695553461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553461, "uuid": "28463329-f0b4-48d5-86ec-6c172c11a93a", "comment": "Malware payload (Mirai)", "value": "7edea38eecf7da22163cbd69b9a3b03a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553461, "uuid": "84f7b7e2-11eb-4781-860b-4bb2b433b0f7", "comment": "Malware payload (Mirai)", "value": "161ed32323198fba62d2bbdcfcebaad5979e89cccbc882105435549747d310f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553461, "uuid": "d0cdfa56-8bdf-4e27-906b-9a92dbbb112c", "comment": "Malware payload (Mirai)", "value": "0b37c1b7d902dd941e720d708652d35a04c7c504", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553461, "uuid": "9c31b570-25bf-4831-b3ee-e48aa2e56492", "comment": "Malware payload (Mirai)", "value": "60b2879fe59b8d068a272c2c2353172698483a5accaf46b32aa5a613b21e0065af2f8c976456191883978ec392850709", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553461, "uuid": "bc57e916-5539-4c1d-9f0b-75414a6f37c9", "value": "T1D2B30845FC509B17C6C212BBFB4E428D7B2A1768D3EE72039D256F61378B85B0E3A146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553461, "uuid": "6ddb1ea5-ec84-4642-9c13-39282d8e36f4", "value": "1536:ZhNOKLDdTwan1/AxPG4VamYT8rhhZM5c6qNftZxl8zwywLFOK3HbWHiJWGOJzU:Zhrhkw1/345Y4rhhZmqNVBkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695553461, "uuid": "f9f435be-9709-4a2b-a1ce-9b5ee044fc8a", "value": 117504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695553461, "uuid": "c9720c4f-339d-42b2-b692-a31441e694e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553461, "uuid": "92b7e70a-6ece-4e3c-8751-c23650c6c92e", "value": "cundi.arm5-20230924-1104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e17382-5a97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695531617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531617, "uuid": "6c73f0d0-e588-4ace-95d9-c836334557f0", "comment": "Malware payload (RedLineStealer)", "value": "942ef891ffced0af0ddab7fe5a30b1bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531617, "uuid": "ec78b964-b9b7-4376-a204-a8327c5809e3", "comment": "Malware payload (RedLineStealer)", "value": "1686a3b388a8ead281159c372bbccac2fa796d547b8aaa6f5ccd9a94d783bf6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531617, "uuid": "54b7a5c8-0297-4abe-9a7c-da2e4f464b8d", "comment": "Malware payload (RedLineStealer)", "value": "0bbee52b2c98a709442c360ccc444e5c9215a0e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531617, "uuid": "efbfa257-f88c-4572-a412-4d6bbb5382aa", "comment": "Malware payload (RedLineStealer)", "value": "8c6ea55caeb95503e4540ae76f90cacea1349e53c5da2f30667676e40de473db2ef41c580d078f4f7362ae55ab936318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531617, "uuid": "e759a383-90dc-4cf7-aff4-97fc25667dd5", "value": "T1CF2523177AD44031E97A2B302CF65BC31E32BC798A7487DB6645989A4CB2AC0F534777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531617, "uuid": "ed2f497c-e5cc-41b8-becf-4bd847788ce0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531617, "uuid": "7e6cfc60-82fa-4022-aefc-f96cfaa4f791", "value": "24576:gyFSxkJ6jyfWzZdsIt4LoGXrxaGGoXD0fZFjwZCql2ojDxJ7pQ:nFSx86jyfWz5y57XD0fTjwZCU2ojtJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695531617, "uuid": "4f500f7f-8688-4ab9-acf7-0e20af6a5967", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695531617, "uuid": "48ddcb00-d0fd-4e4f-9396-87ad528b42cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531617, "uuid": "428962de-7973-444a-9c93-4d9d9fc0aa60", "value": "942ef891ffced0af0ddab7fe5a30b1bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d81b50-5aa5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695537618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695537618, "uuid": "a85b9ce2-17a1-4441-b43c-2378dd442c13", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "45e58bd3983fe6e0f4836e40f175addb", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695537618, "uuid": "e4059b12-5cd1-46ca-a8bb-1f152891afdf", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "172f1e472ff7e411e431f3d23bbc5173b22f04c333c176c36e61ae7a5801c8b8", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695537618, "uuid": "3f93c2aa-9f4e-4cc7-92ef-24060520ddf5", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "83c89f00c865238cc56a68cc16b1b808bfcb8a3f", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695537618, "uuid": "4e363474-e6bd-495d-9ff5-9e22d0cd8b2a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "283b5bb3d5fe88884ec9bdb1f441f790e6733dcb5b0529254dced0e6c9f68b7017501999be63ee588c56fefd496d0772", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695537618, "uuid": "6baa2f50-5eca-4549-b5f6-0db75d5bf32b", "value": "T1F834AE0174D18C72D47215320AF0EBFA5A3DB9600B5159EFA7D43F7E4F386C1A632A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695537618, "uuid": "3c481f0c-7436-4fe4-ae6b-a0f9a5b1e401", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695537618, "uuid": "61fc8821-2bab-4e11-8e93-a626e8c40994", "value": "6144:At46fuYXChoQTjlFgLuCY1dRuAOqxxo3qw8y0:A6YzXChdTbv1buEtw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695537618, "uuid": "b717fde4-86aa-412c-8e77-6fa9378504ef", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695537618, "uuid": "7bd7a370-db35-4894-9053-3b458515335a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695537618, "uuid": "9302126b-fd8c-4d68-9b86-bf42748bc3bc", "value": "45e58bd3983fe6e0f4836e40f175addb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f5ea47-5ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695546147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546147, "uuid": "d6ad691d-b25c-437f-a7e7-f23b1e7796ca", "comment": "Malware payload (Smoke Loader)", "value": "716cb60e934c2472905f2b7977b36401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546147, "uuid": "4a728976-8e27-4025-8860-08ca4d5691e5", "comment": "Malware payload (Smoke Loader)", "value": "17d24e3b051a6348ffa3eba949b5e30b810e854b8ac49b03ca01e48e4e969e6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546147, "uuid": "de3358af-f586-43b1-ab68-a317a1f07ca4", "comment": "Malware payload (Smoke Loader)", "value": "a13c319f00c1028bba002e204ebbe500a8b8934f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546147, "uuid": "56ec4ab4-0ebd-4218-8574-c3a7ef0e793b", "comment": "Malware payload (Smoke Loader)", "value": "d16f939d0b073419ad04e61a74411287f2e7837da48b63f937dab0fe30973066ddec30594965889513016c4ce68a4b66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546147, "uuid": "b7c1aa77-3719-406c-9c3c-5afd2205cb0f", "value": "T1FD646C0397E17C61E5368B319E2EC6F8772EF5604E69376A1358BA2B08B05F2D673311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546147, "uuid": "f2b4f3f7-be88-4f06-b658-afbf744ba036", "value": "5208e0d407d61105b978bd2c2254eb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546147, "uuid": "5390f8a5-7f40-4b3d-b3c5-34c76c18d654", "value": "3072:NPVRKD8nkXTYuKr+kQY9S2Q5i+1P/KtNvPfZ7KMQ1Ds0pJZ10ljvj:dVRKD0ksuKr+BAW5imqnvPdKMQ1Ds4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695546147, "uuid": "fe1db600-0c72-4a00-893b-455ff4dc6da2", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695546147, "uuid": "2a296174-f750-4f59-816f-16db5fbfd479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546147, "uuid": "83b0b369-2b7a-49cb-9b2c-9d2c3d6d60db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a484d3b-5af5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695571898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695571898, "uuid": "933039dd-7311-4a1c-8ac0-4dfe195c7c34", "comment": "Malware payload (RedLineStealer)", "value": "aacfb21e0446e27567b1b491631b3f9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695571898, "uuid": "c6df37e8-4ba5-4a7b-aac5-584e408a29b9", "comment": "Malware payload (RedLineStealer)", "value": "18a66e66e913be5a3980009b8740b2f3cc1a8f06d02ed5f10e96ad787d9f24c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695571898, "uuid": "9dfb7de1-865d-4d20-97d0-4bc7cea3fc39", "comment": "Malware payload (RedLineStealer)", "value": "cf30c2946e423ee5e2d79d0dcc8b5c55554e5c47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695571898, "uuid": "614fa590-6fda-437f-b2a3-fdb4fb478193", "comment": "Malware payload (RedLineStealer)", "value": "063e613faa40e405f731062061efceaf6752e53b41a823e1056523792a69ad259c8e0b84821260247d1e214307b22614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695571898, "uuid": "05cf0d4d-5235-4f24-9eef-72401e440366", "value": "T1EEF41217ABE88932DC790F7058FB12A30F32BC515DB887A66749592F0CB31D0A87176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695571898, "uuid": "4b6b585f-c3f6-482f-b937-a92556330d3d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695571898, "uuid": "99a07b4f-df5a-4c60-997a-5b2bcd3a1e60", "value": "12288:cMrNy90wg72TLZdleEss3mOsqdf9GyHXaZ3Jm6FZNsaJCkVZZsbvO7r7IEJ:hyK+Xksb59XaZ3g6BVTsO7DJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695571898, "uuid": "8077667d-e852-4677-ab78-24948cdb69d2", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695571898, "uuid": "bbfc1c47-cbf1-4444-a364-a3d6165845df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695571898, "uuid": "e0a9c303-dc97-407c-9e4f-231a635c9140", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f9d504-5ad6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695558928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558928, "uuid": "fcf9d8ec-7316-4320-9103-f053a09fb5a0", "comment": "Malware payload (RedLineStealer)", "value": "52a5d233c2cc11560d75c11bc492da3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558928, "uuid": "8a7d70e3-9c23-4947-a5fe-f1722881f4bd", "comment": "Malware payload (RedLineStealer)", "value": "18e050a1ac1232f444a6eaff3efba0b54420774a506d802826bd7b7740c07077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558928, "uuid": "6b2a8645-6853-4a4d-a891-d22944c832ad", "comment": "Malware payload (RedLineStealer)", "value": "d9c294a1244e864d2582cf7f73a9ca307cd68a64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558928, "uuid": "7c97fe0b-c394-42bc-a838-e71bbe6088a5", "comment": "Malware payload (RedLineStealer)", "value": "00223c0707b3a301908f6551da1d4aca5d910d9640f23ef77f0b4008502795d596d7765292375d60f95dd4c489bee419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558928, "uuid": "799b3b49-1a20-447c-a23f-63023729c782", "value": "T16A349E0174E1C472D472153209F0EBBA5A3EB9704B619DEFA7D40F7E4F306C1A636A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558928, "uuid": "e1bece94-1644-4495-a5ce-3c823bdd892c", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558928, "uuid": "6e464209-535b-414a-b714-8614df493497", "value": "6144:VR46fuYXChoQTjlFgLuCY1dRuAOjkuw8y0:VGYzXChdTbv1bupw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695558928, "uuid": "962ac17f-ceda-45d4-939f-6d9c43ccc09c", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695558928, "uuid": "7395b124-4193-4585-bc32-bbf260be20f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558928, "uuid": "16ce2afa-b8b4-4997-904a-dabb8e5382e4", "value": "52a5d233c2cc11560d75c11bc492da3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232f0a95-5ae9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695566785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566785, "uuid": "2c9afb2a-98be-4be0-8637-181d82884efe", "comment": "Malware payload (Gafgyt)", "value": "2f604696bd8f002eba9b504b45167880", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566785, "uuid": "1a8ee0e0-3cd6-45a3-9474-8ae5f0ab4ce8", "comment": "Malware payload (Gafgyt)", "value": "1951ee3a215c962ead131c0a43debea3a8ddfa53988316eec3e5ea76eb511421", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566785, "uuid": "ebc8c7a0-1238-4991-8134-2d00ea28fe1d", "comment": "Malware payload (Gafgyt)", "value": "0acdf40b339e27edd9eec4d1859d05a71ac3afed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566785, "uuid": "21e9ac9b-e4d1-4107-997b-e29e9b235942", "comment": "Malware payload (Gafgyt)", "value": "66c00cc092276ad824a1e3b0a585641ebabbd9f039d626c9118dadb17a3f482dadc2e95d37164c8b81c19220d53ae8e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566785, "uuid": "7ab3fb0b-6d91-4604-945c-f3cfea1a9583", "value": "T19F93294799A19FBBC046BAB16AA709340727E9115F1F1B9A713DAAF4074F4CDB80F324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566785, "uuid": "c9d607b2-86b0-41e2-bf54-2067059dc0d7", "value": "1536:Do0U3IYoPyCPCTwQKDScoo41KhOQ4ZCN73mQEfVjywPsTLgx:G3SqCaTw3DN41FZuTmpfVjyCsTLgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695566785, "uuid": "a91918f2-e34f-4eb0-a4fd-70ebef5f3b70", "value": 90932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695566785, "uuid": "5e3427f9-5c93-4cb6-abce-d399aaa3531c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566785, "uuid": "1087a1ca-f4d4-4e28-94f5-139a75a52ef7", "value": "s-h.4.blaze", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0328e8e5-5aaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695541821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541821, "uuid": "088a306d-e4b7-4359-a84b-9edbdfa2d3a4", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7efd3442937075819da2f9fdf13cb69c", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541821, "uuid": "e8ab3c66-ec10-483c-9778-767c801f42ec", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "1bdf4594723e88721567477b470a2574d18e8c8f14f8528a7b1fa395c7d40d1c", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541821, "uuid": "0c214857-dd89-40d5-a0c9-1d7e3e054182", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "87371518d1ae566305e6a3a09bd230b1686a5e98", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541821, "uuid": "6606c8cb-b8e3-4da8-819b-ed50143da806", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "71f8c135427d7dfecbd15294c04bc0e7f3eaad7052cd00d2c36977af51bb2ceceb3f3ed8ab399d867bad70ec0ea7d692", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695541821, "uuid": "8ee2ef38-cac3-4b99-9e7f-89fc1a272fe8", "value": "T183349D01B4D18473D47215320AF4EBB65A3DB9700B5D99EFE7980F7E4F202F19632A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695541821, "uuid": "59617835-dc8c-4886-9998-bad7c9f2b005", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695541821, "uuid": "deb0ca38-9958-434f-97f1-044df6712835", "value": "6144:Yz46fuYXChoQTjlFgLuCY1dRuAOSlfcuBobmgCDw8y0:YcYzXChdTbv1buqfvBkm9Dw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695541821, "uuid": "8490ed4b-87eb-4b76-815e-0e26eacc18cc", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695541821, "uuid": "cb5a47d1-2de3-44a5-98e0-58b9a31a1823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695541821, "uuid": "1c43cc51-6ebd-4bdb-afcf-879c96ac34bd", "value": "7efd3442937075819da2f9fdf13cb69c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d290e92a-5b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695587696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695587696, "uuid": "a245bff0-78c4-4d23-aaa6-feaf3759b24e", "comment": "Malware payload (MysticStealer)", "value": "f43a4928377138a22231919bb5f6236b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695587696, "uuid": "5c9afc97-6bc8-4f9f-82ae-3c9046b2e187", "comment": "Malware payload (MysticStealer)", "value": "1c1232c2055ba6f3c6cca36b3b9a0ed5e18e2cef358def73b6117d8b25ea4572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695587696, "uuid": "85c7d16b-1db7-41f0-bb44-f520b581b44c", "comment": "Malware payload (MysticStealer)", "value": "81a9686b7a76036beb5811965b1edae191436667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695587696, "uuid": "f1e09a95-4354-44af-b627-fcdc75ebaa56", "comment": "Malware payload (MysticStealer)", "value": "e1f0562e8796371652ab44bb5fa2187e21be30acdc9d6df2559b676ea9f0543556cf343e4f8635126dd41a8d962f251d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695587696, "uuid": "9f320b39-9811-4491-8fba-6b3b76ac509e", "value": "T17484C000B59187B2F561163104BDEB76167FF4238BA18ACF17960EBF4B307D17263AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695587696, "uuid": "8856f1e9-dc9e-4e21-9b3f-2b147834ef10", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695587696, "uuid": "9c436a81-8b47-4230-a575-4dbcdbaf1d61", "value": "6144:VN+hUOqW5XJ6EDOpvOCm5MNuAOM/LZOu2ltqcjHuB8gtlqwh:VNIdqW5sEe2uueNOu2ltq2uu/wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695587696, "uuid": "176a9d8a-62af-4f49-bd38-80c93f41b8de", "value": 405880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695587696, "uuid": "19d3507a-9b46-4173-9f51-0636ffe092f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695587696, "uuid": "3ea52c95-d6cd-4c01-ac79-34f8dc5e5f14", "value": "SecuriteInfo.com.Win32.Evo-gen.14644.32159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c42e3b-5aca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695553455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553455, "uuid": "965fd6dd-f4df-48f1-a519-ab6e06b28196", "comment": "Malware payload (Mirai)", "value": "7705a2b32d9c422ceee657d0d6b94c62", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553455, "uuid": "6a600af7-0108-4cc4-9c2f-4f0c102e5ed8", "comment": "Malware payload (Mirai)", "value": "1c8c101cc2389eaaf8c9c873ab4d9ba0295b2cc4765eff83ee49f63f7d7f922b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553455, "uuid": "e70e1e14-85f2-4627-b732-1aeb7c975866", "comment": "Malware payload (Mirai)", "value": "d76b27f1367167a8bac443a4bb57e9d19c2bf819", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553455, "uuid": "a3f0582d-f997-409e-bf68-a606a8a18b6f", "comment": "Malware payload (Mirai)", "value": "4bc68c61ac4809a7392d311898fb218d5133a4c2ea716f6d495180e6497b3a0b61c2586aebedf3da6031a9bcc1dc85bc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553455, "uuid": "80f128f0-2234-43e7-9b1a-bff2c1222679", "value": "T173D3F856F8819B12D5C111BAFE1E124E37131B3CE2DE7302AD246F657B8A8BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553455, "uuid": "237d88db-1cde-4cd4-85b0-a60fb20f8879", "value": "3072:EQUMnF230X3iUsgMafjnDX/b0zCpV21/6:vDnA0XyUsZaLDI8V21C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695553455, "uuid": "09cd39e0-9ab4-498d-b139-718065d81938", "value": 131932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695553455, "uuid": "6305a2d2-8cd1-45e6-a080-26d5196e324f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553455, "uuid": "7f56059c-4821-43b0-974c-a11012f773d2", "value": "cundi.arm6-20230924-1104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099ad1d7-5b09-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695580486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695580486, "uuid": "b83c784f-fb04-45c4-8140-d010cdc56890", "comment": "Malware payload (RedLineStealer)", "value": "9b7c7543b3121ef444e458dfb763db17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695580486, "uuid": "c1c75f0a-3fba-4d05-8868-d337166d182d", "comment": "Malware payload (RedLineStealer)", "value": "1de54a669a3dbe044011622e37d32e05ca16bd67dfcb54e0a1d7983615bb8ac0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695580486, "uuid": "6f545129-d00f-4280-8149-5b53863955ab", "comment": "Malware payload (RedLineStealer)", "value": "5f450e4855e69dc37c2597980e93ae1251735782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695580486, "uuid": "a6cc39df-4c7e-4152-be00-b0189c3d2503", "comment": "Malware payload (RedLineStealer)", "value": "f8538de15fd26605b81e85ec4c0cea2d98c7634ffdc62957f350d3c56e199ae09dc4e20db316f1b0e13dfa440435eca1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695580486, "uuid": "aed207b6-9441-4509-94b5-98c5b0652a8d", "value": "T13344BF81B4D18473D472213329E4EBB65A3EB9300B555AEF67940E7E8F703C1A7317AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695580486, "uuid": "05d6fc1a-6f64-440f-9401-566197c81a41", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695580486, "uuid": "f1523d49-4824-4077-97e6-282e6ed876db", "value": "6144:vRPhrJ+j+5j68KsT6h/OCy5U9uAOWAzeuH7nEKGqw6:vRJN+j+5+RsqGGuJzeg3w6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695580486, "uuid": "f7968128-d925-46d6-9bd4-8e96f5869df8", "value": 277368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695580486, "uuid": "30f0f06a-6363-461c-99a4-a51e0ee759e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695580486, "uuid": "9953171a-c1ee-4c85-991d-e89b9ee15669", "value": "SecuriteInfo.com.Win32.Evo-gen.25549.30438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5918f4a-5ad2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695557260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695557260, "uuid": "7f110b79-5867-4ae4-890f-a613f1b6c007", "comment": "Malware payload (RedLineStealer)", "value": "7a1f4582c27b943b213f43e82aa92047", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695557260, "uuid": "0b8259b0-d813-48e5-9002-fa6cfd0a4c01", "comment": "Malware payload (RedLineStealer)", "value": "1ed1fcf1e2e10bf0f9bafed05f3f4ed4f8a89e1c7039f20a0ec971f64f9f9387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695557260, "uuid": "6632105c-c40d-4963-8a0c-da6364b9c9d5", "comment": "Malware payload (RedLineStealer)", "value": "bbe5f3e8f7a1e2b8dc3375b0236ffaadd4aa1670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695557260, "uuid": "51bd656a-7bcb-4af6-9753-451e5aa3d53f", "comment": "Malware payload (RedLineStealer)", "value": "0a3637ef91d05798c63071cd92e7180df33311793cfab36e7d6a88e318c1190647f07f3404eb7378cb89c121c084ee75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695557260, "uuid": "1a14a7f9-baa2-4df7-ad72-58b57d6dfa23", "value": "T1B5A4CF1393E17C60E5268B729F2FC2B8771DF1609E6937AA2224BA2F15B01F1D673711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695557260, "uuid": "f3afff4c-908d-4925-a39b-d835e9451589", "value": "2d6b4f4a9e62e7d851c0b57974ea64af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695557260, "uuid": "7388ae5f-32f4-4de0-9189-7f69efc25ca2", "value": "6144:bA+p0ZpXwaRgE33RVJtZXlS5PzPcIIPN02ILWnSGzWDG5:bLWXXIEnRVhlqbPcIIVcWnJzQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695557260, "uuid": "8c51beb5-c711-4183-8030-a5a400c2e6c0", "value": 478720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695557260, "uuid": "bbb5d7ae-3656-4459-86ae-814fcaed1615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695557260, "uuid": "a007a8ce-31c0-4b9f-8cc6-8412d5327feb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8e1416-5a7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695519315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695519315, "uuid": "7db6cdc8-959a-4e2d-9e84-7f7669b9df7c", "comment": "Malware payload (RedLineStealer)", "value": "ee81ba01c3226c7dbb3974bf97613962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695519315, "uuid": "279aa070-4d12-43c0-8ad1-15d0f7e38d08", "comment": "Malware payload (RedLineStealer)", "value": "1fb435fc2ca0d321fdeb0db74e46700cf6e1909a7d9243ffe45b24fcea9bc80b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695519315, "uuid": "bb208dc5-a4ee-417a-8a78-211972e5088d", "comment": "Malware payload (RedLineStealer)", "value": "989893897ae5f0f2c461507c3d56064ae1bf0faa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695519315, "uuid": "b12ce088-d2c1-4e5c-9d82-f3d6997e5080", "comment": "Malware payload (RedLineStealer)", "value": "f01880c526de9579ee80c4ceebed929e8b638ba87d9aab056494c042717c0418a2d1bc9411218490a109e1ec80fe3d0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695519315, "uuid": "ee068573-875a-4843-ac56-460033ec5771", "value": "T138152343A7E96137CDB01BB455F3118B0B36FC719938539A2747A8CF1A721C8E93636A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695519315, "uuid": "27009196-3ff6-48a0-b9c5-803bb796e20a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695519315, "uuid": "43242279-9f7d-4575-8d2f-fc3e3cee00e4", "value": "12288:cMrdy90PsOBKJxRR25U6dT0TTCr0oKkuDxCaENsBApHJtk0RemxDrSNRk8vHv:5yAs8iLgfxO3oMFzUJi0ReWHSXk8vHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695519315, "uuid": "649443a8-56ae-4ba3-b403-791268593349", "value": 949248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695519315, "uuid": "6f498790-75a9-4fde-9615-be04e69b13b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695519315, "uuid": "70b0e2e0-7519-4241-bd9e-c5e9d8966761", "value": "ee81ba01c3226c7dbb3974bf97613962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18780d94-5aca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695553453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553453, "uuid": "36f71506-c8ed-4b12-a276-d6b050403d45", "comment": "Malware payload (Mirai)", "value": "89b6e51d1a58041031a09930b072b126", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553453, "uuid": "9ac78a23-e26c-45fe-bf8a-54de523a5c09", "comment": "Malware payload (Mirai)", "value": "204f019c2e0f03f891903a1b3d06114b9b12b0cd0506fa962aab002d5736afc3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553453, "uuid": "018c8f61-bdaf-4917-9a26-93b72a89bdd3", "comment": "Malware payload (Mirai)", "value": "47211bd4b4a3ab62a33f6c603b57c1c3f1f66b64", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553453, "uuid": "50204da9-4d20-4593-aad0-913656b7bba0", "comment": "Malware payload (Mirai)", "value": "3da25f3937976ec457aef837f57c324138e7eec626edf0e0d8d250881336750be40bd48ac3bd05aca82b1eb1f6788627", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553453, "uuid": "75543c05-a5d2-441a-b3d5-a188f83a6f3d", "value": "T198C32A45FC508B13C6C652BBFB4E428D7B2A1758D3EE72039D256F61378B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553453, "uuid": "f9109091-840e-411f-82c9-20fd4aabee5d", "value": "1536:JhtOKfEqRXRFOAKBc4Va2/sTgdcFBTvqs2En4dFlzeXwywrFv7U8+5tlqGKKOt7b:Jh8YhFOc4pkMdcFBT8K4mpUcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695553453, "uuid": "ef8dd531-ee25-4eaf-b9a5-d7c5de9c73a4", "value": 121600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695553453, "uuid": "ce0d29fa-79e1-4636-9691-0e2a782e902d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553453, "uuid": "10faf881-d1f9-4d4e-81e3-dc45f970bd40", "value": "cundi.arm-20230924-1104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b3b7e0-5aca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695553450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553450, "uuid": "935a7aa3-639c-4aa2-a0ff-8806f348b237", "comment": "Malware payload (Mirai)", "value": "7831fd5839f73b5825145ed4a618d6f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553450, "uuid": "d218f8ac-fdb9-489c-8e02-c49e2f433490", "comment": "Malware payload (Mirai)", "value": "2071d72ff8678c7fe2c56be1a2b1a27ffd1d1075035fe09a60e2900b9801566e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553450, "uuid": "a74b0fc3-0985-4bf1-8f2e-fbb3cb06e8fe", "comment": "Malware payload (Mirai)", "value": "68fe11d24406bf4157dcbe080a326c856f346469", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553450, "uuid": "cc23f08c-43fa-4ac1-9f29-fd4027061ebb", "comment": "Malware payload (Mirai)", "value": "d5ef6c847c9cadfbbb7a92f48caa80b7677a378b7427c8dfebe5c0263fdca85a82f839b1edb6dd23878bc84a3a6acaf5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553450, "uuid": "b8860627-4d28-4b79-96d6-4d5e682064de", "value": "T1C8D3391775D1D4FDC8E9D5B44F9AA13AEA72B02C1238B16B27C4AE272E4EE305F1D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553450, "uuid": "09b593a3-f327-4005-9928-dac0cef452da", "value": "3072:PntXINt6wQ4MyuaogvXpmQ3xzJMAbl4f:PntXsjXZ9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695553450, "uuid": "020ddde1-11fc-47ab-8632-fbc7d204db7b", "value": 131384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695553450, "uuid": "0ac6c028-5a20-4c35-9855-7b64f55ae748", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553450, "uuid": "b2bd6adf-ec96-4f12-b951-e95ffd6c2e7d", "value": "cundi.x86_64-20230924-1104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5bb788-5a8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695526213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526213, "uuid": "56a13fc3-e5fa-4ac9-af5a-e07a8fe722e3", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "6793170a5cda2dc1c21893ad4886fba8", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526213, "uuid": "62c57768-5d7f-4c8f-a3cc-7c2260f44f1c", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "21a15a84d1d077078c0e5e4068bad76fc88405f0ba2c556d1b36b47b04251014", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526213, "uuid": "43c0aa83-9a6c-488e-9707-127aab70a095", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "bd15eb8a35cd3e7ba33e33950ac017305077a050", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526213, "uuid": "eda7b751-2156-4efd-97e3-5f93dab9a0bf", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "13468fabedf1b63937d6c4f6ba0841073fba9b6fe5ea2ca1b5ce2287a46022fe4cdf6c9c40163bf24c62756f8d0a4b27", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526213, "uuid": "0e736ffc-158f-478b-b00b-ddb22efb52f5", "value": "T1B415232376F69432D8F453704DF942430B36BCA19DF4867A2749B49E0DB2786A87273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526213, "uuid": "69b130bb-2a57-4de8-8627-72fe94bf7fd5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526213, "uuid": "f21c1866-063e-4cc6-b5ed-4b120009e0df", "value": "24576:syZWaOVOK60ympxmDdhh5WIPO7bxOIE7Fc:bA9/60fxmDI7bxOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695526213, "uuid": "baaef3d7-4968-4ddd-8821-41512fb84f51", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695526213, "uuid": "f209c13e-fc30-4931-a8b4-658d71078f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526213, "uuid": "df002757-c3a3-4961-a515-527eff8cda10", "value": "6793170a5cda2dc1c21893ad4886fba8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28c9b02-5ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695559805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559805, "uuid": "63cb398d-1458-481e-86a5-69fde3e27ec1", "comment": "Malware payload (Mirai)", "value": "aca1bd419145b9b5c56c3a95271fd18b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559805, "uuid": "5e1c46b4-be0d-40a6-94f0-81196fc9cee8", "comment": "Malware payload (Mirai)", "value": "23de99f14d1119e468f50d59d2aed901739a6cbac4bcb0237a0493216f1ead00", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559805, "uuid": "91d86bf9-ab72-4779-af53-b21d9cd601c1", "comment": "Malware payload (Mirai)", "value": "1b7b3d55560e3737e5021824d384d3ca281a88c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559805, "uuid": "b6f5f1a1-379d-4f55-ba33-79d3277b60c4", "comment": "Malware payload (Mirai)", "value": "b378b083c63017a0148f11429af136ba6e8de0f4649b281d45ded61c232018cbeb89159e455b13fda45a4490cbc27550", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695559805, "uuid": "c2a23ff9-b801-472a-91de-b8fd607081df", "value": "T1AF332A031851C0FDC858C1705E7FAA27D933F47D5235BE4E33987E22AE5AE212A2F959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695559805, "uuid": "f649e013-acf0-47a9-b1a7-6e434a7065b8", "value": "768:2gOG8Yu6gDyWoqeqJrnXXLJiTClmlLY0IUqYlxU7UklLThy0beLrtd4MuqpW3sKX:zlq2qJrXb4T4mlLLbG7UEThy0aH4J8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695559805, "uuid": "ef2b2cf6-6b15-4b23-9ec3-3c678a54e0ec", "value": 50432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695559805, "uuid": "4ce80b93-c620-4236-aee5-c3b7b05ab771", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695559805, "uuid": "8cc232fa-3137-4a06-be17-d2f79580bb77", "value": "x86-20230924-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529a5d45-5b00-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695576743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576743, "uuid": "0625e0b7-cb62-473e-b36c-f529d2493a5e", "comment": "Malware payload (RedLineStealer)", "value": "72476c734df9607e1b2c150adcf58de2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576743, "uuid": "f2661dc2-e60b-42bd-a6aa-c17c3dbda35f", "comment": "Malware payload (RedLineStealer)", "value": "24a940b881277036f482297dac05f2babaff73d8b9731bb8876d328ad1c3bd36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576743, "uuid": "ecac01d1-ac15-4d96-8b1d-c22fd39d7249", "comment": "Malware payload (RedLineStealer)", "value": "69c370cafb6464f66cc2b172a44f475165c8509a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576743, "uuid": "3834f9de-45eb-45d8-a94e-b65a3cf02630", "comment": "Malware payload (RedLineStealer)", "value": "60082491e57653080ae35df33a313fa7ab929074f4ed221c6ae60dd4a09d6381ffc62bac476c239c6d09fea668907e5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576743, "uuid": "b97194a4-4978-415d-83e9-b01f9ca06afd", "value": "T15444AE01B4D18473D472153A09E4EBBA5A3EB9200B555AEF67D40F3F8F607C1A7327AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576743, "uuid": "eaaeb5ee-c118-410d-95b3-f931df38ffff", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576743, "uuid": "e6a5405b-e728-486a-8b38-137dfbf15937", "value": "6144:KRehrJ+j+5j68KsT6h/OCy5U9uAOdAb9AeOqw6:KRoN+j+5+RsqGGuIb9BDw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695576743, "uuid": "af3c5710-675e-43e2-83e3-6e02d42ba819", "value": 277368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695576743, "uuid": "e2409632-85d4-4544-a3fe-6ac16011c492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576743, "uuid": "9a73e766-1319-4a9a-a51a-271347c9a729", "value": "SecuriteInfo.com.Win32.Evo-gen.11459.21608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c69182-5acd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695554787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554787, "uuid": "6c007f36-1fa9-4572-bbed-7d865fa1c3b5", "comment": "Malware payload (Mirai)", "value": "a8459d06354e67d4a292ef0aa9fc6fd7", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554787, "uuid": "701d87b3-9d8d-4d8a-8e23-cf0aadaa9b6a", "comment": "Malware payload (Mirai)", "value": "25568cdc8b6e256e2fe07b4f8f4396286017ced3daef1c5958aae1e9cf517b52", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554787, "uuid": "69b23d1c-147e-450a-a67b-f2666d719531", "comment": "Malware payload (Mirai)", "value": "97041ea28ea063cdd6fcf2804e1023a9abc3c40e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554787, "uuid": "97486286-540f-4f17-8678-5d0e5964de4e", "comment": "Malware payload (Mirai)", "value": "759b97f7fe2cca8013b3a87475d388981b9289d7dc05b1844a95990dbc4bcfc817d2f539d152bc511c069a67a4c4059b", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695554787, "uuid": "70093dd1-2187-4e67-9ec9-290c99a9fea0", "value": "T184536D37A9C180FCC959D2B44A6EE237D8337CBD123AB86933D4BB2B2E5AD115F56500", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695554787, "uuid": "1bd40413-3532-4f94-94ec-4ea9ec5fec1a", "value": "768:PJ0Q+ihjl3WQngBtrXl3U0CKNA91ebjgbk9g/+FK/WV4733HQrqJn3GkFUlNIZ:pBl8jrxnCK2MgANpV+nwrq3ylN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695554787, "uuid": "be701867-dffe-4bcd-9a3e-7867c782069c", "value": 63216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695554787, "uuid": "4c6df744-65a8-4ef1-9172-c2f091f28dee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695554787, "uuid": "62fcd5b2-2150-4399-b897-8c810d13e16c", "value": "skid.x86-20230924-1126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047adb80-5b23-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695591645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695591645, "uuid": "2426dadd-1ae2-4af8-965e-a66de0bfb048", "comment": "Malware payload", "value": "622e6b2648920fc54c46cd04fc966e79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695591645, "uuid": "f7c7fc9b-ac91-4f55-a549-c8480f0f3764", "comment": "Malware payload", "value": "269f95a5eaad3e6a79746836ab191e4586caa963735da89df1703b4af69444d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695591645, "uuid": "96c1502e-7439-42ba-bee2-5726890f6a89", "comment": "Malware payload", "value": "e95e1f68f94c268d153406a1dc2949cbf35728a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695591645, "uuid": "7c7ade4a-8de7-4f64-84ae-af3dc45990e9", "comment": "Malware payload", "value": "072e4ad8ef551aee1129328152a4de3b9c95d43610556f0103205b6dfbd8198c0176ece7ed6d6aee9e437066a030a06b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695591645, "uuid": "f8291cb8-a753-493c-b124-a20e4dee69da", "value": "T15125F1E3BD189CA2F87AB178A42E5557E7B51CF3CE830936BCD6FE1A5430947051B10A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695591645, "uuid": "916c608c-1f3d-45b2-8f64-07698ee57dae", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695591645, "uuid": "264cdf46-58e2-4397-8c15-6ad074992c11", "value": "12288:c0X6ElM9h/Re/pdCPRm6bsTuNAKdv6BD0MNNk02ukc10zPsyozhzoF871oQbvKVJ:UEUWbJKkkSkLPsjhzJOQbvKVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695591645, "uuid": "4bf33349-5658-4989-8d24-3124f35f49c7", "value": 1025216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695591645, "uuid": "5afa9aa5-5588-4279-8e86-e716dfc2a1f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695591645, "uuid": "654a38ed-8c1e-4471-89f5-d79e22f7d67b", "value": "OPE_9231210.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fadd559-5a74-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695516582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695516582, "uuid": "9d77faf5-83c5-4341-b288-ec0fddf4fe73", "comment": "Malware payload (Mirai)", "value": "2c51dd5fd9a9723f21242c077318117a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695516582, "uuid": "8905f56a-d49c-425f-b8c0-3087aec9aaee", "comment": "Malware payload (Mirai)", "value": "270d9b676e53b581c1fa62d554744e462fe02f889099610a50b7cbbc3eb79b5e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695516582, "uuid": "cf2e7790-acd7-4a1d-99ab-745e6393b0e8", "comment": "Malware payload (Mirai)", "value": "4eac370b42a0e72e14072eab773c75e758fcf1be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695516582, "uuid": "94631b04-7730-49b7-8896-9009a5e19f58", "comment": "Malware payload (Mirai)", "value": "7093e685d97ed4a89620171bfed35a9dee74ecf58608d030acf8606ed30698e78f38a900747c14691e10485c055efe37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695516582, "uuid": "a1e1c03b-f2eb-472d-8a31-247da4743ff7", "value": "T1DBA30846FE419F02D4D321B9FA8F41893353AF68E3F971019D34AF61238A9D70FA6616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695516582, "uuid": "913f8786-4974-4913-a8f5-cebe27c99bf9", "value": "1536:RlnrMQZ6qL1hZaBBFSvlAI11eldyokiHtjGMdDY7K0JTSuq:HRBphZaBBFSvlZSxtjGMdDR0JTSuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695516582, "uuid": "88879894-786f-43f2-8f61-c711295904e7", "value": 98368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695516582, "uuid": "0061fc0f-f6f7-4b62-bf48-61d7bdc9b74c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695516582, "uuid": "919dbf8b-6bdc-4785-8483-da4c41eeb075", "value": "softbot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9dab26-5a95-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695531015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531015, "uuid": "1d5a2caf-d6a6-4e71-975e-e0bdf514185c", "comment": "Malware payload (RedLineStealer)", "value": "6b60bd966cac70098dc9d6dfd230b55a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531015, "uuid": "26ad6b1a-10a0-480d-a8f4-9ce9df6fa1d4", "comment": "Malware payload (RedLineStealer)", "value": "28a9a6a024a909ca58ea8f8a63b58c43d5bd58183394ea8ae3e79131a2e7d2e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531015, "uuid": "4ace6218-311b-4955-a8e9-a590ed91a186", "comment": "Malware payload (RedLineStealer)", "value": "ab7eb312a9012b8d9362fbc56aa9ba2f01010121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531015, "uuid": "c9c8049d-faef-4a3a-b330-ec67e4c0ffce", "comment": "Malware payload (RedLineStealer)", "value": "fcd84566060ee847048c75c1b6c2a645cfe95c51743e8d31108e7696d6cfa686b1cb2a67dcad7bfe2ba04caf83e1fc8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531015, "uuid": "7e63df3c-10b9-4e12-8907-dd48dbf93fa8", "value": "T16E552309B6E15172EDA82BB028FB47832B3FBC91C53D975A23468E5B4CB1640E57137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531015, "uuid": "3099ad94-adf2-41de-9f0e-88271d5cf7f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531015, "uuid": "14efb2b1-78c9-400d-8757-669b5b3b4132", "value": "24576:Ky/FjW8Ysio/BeRUprOeuC4RH5M3R84k2I0NjoTpNGyVwYmN29:R/FCfsppeRUpKeuDN5M3R84tPUTpzeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695531015, "uuid": "5711e210-952c-4cb8-81c2-a0bb4747c965", "value": 1295872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695531015, "uuid": "99d16e7c-2bef-47d5-b867-100ee9a0ca63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531015, "uuid": "3aca79fb-88c5-4288-ab08-b51ac2f7617d", "value": "6b60bd966cac70098dc9d6dfd230b55a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c8fd11-5b11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (OnlyLogger)", "timestamp": 1695583993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695583993, "uuid": "ee43fc9b-3b7e-4443-9121-243544ec05c1", "comment": "Malware payload (OnlyLogger)", "value": "b2fea7cca0f2d5d0ea5ba3286794de33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695583993, "uuid": "f2e8312e-ce8a-44f5-928f-08d0f4077b05", "comment": "Malware payload (OnlyLogger)", "value": "2c16200c3d0555be6c757bbebcf4c4015ec93df5f77dbfa71201130237463e8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695583993, "uuid": "cd0fe7a9-b2f1-43f5-a05f-7e57bb3f5842", "comment": "Malware payload (OnlyLogger)", "value": "b713f98c11b238f5084c864ac6abb3d9c270aa5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695583993, "uuid": "9026b2ab-215f-4cbc-bbc6-4534b8697e4e", "comment": "Malware payload (OnlyLogger)", "value": "aef3c2db449fbe47f15fc6b0d27b8e00d6402cf36da3bb9316361823ce1c8da5a5fd21dcf72bd3640835c46b780afeb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695583993, "uuid": "70c33297-f224-4855-8b52-d13bd74e1326", "value": "T1B384AE13A3E17C91E5268B72DE2EC2E8771EF5614F687B6A221C5E2B08B01F2D573711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695583993, "uuid": "86d1fdf1-dac4-45d7-8f34-9e36f72ace55", "value": "089d1b85a24796da8e36040b0bf10205", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695583993, "uuid": "759fbd22-7539-4e80-9bfd-7731ef86fba8", "value": "6144:8pW0jlT+z+tI9JWSYGXG1X2Mm05eqGR1rGft3+:8XRTvi9Yu21X2M9a1r8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695583993, "uuid": "b61696ca-9825-4130-ae66-cb8dbece8634", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695583993, "uuid": "486127de-3fb0-404d-ae08-692d8bb37ea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695583993, "uuid": "44d72605-33d0-4423-87e9-75288797860a", "value": "SecuriteInfo.com.Win32.PWSX-gen.26353.22826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33facc2-5abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695547807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547807, "uuid": "95b6e447-b341-47f4-89ea-51981a2b7792", "comment": "Malware payload (Smoke Loader)", "value": "d6408cd14432e2924380134ec81f21d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547807, "uuid": "8ab95cf9-547b-4005-b1d7-9bea21bb3cd3", "comment": "Malware payload (Smoke Loader)", "value": "2e2da7d0743b4775a185e84c77c4c911140903442919a2659064c66edc65e164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547807, "uuid": "9af63188-936d-4ff7-93f3-b7155958e97b", "comment": "Malware payload (Smoke Loader)", "value": "de69405230b98f43d450bd1094b5064fc7784a46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547807, "uuid": "c4cf95ab-da17-4851-803c-1644214bf871", "comment": "Malware payload (Smoke Loader)", "value": "0a2d28088032d0c3357e5117ef9846e04579980ab1dc84602663d3a03161ca9361a029fb52d2b84e8df0180f7c2e4844", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547807, "uuid": "f3d0a777-7e36-457c-bc73-a4e07b7fa5cd", "value": "T13334AF0074E18472F472A53209F4EBB75A3DB9700B5599EFA7D40F3E8F306C1A63666A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547807, "uuid": "0a845107-893f-4ac9-b422-b92887bdce01", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547807, "uuid": "cd297b50-5f0f-4e21-8808-93918248666d", "value": "6144:7/46fuYXChoQTjlFgLuCY1dRuAOZ8Kw8y0:7wYzXChdTbv1buQKw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695547807, "uuid": "5ebe6841-bf36-4dab-b41f-72aab0c10eee", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695547807, "uuid": "7ba704cc-673e-4d39-8fc1-c44969ef2cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547807, "uuid": "314f7850-b70d-4e72-81a8-823f20ed8f6f", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.18575.32226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831154fa-5ad1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1695556638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695556638, "uuid": "46fe2b48-de57-40a2-a560-23e874b75a20", "comment": "Malware payload (Stealc)", "value": "36ddbb67babd960428783c926e9eb4e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695556638, "uuid": "9b1bc154-f3e1-41dd-95d9-7859394862e8", "comment": "Malware payload (Stealc)", "value": "2e6a082a870132c3c47e698398dd6fd3d7941d13737f00af1f70b730ef50ad2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695556638, "uuid": "20b0718f-a12b-4e23-b240-e2c81430d9e1", "comment": "Malware payload (Stealc)", "value": "ed11a190cc103d6dbd80ac3be5f5b3f6a63f3e61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695556638, "uuid": "600b2c71-615b-47eb-84ab-74b4e233f811", "comment": "Malware payload (Stealc)", "value": "4e91593b8aedc12fe6c499fe9ce2e3fc7a7e9eef05d5944d47ad33c7bd4f64262baf59bfe484b0407c0777e72ac9a6b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695556638, "uuid": "9644a4e2-3c3a-40d6-bfdf-58d87661f330", "value": "T1AB646D1393D17C60E4268A729E2FC6F8761EF5208E59777B2358BB2B09B05B2D673311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695556638, "uuid": "54f6038a-a39f-4a90-8bc0-a4fea6d14231", "value": "2d6b4f4a9e62e7d851c0b57974ea64af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695556638, "uuid": "19ee4249-fb38-4091-ab72-b842b26297ca", "value": "3072:BDj+8uN099ZaBwQp8B1Zlp/dwCZuB7nmR/cnM3/WNDyKya/sMnGQ0lvS:t+800zZaB0LnJdBgi/ce/WlyKyMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695556638, "uuid": "471c9eed-6f96-4d39-951e-6c55cfcaec63", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695556638, "uuid": "fd64c758-9fc1-4d09-a232-bc75ceb0657e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695556638, "uuid": "39671124-187f-4d3d-89b3-92b6ad3bbf2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de77a3a1-5a8e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1695528015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695528015, "uuid": "0dfa9133-c4cc-467f-9c04-8fee7483e227", "comment": "Malware payload (Amadey)", "value": "3cb6fd86f4893d9367c2396c29140924", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695528015, "uuid": "247e2a76-d760-44dc-a123-6753474550e7", "comment": "Malware payload (Amadey)", "value": "3466225309654a486ac587bf9f06afd92b184a7e6c2513d588c3bfbd170e8d1a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695528015, "uuid": "e6ff2a62-ed4a-4252-ba11-6f29e4f265c0", "comment": "Malware payload (Amadey)", "value": "8eaecaaf452a681a22695f5dd933a4f631f7b3b7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695528015, "uuid": "bc7e5530-4774-4d42-a685-ef3e8782717a", "comment": "Malware payload (Amadey)", "value": "7f698b744201e76edda721ab043e0a6c307bc2ee1c33bdf677ae88f0ddfe914230ffc4e116c678dffb567abf9723816d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695528015, "uuid": "c1df9d00-9e7f-4a06-97a8-a9e64cc481c9", "value": "T1E634AE0174E18472D472153209F0EBBA5A7DB9700B659DEFA7D40F7E8F302C1A636A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695528015, "uuid": "37393a3b-1978-40a8-874e-8995e8af1ecf", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695528015, "uuid": "1a4659ce-9f85-4377-98fc-9fd43a5ab7da", "value": "6144:Uh46fuYXChoQTjlFgLuCY1dRuAOiSzsw8y0:U2YzXChdTbv1buNAw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695528015, "uuid": "5a73a10c-dae6-430e-8563-4db4d245fa42", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695528015, "uuid": "70f08416-b560-4ae5-8804-98cb95d0822d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695528015, "uuid": "d3d8aaec-e427-4eac-9e75-91cd7978babe", "value": "3cb6fd86f4893d9367c2396c29140924.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c22dfb-5abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695547811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547811, "uuid": "8d1916da-bf93-448f-be27-d95edad093ce", "comment": "Malware payload (MysticStealer)", "value": "c5cc53433943dfc3cec1a57ef28bd852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547811, "uuid": "086f66ca-ab75-4480-bbaa-4c05e6ea4e3b", "comment": "Malware payload (MysticStealer)", "value": "35a6f9342a6056e55acb1f7d51ba7e3ae925787201c9ebc3ba9bb455e7327153", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547811, "uuid": "9a13ac52-cd1b-4f30-bd8a-d67105224045", "comment": "Malware payload (MysticStealer)", "value": "076f50eb3bcf20131f44c8ecdb2582e0d0df4d56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547811, "uuid": "0a18559c-d89f-466f-90ff-cbf7ef74b668", "comment": "Malware payload (MysticStealer)", "value": "5dce7f05ada48ed8a88336534597357ac83284aa1d39b0193450659121b411e7aa7daf0b9063cf62aab8f12f7ba1e561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547811, "uuid": "0832289f-d675-4550-b290-a574456399b6", "value": "T10284BF05B5F180F1D8B226324AF0BAB6EE3E78604B5558EF5BE81F69CF105819F72127", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547811, "uuid": "dec0f289-f4c0-4a41-9a65-f62e6398d1d8", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547811, "uuid": "d38385f1-ecba-4088-bebe-c793f012dea9", "value": "6144:D846fuYXChoQTjlFgLuCY1dRuAOLE3VlKz3bljVyeIRyGsCHCUaR3tyxbmSBj14g:DlYzXChdTbv1buu0AsCPOYbmSBoStw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695547811, "uuid": "405e78fd-c38c-4be9-b3ba-c190c574b38d", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695547811, "uuid": "2464d58a-9e6c-4c47-8c03-1a93b1669c2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547811, "uuid": "6c976255-4d43-497c-8bbd-35e62a0d4e03", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.21818.8794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f811c16-5b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695585006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695585006, "uuid": "fb9352f3-217c-4e2d-9bcc-2e705451a2ad", "comment": "Malware payload (Mirai)", "value": "984977e9fc4a888343bec79a956ff2aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695585006, "uuid": "52c7d9b3-8de1-47f4-aa1d-04b811e965d0", "comment": "Malware payload (Mirai)", "value": "39ec9c125306c3409303c20250d3e215fa14b11fdf2c3631543c8c42d77aa47f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695585006, "uuid": "1b8ad521-3d70-4e82-ab64-23ba52c4ccbf", "comment": "Malware payload (Mirai)", "value": "bbaf4daf7aeb8ba8fb439f7dda4041be87940200", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695585006, "uuid": "f6713a57-3fe1-421a-857f-5062a55e9d39", "comment": "Malware payload (Mirai)", "value": "659d88be6bf6682e714eded81249ceb56df9f34e634fa5ceeb67e250ce70f7f6341ce212b676cce734fb7011c7f3081c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695585006, "uuid": "0c899d75-ddd3-4760-ab77-eb92e1b8018d", "value": "T15E536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695585006, "uuid": "3becb423-35c6-47a3-b315-9205242d709f", "value": "1536:Z7qARubgzY/bEJyxRcpF80LDHhklv4JQC9DSW:NP+eY/bEJz/XBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695585006, "uuid": "4c8e4a22-a6c0-4603-9b8f-f70b3ef5a12a", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695585006, "uuid": "9a716536-ca1a-4a96-8b20-d0b8c89a090c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695585006, "uuid": "022841d2-0f9b-4bb9-8214-e0d5624fe182", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f797508e-5af7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695573155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695573155, "uuid": "55fd41f9-7263-4150-99b6-312ca1b00359", "comment": "Malware payload (Smoke Loader)", "value": "aabcfd825f5489f9b26cf1f90a552625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695573155, "uuid": "26746fec-d9bb-4db9-a36a-9e5d4c15bd63", "comment": "Malware payload (Smoke Loader)", "value": "3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695573155, "uuid": "39337657-2bc3-47ca-95db-bc0d0f8c448f", "comment": "Malware payload (Smoke Loader)", "value": "fdcba229b9ab1cf3f6f1109ba5aabe86703e8ed2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695573155, "uuid": "0e2933b4-61cd-4f72-9c58-12e1cd6d449c", "comment": "Malware payload (Smoke Loader)", "value": "d47a5732a4f194f9cb1d11cf6b1c0053676f3823b5e06334256d125b1371b948df5093bec91e3e68b5f1ecd01594cce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695573155, "uuid": "d1b2f228-94d3-4c03-ab20-d477c1357a53", "value": "T1DB44AF01B4D18472E47A113E05E4EBB69A3EB9300B559AEB67D40E6F8F307C197317AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695573155, "uuid": "709e19fd-20b4-4b58-bf5c-96b59f4ac90f", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695573155, "uuid": "ba6bb91d-9c65-4a8a-905b-4e5d6887b097", "value": "6144:dRuhrJ+j+5j68KsT6h/OCy5U9uAOAA/lUBqw6:dR4N+j+5+RsqGGun6Yw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695573155, "uuid": "c63d0c06-6bd6-4df9-ba1b-f8c7e72ae671", "value": 277368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695573155, "uuid": "d9275ee4-5c1d-4261-93e9-3d0553ca6568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695573155, "uuid": "518bf244-c02c-43ac-b98c-95521896ebc4", "value": "SecuriteInfo.com.Win32.Evo-gen.27631.21848", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12216cac-5aca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695553442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553442, "uuid": "5b7848a1-7bf7-431f-a596-d0c34f46ca82", "comment": "Malware payload (Mirai)", "value": "c25833bad84b49c94ea0871443a6ad3b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553442, "uuid": "99d8d609-05a9-4eea-b0c5-54259720f1fe", "comment": "Malware payload (Mirai)", "value": "3acbb14eb65509122bc0252feab22ef5258eb8d1051380958432c18ad5e26c8a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553442, "uuid": "800744ac-a8f0-4df5-9189-4ef37d6441fd", "comment": "Malware payload (Mirai)", "value": "a414d22b84c07d76e7e0dc968bd58e36ef96bc8a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553442, "uuid": "5c4e9992-fa05-48ef-b2d5-5f65df49a03e", "comment": "Malware payload (Mirai)", "value": "ec777c62747199f964fba6a4544918a313ba1696842998b19501568919c207e60002591836f3ade408d876eee240a3a2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553442, "uuid": "25a84149-fc7d-4df7-acf4-553e381d7bf2", "value": "T193735CC8BA83D4F1FC5309B2513BA7728773E12A545AEE42C729AD35CC92910E72735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553442, "uuid": "ca906906-2121-495a-a204-f268d87ae91a", "value": "1536:ui0zOGnGHoKB5KAvMMZlpdtqNEloSjot0rfCeya:f0z7n4oKHCMfLt6k1j3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695553442, "uuid": "c2a0b295-0b5c-4da4-8b82-ea427b1a7dbb", "value": 80232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695553442, "uuid": "928637f0-c11f-42de-81aa-50a425bae2ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553442, "uuid": "53b62138-7b10-4376-9df3-ab0c33df1ebe", "value": "cundi.x86-20230924-1104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d09fde-5a9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695533401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533401, "uuid": "a68279e0-a2df-43cc-b11a-d64d1c2c3597", "comment": "Malware payload (MysticStealer)", "value": "9e76fe49539f42b06abf73eeac399d78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533401, "uuid": "49300c63-d9e8-496b-aeb1-3851f4f1b5c3", "comment": "Malware payload (MysticStealer)", "value": "3ce7ac0e6c94b12fbed733a3f3a1788a19402bdfe766fa90a0594689391c9f34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533401, "uuid": "8feb8f31-c776-4506-a07b-0e98beed5c95", "comment": "Malware payload (MysticStealer)", "value": "37a774f3223c2becc033c302836de832bb3d25c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533401, "uuid": "eec9da08-9f1d-4d1b-baa5-807bab10aad4", "comment": "Malware payload (MysticStealer)", "value": "313989b9e864c0442e9663900f3613f7d3ae0385f1cbc88581594c289675ed56c7f47ac13fd29ecabd9753db5bf2772c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533401, "uuid": "5cecca68-2eb6-49af-92b0-cf6328cb2312", "value": "T1A184BF14F4E5443EF07210318EF59AB2297B7A604BA526F7BBD90F2E1F643D1A731A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533401, "uuid": "c010374e-8acb-496a-a050-8576ae31d022", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533401, "uuid": "528d48b7-1185-41da-9629-16b9106facf1", "value": "6144:8f4rZOIXCh4wzjlFg7DCYfnuAOLIrH/ApuEENhTihPKUaeqRw8y0:8QVDXChtzbqfuaD4puTDujyw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695533401, "uuid": "cbeb296f-811c-463f-b2c0-97fb51c91e94", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695533401, "uuid": "d84acccf-1da7-412b-a951-19de9c88c8d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533401, "uuid": "f39d3d2a-9ef3-4071-bcad-8c6284dbf5d0", "value": "SecuriteInfo.com.Win32.Evo-gen.15725.31716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621ad149-5ab4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695544128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695544128, "uuid": "5f530923-8134-4740-9025-4701f4081f6c", "comment": "Malware payload (Smoke Loader)", "value": "9a3e04e2cc6a094a31b2d1dd0b4dd85e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695544128, "uuid": "a1224e8c-1967-4ada-9189-4da2b9b231c7", "comment": "Malware payload (Smoke Loader)", "value": "3dfae81691859195b2a1f0f3619081f06651931b4b01137e9536c382e95651d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695544128, "uuid": "dd5be607-c9eb-4c68-8359-775d55275dda", "comment": "Malware payload (Smoke Loader)", "value": "83a428811b3c5056272b58a13399b5fd6d15d839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695544128, "uuid": "c502f22d-aa24-4199-b30c-0eb506b4d672", "comment": "Malware payload (Smoke Loader)", "value": "8fb433eeb2602e0ea2dfeb00cd48dc094b68cc62f224060c6dc989cb0965b5a9aaa076c404c302271f935a22b50268d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695544128, "uuid": "59d0d60e-738f-4e5f-a4d9-7fdbac39fcdd", "value": "T1E2349D0174D1A472D4B21D3209F0DBB65A3DB9700B5199EFA7DC0F7E4F286C1A632B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695544128, "uuid": "1949d04a-4d4f-4f57-8af4-5dc55e201464", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695544128, "uuid": "746a3880-4998-40d8-b9a4-06924f619b74", "value": "6144:qB46fuYXChoQTjlFgLuCY1dRuAO09ZDCCdw8y0:qWYzXChdTbv1bu6ZD7w8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695544128, "uuid": "52c105f1-bf75-4beb-8b3b-fe72c405f260", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695544128, "uuid": "99553768-98ec-4f5c-a324-8a375dd3c3c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695544128, "uuid": "dadfb1ca-709b-4f92-b587-4de1b5a65e93", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.20101.22988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67512bdc-5adc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695561316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695561316, "uuid": "ebbde269-e1c4-41e2-abc8-856356685497", "comment": "Malware payload (RedLineStealer)", "value": "5b8d7f2689e08262890c0329682e0713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695561316, "uuid": "c62d0ff8-051e-4c6d-b336-514808f4afbe", "comment": "Malware payload (RedLineStealer)", "value": "442c84401115d8b4f9e8e582313364135a467dc63505e7f06734a05b1b352405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695561316, "uuid": "e00c5a33-281d-4210-99d8-7dc5bf2d226b", "comment": "Malware payload (RedLineStealer)", "value": "3646ebecc349eac8c88de4fcb2c82a577ef4d608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695561316, "uuid": "2a864e74-33f5-41e5-a2a8-85b2c41e9383", "comment": "Malware payload (RedLineStealer)", "value": "4a9a360283640e0d885916b1e4970af3d820bbeb7c735dbfe0aa7191970eb2999e7c1bd6ef645e2db1e122568cc372eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695561316, "uuid": "f495f81a-26fd-4821-bb5c-349cdb82bd4d", "value": "T1F6754B127FA49A52C10E633ACAE2211443F3D5D72223FA0B7FD916D51E433DE8D9E686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695561316, "uuid": "be187d5a-b5af-4161-bf4e-ffb31ca0536e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695561316, "uuid": "9fceffbc-e96b-45ef-823f-c9a1494cabe4", "value": "24576:8Zwgmoe9n7bpXu5OX0ZtvNT0MqLtmZNF:mw6onoexMygZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695561316, "uuid": "e5ed7586-95de-47c9-9f97-06f6773a8b15", "value": 1553920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695561316, "uuid": "cd0ab528-7ebd-4507-bbc0-7fba1dff9b2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695561316, "uuid": "3f2520f1-c79e-41e0-acb5-5f02ebeaa8f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886c3f8b-5ae0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695563090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695563090, "uuid": "76b019a8-0d9e-43e8-86f0-e30e1523c8f2", "comment": "Malware payload (RedLineStealer)", "value": "d228d92edff87611fbe399e0143f2ff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695563090, "uuid": "c2ea38a7-586f-4aee-8347-539b810c34ff", "comment": "Malware payload (RedLineStealer)", "value": "44ab9d9729f529fc1eb6bc9d840013e2e0916b2ebcb7cd2fdd8f73c5029cf80c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695563090, "uuid": "21e56305-46a0-42cf-acb6-c33c05e482f3", "comment": "Malware payload (RedLineStealer)", "value": "73cd2cf6696f0247867c8ce280a177ef8815ea9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695563090, "uuid": "16e6917b-6c50-4ff4-865b-b6f75653af09", "comment": "Malware payload (RedLineStealer)", "value": "0c3150d3c5b585a2d59789434133f76fd2f098d35bf469ab9d094ed2cee09d6cd419598ec5087fa716f8917543d8ccaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695563090, "uuid": "e71e3803-6a2f-4fa2-b728-35146e76e650", "value": "T17B558D213DD1B2F3EDF123FA4A9CB4345A2EB4604B25D6DF5A8817EBC6205D12A314BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695563090, "uuid": "4bf8cb4f-f70f-425b-b896-dad18c58aa6c", "value": "a82d39a6c56158e4ea461428d86a9329", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695563090, "uuid": "21cfe908-dc63-4d07-8ff8-e4855278f82d", "value": "24576:nEXXnE/1ezkPzSUgjNbUJo4Zbs3kwKxm6y2bMT2i5TqJ26r+wDpsvFb90:nB/1ezkPkKjh+1Kxm6y2bMT2i1qJ26rU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695563090, "uuid": "68b61bf6-9f09-4387-98dc-1afde78c2cf0", "value": 1303352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695563090, "uuid": "4817e648-b090-4c2f-8b70-06fb80101c55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695563090, "uuid": "efa8cfc7-19e0-4b12-90d5-4c5a3cd043c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696f2a88-5a9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695533403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533403, "uuid": "43f781df-c85f-489b-8119-adf34608453f", "comment": "Malware payload (Smoke Loader)", "value": "b65658eaf1c00aeec25d6c6dd71dc6bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533403, "uuid": "c3722c21-f953-4d2b-8f5e-d1d978556d4f", "comment": "Malware payload (Smoke Loader)", "value": "4b7a587a4f2e34636d12737163bf3558e3cc07895a9ea976c2597d36bf0f0e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533403, "uuid": "0d6fa82b-82c3-437c-90d8-72c968b6a032", "comment": "Malware payload (Smoke Loader)", "value": "aee9159ce53d4b137b87a0e64ed683c3b56f6034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533403, "uuid": "47f3743f-57f0-40a6-9b97-eab53b417630", "comment": "Malware payload (Smoke Loader)", "value": "871a0346f3f24f4dd10b913f0df285f11dc53ae375b2ef49d55bd55d40fd2f41a2717199362171270a2916cb2d4eee87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533403, "uuid": "603ac5a7-a597-49d3-b0c5-616d477afd65", "value": "T194349E01B4D18472D47215320AF0EBB65A3DB9600B669DEFA7D40F7E4F306C1E736A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533403, "uuid": "63f9bce7-5c17-4967-b640-e4e726207c89", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533403, "uuid": "6633d7ae-9241-439f-892f-1f3e9c358c89", "value": "6144:6u46fuYXChoQTjlFgLuCY1dRuAOEtUvMVrw8y0:67YzXChdTbv1bu1Ww8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695533403, "uuid": "0b2a79c3-6a06-4f61-ae3e-cefe7229502f", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695533403, "uuid": "0cf4556c-5018-4dc3-9cf0-df766f44cc1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533403, "uuid": "f7798f47-9576-4859-af34-87efe4f54936", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.25474.26703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f6fa8e-5a95-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695530665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530665, "uuid": "4608133c-6d4f-4684-ab6c-12194aadf4a8", "comment": "Malware payload (RedLineStealer)", "value": "11f534bddbe650a19a20e1f421d9d920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530665, "uuid": "9f116654-a5dd-408c-8cd5-08a99b67c3c0", "comment": "Malware payload (RedLineStealer)", "value": "4c2d4103c69fe501f32315c14aa4c774352c4a25e570eb72cec86d042bd379bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530665, "uuid": "d3453ba2-5461-43ba-aafb-a8ad827d0054", "comment": "Malware payload (RedLineStealer)", "value": "336cd9cbf3ebe62de42619b0b6353c6d72ca978b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530665, "uuid": "7f91bd58-ea71-4d1b-8159-c41291da3c7e", "comment": "Malware payload (RedLineStealer)", "value": "db3a819af0ddab5499eb0320e9e80020ef6556c79781155d2e1f534d813cc463741c75b674f55e28f15f728b7a50c1d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530665, "uuid": "54145b7e-09d8-449e-8493-d7792a11af79", "value": "T101552383A5EC4073E4F01BB14CF902570F367D62AA389B2B1749A99A0DF32D4653736B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530665, "uuid": "798f9e3f-d982-466f-93ff-f19538cdf42b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530665, "uuid": "7c8f720a-7ce4-4c18-b8ac-793d51062fbb", "value": "24576:GyLxadLEKDbyOCyX/TqRzlD+dxtIYLvqgHtkDFjgVhkb0Yu0fA:V8dLnDbyaWzd+XtIYLvqEkJg0b0Yu0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695530665, "uuid": "52d048fb-0f32-4ace-a7de-d703fde3a9c5", "value": 1299456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695530665, "uuid": "60ce119b-1029-4814-aecf-d5d63705d77a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530665, "uuid": "04ac43ac-2120-4111-adb5-743a8066d2f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec970bf-5abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695547827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547827, "uuid": "41ad9e69-850b-4959-a237-3168fa607303", "comment": "Malware payload (RedLineStealer)", "value": "75df6bb33515d9818f834d2221986a56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547827, "uuid": "a7998df2-9929-407a-bf76-eae611c073b0", "comment": "Malware payload (RedLineStealer)", "value": "4de8824d701496c6f572a11a8ec882338065357f183d39d596d5105f0796075f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547827, "uuid": "7625834d-9e53-409b-8413-14df6f8eefed", "comment": "Malware payload (RedLineStealer)", "value": "8d23abb8b785b919ae57de962011afc91c62d550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547827, "uuid": "578ac279-b834-4feb-8180-cb1f238cdf54", "comment": "Malware payload (RedLineStealer)", "value": "b4d6d70ec416446bd9c74c9bb26d9db7619e44f01b6b7e4d8638f1c98238b63a0ecb0297b0a5705af6590af9303cce52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547827, "uuid": "e2cf8008-85ea-4da5-8815-f837e89012fc", "value": "T1CA349E0174E180F2D472153209F4EBB65ABDB9700B5199EFA7D40F7E4F306C1A63EA6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547827, "uuid": "36b29c10-3bfa-4c8a-9659-4810d77e0c51", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547827, "uuid": "0482ea58-d675-414d-aba1-305b3928a5b3", "value": "6144:xW46fuYXChoQTjlFgLuCY1dRuAOvcwm9Jcw8y0:xjYzXChdTbv1bum39aw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695547827, "uuid": "75d713f8-e2c4-40d3-9656-e6105e51ff16", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695547827, "uuid": "fe9c8850-3e65-474c-9616-37ff0c76aabb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547827, "uuid": "bf6f0298-7b65-40ec-afcb-3fac1264298e", "value": "75df6bb33515d9818f834d2221986a56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18564d9-5a95-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1695530973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530973, "uuid": "7d1e4b4d-0780-4eac-9031-a85a553c53d8", "comment": "Malware payload (Rhadamanthys)", "value": "1cf749dd7209e826e36d8ece08aa6a7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530973, "uuid": "8ab8c078-f550-48f9-aea3-d6428e356d87", "comment": "Malware payload (Rhadamanthys)", "value": "4ed48b6b978ebf13a362f8ff7a2d2c1fdf17f4a4d1f513c4851201f804c04ef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530973, "uuid": "7511d065-fd71-497f-ac76-a6362b749888", "comment": "Malware payload (Rhadamanthys)", "value": "59443fd4dbbe44b43c532c30333ba643a7ee69c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530973, "uuid": "029b62c0-8f12-41b9-b711-251db48434d6", "comment": "Malware payload (Rhadamanthys)", "value": "b418c7a2885306ce9d005cba1e038b893a9bab579b8ef3e884c5138a614d31242c559dce12f23c5497660aabbf97bc5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530973, "uuid": "8612e6d5-2c74-41a8-81af-2d93893fc9a0", "value": "T173A45C56AFC33EC0DF89A6B24800FBAE176E4275CA42D0C4BD6CE5525B275A7D70B234", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530973, "uuid": "12f1cea3-5029-4c94-a6d9-7e38c78e6d99", "value": "eca0c30b65294d02a6c6180a6b323b58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530973, "uuid": "b1db2b00-9474-49f6-a01d-40fc4620a929", "value": "6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+1:2uWP/BZUyoLu8Agsmxwrvejkd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695530973, "uuid": "a76399ce-3bf1-4c51-b464-d11ad89daf1c", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695530973, "uuid": "bb36ed71-8ac8-4d87-8f3c-ceabef6df62a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530973, "uuid": "99f1d04b-759c-480d-b094-08104b038a5d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d0bc3c-5b22-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695591238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695591238, "uuid": "70ff5017-0ae7-405b-a5ee-f0af7dde4739", "comment": "Malware payload", "value": "5e98ccd93dc75c6ee086a80a4f55d042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695591238, "uuid": "a65dae00-71d7-4fe4-990d-b78801a8ebf9", "comment": "Malware payload", "value": "4f128b2da9cf6f5aa8651941b942f2ad725b1cb380c15733e5164befc5ea5d89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695591238, "uuid": "b3cb6263-5153-415d-a0e8-62f49be882e9", "comment": "Malware payload", "value": "092bdfd409a879517988eacfedae0bbbf6687030", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695591238, "uuid": "44236013-b252-4dcd-bba4-acb87eee1335", "comment": "Malware payload", "value": "cbf65e58f9a922fd5f342eb0b290ce1bcb273cb200aee88cba3da99b06f6b6344dc8d8542753ad48316cb9b139dcb09d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695591238, "uuid": "32647a6b-565d-4b16-a706-727c5512d672", "value": "T15A84BF0074D28032C83216721AF5D7695BBDB861C7E14AC777881D2BEE717C2F63BA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695591238, "uuid": "39aeaa7d-e846-4e37-a029-a88e39e6c36f", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695591238, "uuid": "c252bd29-29b6-4365-b32d-399e6dbc35f9", "value": "6144:RN0hUOqW5XJ6EDOpvOCm5MNuAO40/ukCCFRIiKrXjX9Reevlqwh:RNadqW5sEe2uu2PDCXINtRx8wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695591238, "uuid": "33c85aad-f050-4121-a260-34159267850b", "value": 405880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695591238, "uuid": "b67f2245-6d9d-4ae8-8125-df3f100b0269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695591238, "uuid": "942f2629-ef93-4609-9d93-9e91d718a62a", "value": "SecuriteInfo.com.Win32.Evo-gen.19461.2803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514f2421-5b00-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695576741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576741, "uuid": "3438dc10-dd28-4f5a-a7f2-26f4827b5679", "comment": "Malware payload", "value": "049378b9920754387322bdfad0f1b169", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576741, "uuid": "2b2e7288-e778-4124-aa99-364412e88e2a", "comment": "Malware payload", "value": "504602b384ca6337eb358d38be028d818ff84892af5191d709fcf1d1f19735fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576741, "uuid": "63b89c7f-11ec-42f9-b43c-21dfbf7d9ba9", "comment": "Malware payload", "value": "4d09946d117f0d9c6b91ae8f00a6c73eabc64390", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576741, "uuid": "ca16bd75-7baa-4963-b392-17ba137a967d", "comment": "Malware payload", "value": "0e2ad1f082f7d83a21753aca0c3519539acf7a67378b032dbb974c4f0adca8d5848c740d2f8c7df80fec54d83fbdeef0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576741, "uuid": "b8d4f703-0a4c-468d-b311-8f0daf234328", "value": "T12B03F16DC34B59A2C117487709E986268E384FA2B48FFFA48C7685DCAE51003B463DE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576741, "uuid": "47433e60-4e5e-4ea7-8e98-bb0f38b1a03f", "value": "768:UhqtGBLQ7cFKpPFH5RO7pcsupOM0ZMhO6XJgGlzDpUYsX:btgzFM7ROWsZMrVqYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695576741, "uuid": "c49652da-c506-4571-8200-95f531bccee8", "value": 39924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695576741, "uuid": "2d3370cc-b90e-4912-a122-e61ba7e7f8d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576741, "uuid": "65983b7d-51cd-4d49-8482-ad777a0b439a", "value": "SecuriteInfo.com.Linux.Siggen.9999.14299.5866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a7aeda-5af1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695570363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695570363, "uuid": "9a8dc642-57f5-49cd-867d-858f6ac2aee2", "comment": "Malware payload (RedLineStealer)", "value": "e8a2c47d648caba49b62689e611777cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695570363, "uuid": "816dcbad-1e15-4867-889d-8d8229b052e9", "comment": "Malware payload (RedLineStealer)", "value": "55904e6d68cdd6011feb222e78cf0e9615609a15d99036859c0d0db4a2ac8d27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695570363, "uuid": "3b562a87-b857-42da-84c2-312a0b66d617", "comment": "Malware payload (RedLineStealer)", "value": "42693eb97747004542a5852060b2aa25846d4243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695570363, "uuid": "960310d0-30bb-4bee-a9cd-4d1831f33b62", "comment": "Malware payload (RedLineStealer)", "value": "1aae8dcc6177259bc92bd784cc1d521a37d56fdc129b1adbadb71f41a65e70175ce298d3a1498dd3aadf2d15b7349089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695570363, "uuid": "02ba2bed-b706-46ca-8486-315c99d3977c", "value": "T10155AE7C3B828535EDE933F801FCB5A3862C9172132939CB95C816E9B7646DE2E31D85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695570363, "uuid": "ed904d5d-ff56-4456-a1f9-39bf37aae974", "value": "a82d39a6c56158e4ea461428d86a9329", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695570363, "uuid": "30141dd9-6447-4ed0-85a6-9b4b789b3ca9", "value": "24576:BHXXnE/1ezkPjyUgINbUx+4Zes5XpihDphFdWb90:BE/1ezkPHidYg5io9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695570363, "uuid": "059b1fcf-0e1d-466f-9d34-cccf744c25b4", "value": 1303352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695570363, "uuid": "81529a68-273c-4225-9641-6ecd71ed098c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695570363, "uuid": "afa15d5d-c77b-4c9f-b3c5-5929c8bbb8dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79021e46-5a96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (OnlyLogger)", "timestamp": 1695531281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531281, "uuid": "b4b543d8-8d5e-4be4-970b-77bfc100410d", "comment": "Malware payload (OnlyLogger)", "value": "390007da4f30a3384554527d3973a710", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531281, "uuid": "f59d646f-ef3d-4a55-86af-dd7e5471efcc", "comment": "Malware payload (OnlyLogger)", "value": "55beaf1f66b9a21eb32a5820d7b63911974c057c2fc46af82455b7ffbaa0bda1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531281, "uuid": "0fb03443-6357-421f-9d9f-6bd7a01a8634", "comment": "Malware payload (OnlyLogger)", "value": "35d19268eddcb52cbb29e4dadfda77010bc1ce39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531281, "uuid": "068cf0d8-8e26-42a5-a9b0-3856e0704eae", "comment": "Malware payload (OnlyLogger)", "value": "ae6278c8dec059e020ff2d5d2f3d31d8f4c817db080c7005548e6e744468fe7812ee81bda818b5c56c4f1a358c2e3699", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531281, "uuid": "c80064aa-765a-4d30-81dd-47b8790d1aa6", "value": "T18A849E13A3E17C61E5324B319E2EC6E4762FF5608E6937AB22287A2F05701F2D673751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531281, "uuid": "41bc1d50-9af8-4519-9fba-ba954fda0cc8", "value": "915313f9baf3d4fbe9e467fb8242a50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531281, "uuid": "9686be2e-2b3f-4970-806a-717b496b1a29", "value": "6144:bFTnxTqkZl5wFjS9COvetbwxjzbnSRh6jAaVrGnMEJ:Z1T9f5zCOvetKbmMoMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695531281, "uuid": "1b455f4d-14f9-47ab-9b88-097194c47ecd", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695531281, "uuid": "409fb645-1773-42f8-bf48-cd6491c241c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531281, "uuid": "7d90674c-347b-49b0-bf59-59afabcbfdd9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bd92cf-5aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1695546630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546630, "uuid": "f9cdc3d6-832e-4b7d-8f07-09763644b5f0", "comment": "Malware payload (RecordBreaker)", "value": "a06fdfa0403ec69a7c7455fed7b0dce0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546630, "uuid": "3b6ce618-1ed5-43da-b0d6-339cbff239ae", "comment": "Malware payload (RecordBreaker)", "value": "55de44d4b1b6a3f2b7b38cb908fba92c852530dbb8d273c2c86a7f490f5ffa5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546630, "uuid": "fec29fd2-6ce6-4353-8ec6-1b716c303f4d", "comment": "Malware payload (RecordBreaker)", "value": "dbc2563ac065c198e23169cf36c7d85acc08a00a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546630, "uuid": "858e47a8-820f-4a81-8ca3-99b75b9944fe", "comment": "Malware payload (RecordBreaker)", "value": "4405a0a5040fd2e14028829a93c8edd7a4fbf6c998deee828c7e2693f514001c898200308a6784f23d4f382cb9e8ee02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546630, "uuid": "a58e4189-6140-44e5-b2fd-5c3b7b2e8659", "value": "T1BEF5121132D1CC77D79A92B09572C6E11EBA394F93B8507B37602F2D3F705918ABA31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546630, "uuid": "e711dae3-2f32-4229-a1a1-7fc3170594b3", "value": "5b554c388a3c865e206967d272cdc3f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546630, "uuid": "dd63c997-ed2d-4f2e-809d-f4a5661776e9", "value": "12288:jDPXTL6tR7OV10FFJffqnru9VbYXguLOG1jlSqi:jbjkRSV10FFJKnr+V4gAOY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695546630, "uuid": "d7f99f0c-0da0-449f-8724-c6634008893b", "value": 3493888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695546630, "uuid": "db59ea20-00df-43e3-bca7-4a70609c59ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546630, "uuid": "b84f0d80-22da-48dd-b7ee-1fd52b0606d9", "value": "a06fdfa0403ec69a7c7455fed7b0dce0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4d339e-5abf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695549003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549003, "uuid": "56adc553-2305-4fa4-82ea-48014e034878", "comment": "Malware payload (Mirai)", "value": "a6481f55ae4550d9429607c5f1a30ca1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549003, "uuid": "0e00247d-6fe3-4089-b066-bb6c62b59def", "comment": "Malware payload (Mirai)", "value": "5642c233370052ab6052dbe141d0bff095d4abea704568a2047f7c32f3ca7470", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549003, "uuid": "1b375f9c-d712-4d6e-8e6a-848fa914566f", "comment": "Malware payload (Mirai)", "value": "55cbb7cd7656e82766f843c10c8330dd68c364bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549003, "uuid": "ae5a8b48-988b-4512-b5f2-2b4153a95a9d", "comment": "Malware payload (Mirai)", "value": "e8702cc05a5b2ef6053713702fcc0822dd585a9fd4e3f7f083ea7529d4765e12b00ce76ee6335c012ba6bec49576b4fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549003, "uuid": "ad8e2ead-15d3-4182-a167-4bce8babd1bb", "value": "T102D33B46FA818E13C4D5177ABAEF414533239B64E3DB730689285FB83F8669F0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549003, "uuid": "191956b8-ff7f-492c-945c-c7040c192a83", "value": "3072:p87RhnYLmccGfgJp1K18O6Gh9X0NyaOoG7TUjM/9L8D:q7RhYLmGO1g8O6Gh9kNNG7T2M/9gD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695549003, "uuid": "397d5aa2-7d22-415b-8b37-1c2440fc90db", "value": 130986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695549003, "uuid": "bd088bb2-c98e-4f30-84eb-eee53d1fa071", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549003, "uuid": "316551a9-25ce-4a1d-9bd8-5ba5eaee4fb3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9820ba96-5abb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695547225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547225, "uuid": "685edadd-72df-4ccb-a59e-b6534935587a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "584289b7693d97a4e55baa961ed8d8ed", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547225, "uuid": "c51d7b57-8f24-4e8a-ac15-98bc86748ba3", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "56729c2ee1988efc44987e5bd435080baaa1177f05045e58896b07d86c5d3a1d", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547225, "uuid": "a05a70f9-77ad-4a79-b78b-df0fe0f3a613", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "878a6a09fc87cc08edeb60899ae34e4cf0ca0bb0", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547225, "uuid": "58d70336-d016-48d6-bd72-8289cbafebec", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "4401b04ae90b521d04772be70672385ff8aad487dd7a53ce833eaa618eb8b311e77bbf4a6d9413c6f6001331a512f0f4", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547225, "uuid": "fe09535c-a3f4-4d23-97db-ebd76294a825", "value": "T11534AE0174D182F2D072153229F4DBB65A3DB9780B5189EFA7D40F7E8F3C6C19632A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547225, "uuid": "8dd41dee-b268-4d54-bd4a-cb593c3826d5", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547225, "uuid": "3e651c60-aee7-4245-bdb0-2c93c23b5f95", "value": "6144:lW46fuYXChoQTjlFgLuCY1dRuAOzEVn55Goww8y0:ljYzXChdTbv1buGLPww8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695547225, "uuid": "564b448e-3bbb-4f5b-bc07-f6adc3da25ec", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695547225, "uuid": "224d35ec-d23b-49b7-a28e-77308cbe63ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547225, "uuid": "9356cae1-ed52-4b67-b3e6-72dbcae6617f", "value": "584289b7693d97a4e55baa961ed8d8ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0554e3b5-5af0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695569742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569742, "uuid": "808c6b66-d4fc-4d75-b80e-20a09549a894", "comment": "Malware payload (MysticStealer)", "value": "d689d448c8f5468686ed63548c15faf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569742, "uuid": "62a89077-182c-4d11-960d-a9652d071164", "comment": "Malware payload (MysticStealer)", "value": "590e86916d371437ce1601922f857297adc4627d5756c66c0b71e11891abaa68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569742, "uuid": "0748bdc8-bd55-45fd-89a3-96477742c15d", "comment": "Malware payload (MysticStealer)", "value": "ea0ad786be5efa8ab4cb502481e17437b46cb1b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569742, "uuid": "afd483fa-57fa-4eca-ad13-eead4891c248", "comment": "Malware payload (MysticStealer)", "value": "df911aac248a54281aea67627bfd58c093030f3c78bdef94f680cf3d0fc7cd0e78fa689fb8bd9d92d974f5ce06482005", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569742, "uuid": "e926e521-2aea-4c51-bd08-a1de22ed96f4", "value": "T1C384AE0074C1C833C1B256FA15A4EBBAA678BDF04B5E5BEB6F900D3B5F602C192355E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569742, "uuid": "a5ffa380-ed72-48b6-b99b-d7b9eb94b7df", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569742, "uuid": "c79ae885-2ab7-436b-9720-1711db2575e5", "value": "6144:yNQczbqW5XJ6EDOpvOCm5MKuAOzF9ypRkUSl5xlf5kQkhp4juYFwh:yNDfqW5sEe25upFmolBkhpEwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695569742, "uuid": "a70d12cc-a9c0-4bb5-ac35-28ce44c8c690", "value": 405880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695569742, "uuid": "297ff164-8e4f-4e57-b073-689ebf9a35ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569742, "uuid": "723af0f8-0044-4c26-b90b-a0412c3a06c5", "value": "SecuriteInfo.com.Win32.Evo-gen.16955.26905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c03570-5aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695546927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546927, "uuid": "3ea94027-ed42-4e82-be04-790cccdbea38", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "156801911019bb30c74b33048e21034f", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546927, "uuid": "1da8a193-02bb-49eb-a3d7-706eb1b7fc1e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "5c6501d009b2c8f2f0820884350fae8585fe7d93c4ec195ef04d5c7e2adabcaf", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546927, "uuid": "ddaad15f-a7b4-4d1d-9be7-1bbb06431e63", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "e2d1ed29fc73506bc1af20492e388aee2be48fca", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546927, "uuid": "62e9eefa-7117-4b26-8fd5-f4493a80722d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "71d053de8ef042091e2b77e5282c230408ecf275ba83d6912dd2786a4126817c2a382f910f670ab40e8f2d6fb80bbf4b", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546927, "uuid": "9abc06cb-01d3-4cf4-91e2-491b5850900b", "value": "T160348D01B4D18472D472153209F0ABBA5A3DB9600B519FEFA7D40F7E6F307C1A636A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546927, "uuid": "d09d23c8-f0db-4195-871d-cb77bc7bbf74", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546927, "uuid": "f290f554-22b8-4cf9-b929-025fbf6fb5b5", "value": "6144:1/46fuYXChoQTjlFgLuCY1dRuAOHsquCPw8y0:1wYzXChdTbv1bu6VCPw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695546927, "uuid": "c482ae0b-3df3-48a1-b509-e31be96daeb2", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695546927, "uuid": "13dd9fb8-274e-4285-959b-e70b1a7c10c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546927, "uuid": "414a8799-f886-44a8-bb5e-3919b1db089a", "value": "156801911019bb30c74b33048e21034f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5b5dc9-5ac3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695550827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695550827, "uuid": "56c43844-bf13-4287-9513-eb5b3f71fee3", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "df35c61e4670f228fb00f663410161bf", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695550827, "uuid": "a94ef0be-d532-4f39-a309-bde486001426", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "5cbd85534ced6ba7d749f4143fcc9977cafcff7f72fd03a1fd49415275db95bc", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695550827, "uuid": "1c4e5910-0d04-4174-8042-73af81c28f85", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ee0794949af9833a820ec24d44ff2161c240468c", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695550827, "uuid": "be9fb11b-a2cf-4c2c-85a3-7802d6e1aa00", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "de77e19e9fd3c042a7940667753b68e95a6adc0ead389c57c584213703e1ad1c7419524ceb3f7e7e9c44d089207cec8f", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695550827, "uuid": "2ac6342d-25e4-4399-94c1-15bd976eeb9f", "value": "T116348D0174D18472D47225328DF09BBA5B3EB9604B719DEFB7D40F7E8F206C19632A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695550827, "uuid": "bd169338-ac7d-45fb-b430-eb02fef3d13d", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695550827, "uuid": "4ca8e29a-efb6-4c13-88b9-20fec9047269", "value": "6144:t146fuYXChoQTjlFgLuCY1dRuAOb+D8NhwFIw8y0:tCYzXChdTbv1bu0DdKw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695550827, "uuid": "3f9eff7d-5434-4743-9f99-38e48626cf5d", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695550827, "uuid": "a6963e5d-733b-42dd-a7ff-6679e22b7ed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695550827, "uuid": "37802351-fdb6-42d7-812b-a60d6510fc31", "value": "df35c61e4670f228fb00f663410161bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b2aad8-5ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695546466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546466, "uuid": "1501b7cc-932d-4f42-9a41-c36dc16bc2fd", "comment": "Malware payload (RedLineStealer)", "value": "b672fe7026a6894e41b032cea63bc074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546466, "uuid": "f96376cd-f29d-419a-9dd7-f72ba57d8d6e", "comment": "Malware payload (RedLineStealer)", "value": "5da664e4506bf327bd5b1aaa45426acee9ba3112a563b5086e6402b73a3d841d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546466, "uuid": "efcd7fe3-f100-45d4-b4a6-1ff041587fac", "comment": "Malware payload (RedLineStealer)", "value": "a824eb64c13b47092f067203c79e38b57919d506", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546466, "uuid": "ae8b4376-b104-4a0f-a524-43a87ffcf677", "comment": "Malware payload (RedLineStealer)", "value": "0444e7a31caa2281aa11f92025ac9b4bb15c727baf22be6e1b432a7017d1e4dd4b57406cf771a8e66528086dae41adfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546466, "uuid": "1ab86e3f-85c3-4402-9822-708063729a79", "value": "T156847D0038E5B172F1F52D321DF052F70E687AB7498908A7939F8AD8C5D05E568BAB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546466, "uuid": "ad1c4149-740e-40ec-a402-ab971efb2eec", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546466, "uuid": "f5c7cc8f-e823-4d28-bd86-d1f5ae92e7f5", "value": "6144:Z5AfHWAy5hne6jlVg1jCYRCuAO20vCHI112hYo0KTw8y:ZOf7y5he6DkQuvvCHI1mw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695546466, "uuid": "54b975d3-60b6-47c5-94f6-31c2926ed894", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695546466, "uuid": "cff65c37-57d0-4e25-8478-29153d696e62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546466, "uuid": "605bf5dd-5a39-46bd-9e11-f3e6c487a48b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5227453-5abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (OnlyLogger)", "timestamp": 1695547810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547810, "uuid": "3de0d5ae-3ce1-4109-99fd-3a762365e1b3", "comment": "Malware payload (OnlyLogger)", "value": "c5e389a52a829ceed21d8b4924258bc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547810, "uuid": "76daf028-a016-4f9d-98c5-2054b8d883c3", "comment": "Malware payload (OnlyLogger)", "value": "5e32d15eca9aa02ea00b0fab9db99e52fc0c90332cd653369d12d0a3b0152427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547810, "uuid": "952aa314-4f61-4365-98e6-3347ce06642b", "comment": "Malware payload (OnlyLogger)", "value": "325eb34ba842e659980954c15e34d3b967f4daaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547810, "uuid": "712d98f0-6832-4a05-aa76-f76744ae4e38", "comment": "Malware payload (OnlyLogger)", "value": "f8201572c3ae11c7de577571fad6b2176732a1e3e532e2328b9d45b8bfeb658467dadecd7424f5f6c681ddf5b6fbacc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547810, "uuid": "614abcca-80df-4954-8502-30a46a16038c", "value": "T1A2849E1393E17C51E5728B329E2E86E8772EF5108E6D7B6A23247A2F09701F2D673711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547810, "uuid": "4160c443-e587-4fab-8b6f-52394e92b4f7", "value": "915313f9baf3d4fbe9e467fb8242a50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547810, "uuid": "88752095-869e-42ee-a03f-f38e715629d7", "value": "6144:QvxWpT6kHjtdQkER4IJt0VePZN8mOjzSn9hNn8BQRhCwjR:WITNDtLEt0vSOw0MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695547810, "uuid": "bff65eff-08d4-46ec-adc2-eee4ef869b94", "value": 388096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695547810, "uuid": "a38d78dc-7464-474d-9ba9-f89562a4c356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547810, "uuid": "4b3efd3a-b3a2-4834-9167-3fc83a5432cd", "value": "SecuriteInfo.com.Win32.RansomX-gen.22566.13671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8525ab-5aae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695541806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541806, "uuid": "efda26dd-264a-49a6-b919-2776fa68b818", "comment": "Malware payload (Mirai)", "value": "0f084b1e95239c7539723c4f296a54e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541806, "uuid": "0d3ebf50-5716-4052-b167-4498d98eba57", "comment": "Malware payload (Mirai)", "value": "5e8598d9982beb1b402e92f9dc56b2df4e7d7b4a60428ecf21f6b485a83030e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541806, "uuid": "ced198a9-5006-4fc8-91ee-7aae2f216b89", "comment": "Malware payload (Mirai)", "value": "57f4b596e99e1be5260c40739265694cff01e179", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541806, "uuid": "07dc0496-98f1-4272-8dc5-4334239af903", "comment": "Malware payload (Mirai)", "value": "f178f03cef6426b92483ba820a8f058ba014487a3449ae4cda982b3c19a8375d344b88daaaafbb8954a8bf1857b25d0d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695541806, "uuid": "61cbc4c3-6236-4ae2-b8c1-08ed1be97cf3", "value": "T1E7E2E122E706A8E7F6F10DB37AA6C20513A5757CED037AB6AC0A5378E4D30025A74C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695541806, "uuid": "5409ea17-6297-44b0-bb5b-2c7fe452cf5d", "value": "768:5QCEJ3Eda5gR/GVbBxkIsWdR9tZ8q1IvmRewPE5qW3Uc:5QCGEE5EsbD9LfInoE5qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695541806, "uuid": "5e631676-91de-4733-b908-9760e52cbe09", "value": 31760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695541806, "uuid": "1416b00b-f470-4429-a4d6-b67c22a7e60b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695541806, "uuid": "a91aa80e-6973-4251-9cd4-eef4c292fbc9", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e13e5d-5b22-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695591239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695591239, "uuid": "a3627912-913d-4f4e-89a5-363b7a66c3f0", "comment": "Malware payload", "value": "becca129083edb1d170a4a54ae6e904a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695591239, "uuid": "18cbbe2c-8eef-4333-80da-6656d33e5d6b", "comment": "Malware payload", "value": "5f0c15e04c5359cd6260d91bd8c1e4f8ccb2d8d13aacaa31bdc6f1439985171f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695591239, "uuid": "46a87f05-4100-40ad-b274-8de9fbd872c2", "comment": "Malware payload", "value": "eeab35d07457f905cb6db26bee8b50d5925fb981", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695591239, "uuid": "9af84ee7-8765-458a-bef5-7798cf58c428", "comment": "Malware payload", "value": "2b9c335029fe960cb4f7646e466429d50b7b22762e0e08fbbf95dc1b05e0146f9b817af1a7d3310d7000661770e60398", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695591239, "uuid": "f9264d50-2b63-4874-a91d-62cabe3bf239", "value": "T12544AE01B4D18472DC72153205E4EBB69E7EB8200B555AEF67940E7ECF707C1B731AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695591239, "uuid": "c4112da6-9454-4974-9313-738583bda613", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695591239, "uuid": "2860d323-cc5c-4421-a832-afe8d818e0d3", "value": "6144:JR0hrJ+j+5j68KsT6h/OCy5U9uAOYAdTxZ8sGqw6:JRaN+j+5+RsqGGuPdFZ8srw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695591239, "uuid": "69d6a0c6-7b5d-439b-84ff-0f0075d78d88", "value": 277368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695591239, "uuid": "6316c3a7-ffda-4f86-9a3d-c7fafde622ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695591239, "uuid": "f60cb06a-4f66-4793-98c5-f90ba53edcc2", "value": "SecuriteInfo.com.Win32.Evo-gen.6911.8447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b3075c-5a90-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695528615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695528615, "uuid": "bbc2300c-a7b2-4b18-9f95-05c297cd9e1b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "76490639a43c163b56877e94e02089ee", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695528615, "uuid": "3cd8ab79-a3e2-4a86-85e6-3f5ca8377b95", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "6042750601f306da06be132a49ba9ebce890c6707b43b9476dee1bb23e694bd0", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695528615, "uuid": "322ba2c7-2aa9-45b5-9bd4-31496ab92106", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c0789d891e5ae9ae7762707a4079f67607e9ae4e", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695528615, "uuid": "d9fd3138-df4c-4c3f-97e7-1be4ae678172", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9ae644e3e38e9e717790ac9c2a8d0a13d4ed05a1d45cd85f9bb9f1bcc8bc0729b327ee918fadafa79842fb7aa88ca11a", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695528615, "uuid": "15bea8df-4558-4b36-8ac5-b4b013862ca6", "value": "T18134AE0074E18472D472B53609F4EBB65A3DB9600B519DEFA7D40F7E8F312C1E632A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695528615, "uuid": "e11060c5-a6b8-4cbf-baba-63601409eb6c", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695528615, "uuid": "4562f8c9-810d-490a-9521-a2c72de24efa", "value": "6144:kL46fuYXChoQTjlFgLuCY1dRuAOG5u7Sw8y0:kUYzXChdTbv1bu2u7Sw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695528615, "uuid": "b4cd77a5-91e2-4e15-b7ac-48052602320a", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695528615, "uuid": "0189847a-ddc0-4f69-ac36-21077e1a5ffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695528615, "uuid": "bde68ed3-23f6-4df0-97a4-e6af9e2780d6", "value": "76490639a43c163b56877e94e02089ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e50b4e-5ae9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695566761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566761, "uuid": "1c04850b-92ac-4ec0-a0bd-b9e707f651ab", "comment": "Malware payload (Gafgyt)", "value": "3e8985b94360c76e49bef25543e017c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566761, "uuid": "b1d3e3df-621f-461c-ab44-5512e1faa945", "comment": "Malware payload (Gafgyt)", "value": "60a3a789244235293c3064d39aa046251a7a90877e540e63610b317ad8e817a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566761, "uuid": "2eae37a1-49f4-446a-94d4-aa7f5774fc1e", "comment": "Malware payload (Gafgyt)", "value": "b0a2759d6c2c3f5b4cb7d4870ca58644690c8546", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566761, "uuid": "1eca0c71-998d-4b19-add8-bf60c4520e61", "comment": "Malware payload (Gafgyt)", "value": "31e337f7c9a154279445f94fd89b7632b8fa8030408e79daabbaa9e3f210a1ef01466c624006042538ec5740d4a799e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566761, "uuid": "16ce783c-55c2-4b65-b201-dfc0cd2cb2c2", "value": "T1F1D3951BAB618FB7DC1ECE7306AA4501208DE15A12D96F6FB274D92CE78B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566761, "uuid": "1d4e723b-9b9b-4f0d-b8c0-a69db08f40d4", "value": "1536:JdbeT2Udm+cWHcjcNMNMZHWP1ZElgX3MFIt8Gh7bFvA/mGo+hFCHhnfuel:JdjUKcN4MVla3j8G9VA/mG3hFCHZfuel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695566761, "uuid": "c9c84fb6-8a22-4678-b249-b06c54a8d06a", "value": 133003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695566761, "uuid": "c5e564f7-3e7e-4b25-9abe-13f12d1b92d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566761, "uuid": "0ffaf63d-1715-494c-81e9-8b5c450c2987", "value": "m-p.s-l.blaze", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f685cd-5b09-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695580485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695580485, "uuid": "2f273e96-ce88-4021-8479-b6890e77f41f", "comment": "Malware payload", "value": "41449601ef825a3d43bef5e4b860ba30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695580485, "uuid": "bb1841bf-fd48-4cee-a584-3ef3951d17da", "comment": "Malware payload", "value": "646fa4e0ef8ff0b0c5f56727851906f0e8bdebbaccb7b5a328747a11deefbe6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695580485, "uuid": "1ca1d360-9812-408a-973e-53ddbb88ed17", "comment": "Malware payload", "value": "99939c0c5e431d26677aaac1931c5cef81b68847", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695580485, "uuid": "7241f611-1826-4929-973b-3a6a921d53ca", "comment": "Malware payload", "value": "a9a0b14fcb4ce455f4568d48e6c48799e6facf1f37d2732b3b55446bbf47aac0e317521101bfe83cbd7a40b018452f91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695580485, "uuid": "801a52d1-4d51-4c55-bc45-18987badb6f5", "value": "T1FA03F1CF48E87DA6EEBD86BC519E2381B981304530885B5F73C5CCB4727E80B15DA9A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695580485, "uuid": "7cd81ce4-0f0c-4158-8844-8676a9d4bfff", "value": "768:UnYrAiIsj1JXjNAY/nAAiOFr7r9Zui06jfAnpItUkphiYj7Qzjue6vWMS:HAZazTNAwVrzZlMkpZj7mp6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695580485, "uuid": "aeef1c24-e20e-47bf-9c3b-06b423073acb", "value": 41284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695580485, "uuid": "0f10fd81-a77a-480c-929e-c9f961483359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695580485, "uuid": "6ef547d1-3a6a-47a9-a914-f367746dd311", "value": "SecuriteInfo.com.Linux.Siggen.9999.3467.30715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941f276b-5a8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695526173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526173, "uuid": "31673f65-fd83-47ad-be4d-ad98794ac80f", "comment": "Malware payload (MysticStealer)", "value": "bb74af113c7a8dd66fc99c641bf6beb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526173, "uuid": "b497ab40-2e01-462a-af46-e26852ed57b2", "comment": "Malware payload (MysticStealer)", "value": "6489251a000df2cdccdadbcc95c3434f8484b11c3c653dfa0c9c29bb03aba49f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526173, "uuid": "f4021bb3-cd65-41d3-b4f3-eb8778f68b4e", "comment": "Malware payload (MysticStealer)", "value": "ebd33b77cbf182b2eeefc086ae7f7c8ad2a4f467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526173, "uuid": "90b80f2b-bafd-43d8-9d5c-c82904d36dd3", "comment": "Malware payload (MysticStealer)", "value": "36cb0d66d6e3b2ca33d472f5b700d2534d6180447ddc7ff83bc222c1922102d450ca671f183c59f3efb8b2aedf7624c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526173, "uuid": "4ab6a7c3-9e47-4789-bf06-97c63cf06556", "value": "T1FD84C001B8A0CC71C572163906F5BB764B3EE8614A5789EBB7E80EFA4F612C1D132776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526173, "uuid": "c1dcb5d9-a44b-48b6-80d8-54b8f26bbee2", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526173, "uuid": "56f4782b-22c5-4db4-8bac-208b04454c32", "value": "6144:1746fuYXChoQTjlFgLuCY1dRuAOlef1ZqIkeYlJ2Hfmiw8y0:1kYzXChdTbv1buYClJww8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695526173, "uuid": "7a452733-f937-4828-993c-8e8ffd0c9028", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695526173, "uuid": "8155016b-8b72-4adf-abc5-19b00bacfa6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526173, "uuid": "2f6ca4a1-a8d7-4eb2-9443-09a5d926c0de", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.17541.13050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f00a0b-5af7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695573154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695573154, "uuid": "1e60f888-10ab-4034-bf5a-24567f5b58d3", "comment": "Malware payload (MysticStealer)", "value": "aa5dee2bf8dbcd38228798a6f88ba535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695573154, "uuid": "1653481f-0713-492e-8565-873623aeceec", "comment": "Malware payload (MysticStealer)", "value": "6582f18f0822d4a4f7f68e165d82f1961a0ba63d4110065606d21ee8e97d27e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695573154, "uuid": "2c54c466-5abf-4205-b8b7-f77fdd85ac35", "comment": "Malware payload (MysticStealer)", "value": "06a5fcd142f535d72d6d6841ec2f0d112a1d0c97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695573154, "uuid": "9e870204-5209-4a5e-aa85-bc149ee7a8b9", "comment": "Malware payload (MysticStealer)", "value": "1740f9aecfdbea80e8c6bec0069cee0298de572d6bb6dcba2e5c838a0cf2ce20a49206f9439cc4f57b04162db622da3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695573154, "uuid": "71b97dda-096a-4901-a458-752403738692", "value": "T1E484CF0074D185B2E432D27648D5DBB14B7EB56103020BEFE7590FAE4E90FC19FBA66A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695573154, "uuid": "61e49421-e785-4410-992a-872585bd047c", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695573154, "uuid": "6da9d1ee-1266-4c1f-bd6c-617a7ce85643", "value": "6144:9NUczbqW5XJ6EDOpvOCm5MKuAO06LxzTb4TP8XH1Ovy4xJwh:9NXfqW5sEe25u2Q54IXKLwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695573154, "uuid": "e2e0c7fd-f37b-405a-90e2-936e1b1f661b", "value": 405880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695573154, "uuid": "ad769246-2c66-4d95-ac91-03f83da72822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695573154, "uuid": "c3697399-dd06-4910-8c34-5f7b517eab78", "value": "SecuriteInfo.com.Win32.Evo-gen.14211.20713", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073e9d6f-5af0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695569745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569745, "uuid": "c1018646-850d-40a8-ad76-9cb1b23b4929", "comment": "Malware payload (RedLineStealer)", "value": "5920b4c984296b78b7aa8bac26704fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569745, "uuid": "4e4e78a2-7192-45c8-b7c9-c7739441e2ae", "comment": "Malware payload (RedLineStealer)", "value": "65df6b05b9779b892aaebe2e07360ad6e7ff8976ec857cf1334764e1c8652e6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569745, "uuid": "6a163f45-43e7-4f3e-867e-8250e9937bb5", "comment": "Malware payload (RedLineStealer)", "value": "983a6024fadf42734d7ed6e5b6d035b17f980163", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569745, "uuid": "fa6bbb07-38f1-4582-a9a5-0c27a2adbe09", "comment": "Malware payload (RedLineStealer)", "value": "8e7804d698bb1c5dc5986b5d75e5245d34c8d336d733e02cc4148a75992b0dc06910c7499adfec633262b3ae63ab6d7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569745, "uuid": "fb48659d-a68c-43c8-9842-f9a563f50ded", "value": "T1DC945C026CB19166C4632D3601E1D67F2A6EEC204FC606EB67FC9B3BCA533D1D2A1675", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569745, "uuid": "af939649-fa47-42c7-b6d0-c46daa46cf89", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569745, "uuid": "a7ad93d3-8321-4bfa-9114-bbacc42e9099", "value": "6144:/9+hvxIcPJL8+5oprOCu5yzuAOaZJEcCC8cWKdSgmNE9qwq:/9IpIcPy+a6uuAZJETC8cWKggmNEMwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695569745, "uuid": "8eaa0f2e-eec0-46a9-b4a1-83e3161be414", "value": 422856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695569745, "uuid": "9408a2de-a862-4ab7-b019-70b37282812e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569745, "uuid": "fece9ae3-39a8-4899-be27-f31ad9a84076", "value": "SecuriteInfo.com.Win32.PWSX-gen.394.6970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99be3177-5ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695566125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566125, "uuid": "7c8404af-09a6-4422-942d-33b64d9e8859", "comment": "Malware payload (MysticStealer)", "value": "1ffd37156bc81a034f959a8abaf2c621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566125, "uuid": "f0866338-43d0-47f7-8ae5-f0dfbdd9ef47", "comment": "Malware payload (MysticStealer)", "value": "66fcbc50ae7ad897070b0c5219518239917d899fdf67b66b146557f1cdb051b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566125, "uuid": "2d59f181-4a01-4778-9806-d695d90182e5", "comment": "Malware payload (MysticStealer)", "value": "4a09cac4b7f73c9e5796c3b491f5274d7004290b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566125, "uuid": "9ec5a93c-280b-41e6-8be7-e3dfd108fd61", "comment": "Malware payload (MysticStealer)", "value": "c04351997a608022c5d72a046b1b3955291c1ce0a9ea02a082812637bfc8bb3e98381d053a725590669ea1abb485b824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566125, "uuid": "16638398-8926-44cc-9496-1018481d22d0", "value": "T12C84CFA0FA83C8F2E562AC3245D5EFBB567DB630476141FB3B901E2E4B206C0D5356A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566125, "uuid": "516fccba-264f-4a28-ae15-a68c2b345d37", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566125, "uuid": "2f84f686-f124-41f0-a481-79ebb6a17bab", "value": "12288:INVdqW5sEe2uuzUe8TwUqqZfoxZMvm8joG5lAYdVoXATyAwh:INVt5vwPIxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695566125, "uuid": "05430306-3ab8-4870-92da-d3cd904ce1d5", "value": 405880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695566125, "uuid": "26dfced5-1d6c-4716-af5f-6471f364b2ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566125, "uuid": "87d946f8-7076-4062-8873-950c97ae066d", "value": "SecuriteInfo.com.Win32.Evo-gen.1056.5397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7ed1d2-5abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695547526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547526, "uuid": "f2441d0a-d74f-437e-be56-7c81e7316966", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b9a2f78c4fd174914825bc4562a185bf", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547526, "uuid": "803030aa-900d-4b2e-9c2c-4d77c4c595c9", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "67313788154133bc4fcabf7c9686ade68061379f0c5b509a9e20bf07e5645941", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547526, "uuid": "acd0d2c7-cce3-4004-9b5d-0828bef436d8", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ee3abbac2b37522da2231ce5d4327fa554fdccb1", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547526, "uuid": "e18c3e84-43e4-400b-980e-d19877085585", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "079f59098bc6d347138cc61f21528af5dbb4671759594424150dfb579d3b8ad217b930b58cb4a80eb405cb3ef20f5275", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547526, "uuid": "696ef240-7706-4e9e-8886-324b07ebfff6", "value": "T1C015235216EC80B3D9F65B7448F622971B39BCA0AD7987632309E95D0DB3AD0E532337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547526, "uuid": "89b66de5-585a-4a56-a5f2-882d4eb5334c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547526, "uuid": "a4a4a079-d811-4161-b2fd-238ab59c775f", "value": "24576:YyyNiCt5w4wjxZo4zqMJLWU7xCpgvquC:fyN3tbwj7o4W4igy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695547526, "uuid": "9d021c67-4abe-4758-be3c-a09b1ce43fa1", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695547526, "uuid": "5c00c74d-57fa-4625-ac6b-af3713185d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547526, "uuid": "b39f9865-cda1-4eaa-921c-ea7df062ecdf", "value": "67313788154133BC4FCABF7C9686ADE68061379F0C5B5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da43b38-5b35-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695599579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695599579, "uuid": "94e3cc27-a966-4130-b708-9aed404f098f", "comment": "Malware payload", "value": "bcacc8bacd767fda9f0f034f4b5301e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695599579, "uuid": "c395bed9-cdf8-436a-9535-677732d4c79e", "comment": "Malware payload", "value": "687db56c8db748eb1572becb7ab6965ba572f69bbd68a8be0dbad82ff63b3ed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695599579, "uuid": "91937a92-9530-4c64-b79b-f9399e30926c", "comment": "Malware payload", "value": "4bccebaa1dcb916fe0852f3b9d216420af9344bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695599579, "uuid": "ca59c61e-658f-4955-bab2-12c7a8e3d7d0", "comment": "Malware payload", "value": "d37cbd0724199d82e441b2c6b6aba3f15506eea7418608437b3f219bf5cd8384529fedd5222e15acce9428e40a92ee5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695599579, "uuid": "fcedfaf3-d574-4e9c-b407-9b7bbb11584e", "value": "T10684BE04B9818032ED6211300DE4DE7A8F3DA76207944AEB6FA51E2DCF64ED1FE72759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695599579, "uuid": "2f7bced1-6483-4910-8a1a-fb159ada16da", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695599579, "uuid": "d65b8482-0415-4e88-8133-74abcc630398", "value": "12288:+NjdqW5sEe2uud4Hqnt+54mzT+fmFFjrwh:+Njt5viKt+5dUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695599579, "uuid": "28e0a89b-e10d-4422-8ecd-502b65f14807", "value": 405880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695599579, "uuid": "851fe872-1cee-40d3-b3fb-e5d5da7afa50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695599579, "uuid": "0c577c36-7548-4ea1-a856-8809b601f4e3", "value": "SecuriteInfo.com.Win32.Evo-gen.6254.14670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43164c0-5ae8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695566680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566680, "uuid": "afcd2a0f-9d1c-4e10-aa6d-af048f76d127", "comment": "Malware payload (Gafgyt)", "value": "d83f941be4e96bb0cc1f8739caa84c82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566680, "uuid": "5b20bd36-010e-440e-a6fb-b34c32d83728", "comment": "Malware payload (Gafgyt)", "value": "68c5bb8ba328c0020bf8d2b7dc5325b6cf4f6ad346aaa6deaff69d08811f63a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566680, "uuid": "69ad9591-accf-4897-a0a4-74faccc8beed", "comment": "Malware payload (Gafgyt)", "value": "d771c1b1cc907bc2f954c861e356ea254efeedab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566680, "uuid": "ea0f2da7-1bd1-4065-a58a-3c0a0b94b67f", "comment": "Malware payload (Gafgyt)", "value": "fe3fc8b5528d24eec27cc673c074a800dbc76d6bdcb7f0b94e31d23025a2b5dfb267eb2087b787f52e694a64e35e711e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566680, "uuid": "a02f19be-6b6b-4aae-b1a6-df689c035e73", "value": "T161934A57671D0B43C49BAAF12DB737F0C3A9F97112A65280660DBFC40372AF06526FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566680, "uuid": "680dfadb-2a67-4929-bbd5-732dbb25b4e8", "value": "1536:kQhEMOa8BUy8298nML9Ct0kxge4KFXBbm1EGVjtIhUTLbl:kqjH8qF1nML9CP/fbmuGVjtIUTLbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695566680, "uuid": "5fc25531-2456-4a7b-965c-d78a498f01cd", "value": 97112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695566680, "uuid": "ed1b1208-eb6f-4dde-a6ab-c03fc72d1e12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566680, "uuid": "1d1ec3c1-cd0b-43bb-a316-b3dedbc778d2", "value": "a-r.m-7.blaze", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc56946a-5a92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695529784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529784, "uuid": "e4625037-a2b5-41f2-905e-055d0f129324", "comment": "Malware payload (Smoke Loader)", "value": "f4701be9031ce888ca113b5ce760c63b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529784, "uuid": "212aaf75-b96b-4fe9-85e9-4f0b883c4272", "comment": "Malware payload (Smoke Loader)", "value": "68fcb54bf0b225c17e07412a1888465d3ea10d56a522e1e732967ae7d57afc36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529784, "uuid": "22912139-ffbf-4c57-9acf-ce9d989eddf9", "comment": "Malware payload (Smoke Loader)", "value": "fa4b3bfeb14fa8755437fbceb57733107c57b7b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529784, "uuid": "eb902b3d-767d-4d14-8699-7493946914c6", "comment": "Malware payload (Smoke Loader)", "value": "80a1d5e7fb7ce3079a9f1496d9741d7944469fee3ca38584450c57223f67d4608faccbb193d0e41673283d5d94daeab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529784, "uuid": "9e1b83d5-378d-4c77-bbfe-e126653ad616", "value": "T17F349D01B7E1C472D472153209F0EBB65A3DB9604B619DEFE7D40F7E4F202C1A636A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529784, "uuid": "3787679e-003d-41fc-bfa5-564ac6bbd79d", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529784, "uuid": "e5bcfb62-e5ad-4b3d-b65a-5f9c75e95b26", "value": "6144:dH46fuYXChoQTjlFgLuCY1dRuAO7WN0Lvw8y0:dYYzXChdTbv1bukyvw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695529784, "uuid": "d0e036ea-858e-42b4-a518-3ea66e469fe9", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695529784, "uuid": "81d4a946-8563-466f-808c-933cfb999e31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529784, "uuid": "b8be9a20-fcba-4d6c-a0d4-ef1d1908a76a", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.30143.20432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b887c2c-5aa4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695537137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695537137, "uuid": "8c5556c3-386a-4ef0-b6e1-fc7537ede255", "comment": "Malware payload (MysticStealer)", "value": "02448dbf00d1a8bda6765569163be0d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695537137, "uuid": "6e55fef7-c4c2-40a5-87e4-9e7ba273d983", "comment": "Malware payload (MysticStealer)", "value": "69bafbc99f2eb926806f5b08c251815b9e0a26f7ebf035cabe5e4b6cdbf71caf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695537137, "uuid": "f3267459-96be-40b8-9745-158077494f71", "comment": "Malware payload (MysticStealer)", "value": "87fd9397e90abcccb2c3865b97bad9d4492dc568", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695537137, "uuid": "18eb5085-2f38-477d-b0c6-89f04553bf08", "comment": "Malware payload (MysticStealer)", "value": "9ae4c8c0854806b1d63eb7f646dfb919f13f6452d2f9e39a3e6a05aad97c1697daf95e8caa941e91a631d9b4af46daf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695537137, "uuid": "635b1403-a519-410b-9e99-caae3f1758eb", "value": "T15984C01CB5A24032F0B2783017F5AAB65A3D75214B9248E797DC0F6F4A316E1E63E74E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695537137, "uuid": "6f6a110c-bf89-46d2-b9f4-0ac20b7344d9", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695537137, "uuid": "baf0ccf4-90be-4512-8d43-589336d0a670", "value": "6144:io46fuYXChoQTjlFgLuCY1dRuAOyfQC9rJcJ10h4KYw8y0:iZYzXChdTbv1buor81dKYw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695537137, "uuid": "642a2cc3-d9c4-46bd-95bd-1c5a83703825", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695537137, "uuid": "4d060a5b-b05f-400a-9704-3a71c8e7fd02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695537137, "uuid": "8f8a7d2e-947d-4af6-8ee2-6326911731eb", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.3867.24962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e97f3a-5b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695587694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695587694, "uuid": "0e337ca6-f5f7-460b-aac4-7fc6bf234afc", "comment": "Malware payload", "value": "a7b133bfbcd29e1a79a5077c8b2f468b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695587694, "uuid": "6a823ee1-4ee1-42d2-a6b3-3cc385100746", "comment": "Malware payload", "value": "71f277fda0260a2c642ff1beb54929700c1a1eaa54898e841ec911e9fe8fc1dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695587694, "uuid": "dffdae39-fe53-429e-bc56-8148d9606bea", "comment": "Malware payload", "value": "bfd15d487b048d7462e4adf6e2e3d1a6b43f0337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695587694, "uuid": "47856ece-7491-442e-9fc0-da1aa3489fbf", "comment": "Malware payload", "value": "a9b9eeb2af5c40cee3cc6b6f5984bbf2675e834d8c459b9b7c4c15653ee4fb0b795acaecaa45635ddf4344eaa632ef17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695587694, "uuid": "84be5843-85ea-41db-9db3-28899bd549f1", "value": "T1F944AE00B4D18472D472113309E4EB76DA7EB930EB519AEF6B940F7E8F706C197316AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695587694, "uuid": "3e7a6b4c-e4c5-4ee1-a759-c0c4eb01307a", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695587694, "uuid": "0bcc35b9-0b56-4b40-bebb-0295e8fb47a0", "value": "6144:WR7cMQ+j+5j68KsT6h/OCy5UKuAOpgep8ePwK:WRA7+j+5+RsqGhu4epVwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695587694, "uuid": "d604afdd-13dd-4792-bac4-b456e036b17b", "value": 277368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695587694, "uuid": "738f5c3b-3b0c-4c22-aa28-890b7e24c436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695587694, "uuid": "1d0613a4-731e-4e75-aab0-b27cc57de013", "value": "SecuriteInfo.com.Win32.Evo-gen.7071.18285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc3cd41-5a71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695515448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515448, "uuid": "093f113f-5f23-4602-a946-6e06576d3064", "comment": "Malware payload (Mirai)", "value": "ed54036856ee72bffbfb8463dabeac42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515448, "uuid": "aa31d71b-8e92-409c-b9cd-1392c818489d", "comment": "Malware payload (Mirai)", "value": "72aba86bfcd5d093d1419160f46e932e26f183671f4e02a4054dfbd4d3efb77e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515448, "uuid": "e19f73a6-2f89-4996-90c3-a1f9fccd1619", "comment": "Malware payload (Mirai)", "value": "024768953d9bbdf99dc9e1e70b5595d6c004f2cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515448, "uuid": "5c0de5bf-50a7-4f6e-8358-27e21225e0f0", "comment": "Malware payload (Mirai)", "value": "c2e9c6f80b0bc80353b30106531393040a7430bee65054c60d1e432705f34f3abcbf8d66fdc5f38581b8ba84c8811157", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695515448, "uuid": "f468b614-d360-472f-9ff7-536ffcfc0867", "value": "T1E4E2EA46B850D157C9C50B36BA0F43993B329301E7DB33029A2BBFB19F17B2E5E66254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695515448, "uuid": "85ec7ea3-f55d-46f8-a1df-5085b90deb6f", "value": "384:CMFxwfvmbDouNRFsPnOqo6GGwFBKGDjFx4ecrMUO/XyyFPvAT0njUSVf:CMXwfuVGvOqPP2KGguymQ0nIIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695515448, "uuid": "8459310c-9c31-4d00-9b13-71a1c2219521", "value": 32604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695515448, "uuid": "6a2d1dd0-86e6-4bf7-9b6f-edf369ba9656", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695515448, "uuid": "d8e1fbed-69ea-4d50-9015-fe700305f231", "value": "SecuriteInfo.com.Linux.Siggen.9999.2468.12862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13762669-5aca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695553445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553445, "uuid": "197684dc-677b-4950-bdc8-08cc0272f238", "comment": "Malware payload (Mirai)", "value": "6aaf24466a6758f8532898065329b67d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553445, "uuid": "a486d072-4003-4f6e-bc20-26f3b3fd2e1e", "comment": "Malware payload (Mirai)", "value": "74cb1ec872d99b9649783646153c10ecda6330ea1af640bf3facd69fda9d490c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553445, "uuid": "b1374bfa-84d9-4c51-8214-c679f3c670a2", "comment": "Malware payload (Mirai)", "value": "5b8748fb35059be4506b9739bb9c5c72a0f718c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553445, "uuid": "2db2753e-d510-4a84-85c3-29ea9a17c236", "comment": "Malware payload (Mirai)", "value": "9c7a1afbeb228f2b27c3e2292f93094d0a67f36f324c1bee28da8668642d78c8afee7e77ca2089ac0a46f3867fcd0fbd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553445, "uuid": "ca0bfe47-a66c-40fa-8eea-450be2558841", "value": "T1F7F3C80AAF610FBBDCAFDD3706E9060139CCA51722A93B753674D528F50E54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553445, "uuid": "86a4e9f8-b2fe-4786-80bd-62041af3d80b", "value": "1536:2tcrceoEWWqFQPmsp0zndTHy6UCXbWdYMLP2GfHXqZgBBTDYSLIEKSkY3onN9s3J:2tcIoWn0uhTEb24H6SrLIx/YuNkdqAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695553445, "uuid": "e45fa13d-cb3a-4761-9230-5fa016d40352", "value": 161480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695553445, "uuid": "d41327ab-93a4-4714-80e8-52d9a7365a86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553445, "uuid": "ca1e7c1a-8f68-4440-a002-fa65a2d681c7", "value": "cundi.mpsl-20230924-1104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9911ef1f-5ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695566124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566124, "uuid": "fa2dc182-42ba-4997-b445-16cb30da53fe", "comment": "Malware payload (Smoke Loader)", "value": "f941aa766b846c76e92585dd358b4e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566124, "uuid": "d9e157f0-9105-4d88-b4cb-a9f0cebad3ca", "comment": "Malware payload (Smoke Loader)", "value": "76a72f4fa55c951338203687da6663bc08b4aa0a06fce7e74fdc4a8c97e63e49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566124, "uuid": "3fbe8668-6388-4185-a254-1c04cd32f752", "comment": "Malware payload (Smoke Loader)", "value": "d515fa2fb80f9e06047a4cbb5708794838638155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566124, "uuid": "d8c6ea3e-a01a-48b2-bb8e-00c8f9c50e71", "comment": "Malware payload (Smoke Loader)", "value": "e1507119618629d565b133812d99357eaf9aa8d17cecc3c4ac36da91115726050eaf51c66b6673835560dfa54f3ce14c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566124, "uuid": "80fed37f-e2d0-44b1-8f4a-7b0d3634d939", "value": "T1DB44AF01B4D18472D672113209E4EFB65A7EB9204B555EEF67E40E3E8F207C1E7327AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566124, "uuid": "913c8d11-98bd-419e-ae94-d1949fdc3307", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566124, "uuid": "123e2e01-e7f5-4678-bf5f-21db0771cedf", "value": "6144:ARyhrJ+j+5j68KsT6h/OCy5U9uAOfAKy9t+YAqw6:ARcN+j+5+RsqGGuqzLw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695566124, "uuid": "fa0694c3-d62f-4483-a6bf-efdc2150b385", "value": 277368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695566124, "uuid": "2dc771e7-7342-4728-a85f-3fef9417c8ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566124, "uuid": "1a850db8-8563-4e58-af68-f24454f827e0", "value": "SecuriteInfo.com.Win32.Evo-gen.31054.1608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65e0539-5abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695547812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547812, "uuid": "fc3b5062-946b-4d84-a766-e0eae302b20c", "comment": "Malware payload (Smoke Loader)", "value": "2dfa5d838324f9bd9a86bdccd1a855ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547812, "uuid": "fcb58026-f507-40a6-8b1a-5c55d20c6e02", "comment": "Malware payload (Smoke Loader)", "value": "78210fa6dc7c7e8d9ad31767e978bb97ef5e7099228762043c2ed6e0f742d033", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547812, "uuid": "0c906935-56e1-4ca1-8d81-4638575a58f6", "comment": "Malware payload (Smoke Loader)", "value": "0b2ed9b85bcea4b4dc629b8a71706f4ef8b48918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547812, "uuid": "b6ef46ff-9789-4d40-ba2a-a4e9f7d25b2c", "comment": "Malware payload (Smoke Loader)", "value": "ae632d158e0766751a7bd3b13f771494e32a826879fd1eac5261842de7b4e101ccae45b914494efe0ec28cf053dbbdf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547812, "uuid": "78ad7ebf-c2c5-4c2e-8b49-d70c7d31ae81", "value": "T145348D0175E1C472D47215320AF0EBBE5A3DB9F00B5199EFA7D40F7E4F206C1A636A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547812, "uuid": "38535030-d2b7-49e5-a555-c71903155701", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547812, "uuid": "a6723094-df6b-41c7-8584-f9631b0e3164", "value": "6144:9Q46fuYXChoQTjlFgLuCY1dRuAOneE8Kdw8y0:9hYzXChdTbv1buDdw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695547812, "uuid": "1a8ff11b-be81-4eba-8b15-15e9049e8048", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695547812, "uuid": "bc6e26ae-0f65-4aa5-8780-cc30101c42b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547812, "uuid": "26c8f925-369f-47ac-a0d7-2b2d28d0b624", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.14184.15137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4758fa-5b35-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695599580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695599580, "uuid": "fc2c17a0-8502-4f20-954d-3438a1246372", "comment": "Malware payload", "value": "3d6d23a12a70a3f32f2764d15463cf66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695599580, "uuid": "982a099c-dbe8-4130-b176-183a099e9dd0", "comment": "Malware payload", "value": "7b7b88730642a23a8839968e665d119af960929dd53e4dc51b3a633bd1ae2493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695599580, "uuid": "8772d02e-407b-4192-b9fd-f23fc0ab5d89", "comment": "Malware payload", "value": "9cd1ec5065f67b211ff5d5a5dc381bb8f7f89b90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695599580, "uuid": "a8330f38-d09e-4f10-935d-02205a74f0aa", "comment": "Malware payload", "value": "1f5f9b4821f086c34d73369760c76e416db8800e27ea03551fc490db27eed8dd06e8cf933f6c74b377c59a9781ec61f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695599580, "uuid": "000c1e57-ff4f-46f5-84e4-f7777701bfae", "value": "T13E44AF00B4D18472D472213209E4DBB69A3EB9214B555EFF67940E7F8F607C29732ABA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695599580, "uuid": "98fc566c-0b45-484a-85a2-54b127eb0e23", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695599580, "uuid": "0155660d-3001-4c72-be64-da8d5007657f", "value": "6144:iRphrJ+j+5j68KsT6h/OCy5U9uAORAUNqw6:iRfN+j+5+RsqGGuwU8w6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695599580, "uuid": "84025ff0-3749-4fb6-bcaf-7cd4e0d61d20", "value": 277368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695599580, "uuid": "685b81e6-f3c7-4b2c-b92c-cd5f67869064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695599580, "uuid": "255769d8-e952-42b0-97e3-bd0de554c1e6", "value": "SecuriteInfo.com.Win32.Evo-gen.7934.3402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53eefb0-5ade-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695562333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695562333, "uuid": "6ef357b2-ee64-4c08-93b1-008e7508be0f", "comment": "Malware payload (MysticStealer)", "value": "027c7b637cd1debc7d4f071fe92b0f86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695562333, "uuid": "a1f0cbed-0ad7-434a-8274-70f8b61b4725", "comment": "Malware payload (MysticStealer)", "value": "7c14e7bdc43e28f6bcb11e41f3519f9bae7c4cd8e5384c9edd406dd2032b93ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695562333, "uuid": "f0f8665a-a543-42d9-a13d-a2dd1e31d2b3", "comment": "Malware payload (MysticStealer)", "value": "9c659ec752b1d94e4bda44590833be7121c112af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695562333, "uuid": "4b80cfd6-6318-4bcc-90b2-345100390822", "comment": "Malware payload (MysticStealer)", "value": "44231ef19285e9f567a352b2ea970b31eb83197c59a4cc2df6385baef9a074240f8a2d400d05b28de495ade288fb1f4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695562333, "uuid": "0fdff654-5086-42df-9033-25fd5a87b6f0", "value": "T1B784BE2274D08072D0211E3745E7A7BAEA7EF8A0535D5BCF63851D2F0F217C09BB966A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695562333, "uuid": "5ca9e697-4052-47f0-ad8a-aa5fa5535a02", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695562333, "uuid": "26512170-f286-49f8-af90-9d3f348e7cb1", "value": "6144:eNzhUOqW5XJ6EDOpvOCm5MNuAOvp1gfuzw5f1A23ac3LAD7h5tRqwh:eNddqW5sEe2uuldUBL3ac3Lqcwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695562333, "uuid": "5ee3fdc7-e75e-4f8e-a40b-100ec6d45575", "value": 405880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695562333, "uuid": "9c382373-55c2-4b83-8546-6598e170a048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695562333, "uuid": "a45584ff-9434-4848-b672-fa9ba44086a6", "value": "SecuriteInfo.com.Trojan.Win32.Injector.20257.49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165086ab-5a92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1695529398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529398, "uuid": "c1d947b5-b6c9-4797-98fe-37e86b7f6eff", "comment": "Malware payload (Stealc)", "value": "069c493244696df21e87b7cb7d17cc29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529398, "uuid": "dd140dad-c518-4c8b-a1db-b9aee4a4b7ec", "comment": "Malware payload (Stealc)", "value": "7c59665549676d552743527a5a96383abe8605c1e7bb2556ca32013ba9206c16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529398, "uuid": "d211bdf5-5a31-4ba3-b978-f9ab6a7144cf", "comment": "Malware payload (Stealc)", "value": "6fbbd71ce8c96022e321952abcae9e155013faf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529398, "uuid": "33007a10-8c9f-4612-b044-53e7f199ea32", "comment": "Malware payload (Stealc)", "value": "0b55daf94bc94eea2f0cca2b7dd4d1cc27151b5e17b22dce18d68ad73cc2e6abfbbc0959a3fc157bb37fb2f986823f4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529398, "uuid": "eb9d2c48-fc8f-402e-ae5a-9644fae55a4f", "value": "T174647D1393E17C51E5768B329E2EC6F8762EF1518E69776A2318BA2F08701F2D673701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529398, "uuid": "6700ec60-e927-4b9e-aa79-6a7277c1d9fc", "value": "915313f9baf3d4fbe9e467fb8242a50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529398, "uuid": "88c0ed50-253e-4f21-b1f9-3c915fcd78a6", "value": "6144:s5pklTDkHTAHliaTVJl30FNFZPLiOpAXgke:Q6TwzAFtTVLUNFZP/CXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695529398, "uuid": "3098b204-a874-4310-80a7-412bd6bf7faf", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695529398, "uuid": "f7ad9470-a367-459f-8779-21a241821d5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529398, "uuid": "d9705d93-634f-4c11-ad86-25ecdad4ec7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd04c872-5b24-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1695592438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695592438, "uuid": "f3f65449-aa8e-4238-8a7a-8dbf5686d898", "comment": "Malware payload (RemcosRAT)", "value": "cf31a64bb72bb0fb36f226738bbfa627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695592438, "uuid": "a7236a2d-bb91-45c1-bdb9-9aeb0f032bac", "comment": "Malware payload (RemcosRAT)", "value": "7c98f8c87f6256b929262cbbd898337fc9ae80fc0a666ae0b7c6663e1308db0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695592438, "uuid": "b8e5eea4-9771-4db5-b8a9-8d3f2b5c80fe", "comment": "Malware payload (RemcosRAT)", "value": "b8105a0311ab9e96c31ddb5bc16969c403033abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695592438, "uuid": "33b44fc4-21b0-4fc6-83bf-52490a1193d0", "comment": "Malware payload (RemcosRAT)", "value": "417e7b217bbf45e7512a2cb74e8b89d30f3f1cbeff9f980dfad7cf40d0f3470e515f629bcbc6d571f9e91e09c41d1eb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695592438, "uuid": "5d379344-5f19-48de-a6d6-dd6eaea8050a", "value": "T1C21523C863D0C512D8625377EADA8AF059248DC3EC7B634B63A27E3979F34629C1D316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695592438, "uuid": "f6ff628c-6c7b-4763-9ff6-0382628ac9b3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695592438, "uuid": "69fc398c-5d2b-4e0e-aa30-1358690c95c5", "value": "24576:eq7JcjVudHPlUMMbpdmlKn99NDpKGN/VcUN/:V7ueHPGzvnWGNNN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695592438, "uuid": "7e438ca1-4dce-4e3d-8275-4a66630dbee8", "value": 918363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695592438, "uuid": "1350024c-e664-4598-8206-5cb7920f02f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695592438, "uuid": "213b419b-0c6b-4706-a638-389c68fed27b", "value": "Or_amento ARSENAL 260921_5_4808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3875f4b6-5b0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695581424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695581424, "uuid": "19e3a8b1-ea3b-4ef7-85a8-7d052c158cb1", "comment": "Malware payload", "value": "39fb8a8a40c829ac3a4fd5cd6ea473b7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695581424, "uuid": "af72cc83-bc30-4a93-91ac-b099a6cd6c6b", "comment": "Malware payload", "value": "7e1974ea77e2416b2ac75656d1e24da59de0af97815a9e337e4a7cc58f6339a4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695581424, "uuid": "e97c9e7b-af2e-4861-bb2f-04769c8be21b", "comment": "Malware payload", "value": "5930195043f8a59566d778d15acb31d3c3e5c3a8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695581424, "uuid": "0a77f99a-bdda-4c34-8e44-fafc035ee180", "comment": "Malware payload", "value": "bb4cdc6a20d125bd8d184e011b66c08262a8630dbf07f68b2a6024e346d7806c3e17685accc05c99cc371b1ec357ce53", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695581424, "uuid": "d7229ecc-cf0b-4b37-bb13-696df9b6977a", "value": "T171232A003BEDC12AF2BE5F7499F221458A7AF1672903D54E1CC4419B5A13FC6DA42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695581424, "uuid": "d03e8da7-6aaa-43ac-a568-957ba5856682", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695581424, "uuid": "6dd95ad3-53a6-44f9-a2fe-8a089479511a", "value": "1536:euWk5T1gi29npmgpzmyb+M/oLnOA5UtGhdIR:euWET1gi29pmgpzmyb+/Ld6tI+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695581424, "uuid": "e5fb704e-ca58-4734-ba0c-12c78eed7bf3", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695581424, "uuid": "b7641e16-c982-4f18-b7fd-f691d9260ba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695581424, "uuid": "131a463a-fc69-450d-9e9f-240a52509057", "value": "setup.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6f0b58-5ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1695545841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695545841, "uuid": "4dbc969d-ab8a-44bc-8276-5d1ca1280873", "comment": "Malware payload (MarsStealer)", "value": "84e957df7e77de3f3899e20e49207cf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695545841, "uuid": "ab081949-2fcb-4b3d-92b7-b1711e2bb99f", "comment": "Malware payload (MarsStealer)", "value": "7ea53efe7909227d8d1c3b96df3f2194947459d09d6168e629dd1d089b3a9c42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695545841, "uuid": "f0bda118-cb54-4e61-8db4-661fc9c2d1bd", "comment": "Malware payload (MarsStealer)", "value": "7aed17df6078a860b3eb8339390238ce8830067b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695545841, "uuid": "8a0b72c8-95ef-4f0c-87a4-5d1ecb0a7eba", "comment": "Malware payload (MarsStealer)", "value": "87741d77679016191faecdadd03c89b0240f391c67d7b6f5666a24a0b7fe2a63b34147aa0f0c678cbd7ffd0e97fa6f21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695545841, "uuid": "f8affbf8-e780-4de9-89a0-76dc84371224", "value": "T176646D53A3E17C60E5764B719E2EC2F8762EF5208F69376A1358BA2B05B01F2D273711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695545841, "uuid": "a62c72b2-7253-4c12-b070-5c2b5a1f3a6b", "value": "5208e0d407d61105b978bd2c2254eb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695545841, "uuid": "14914f7b-addf-4f85-8f7f-810037f54271", "value": "6144:0z4/KDikuQ4KmMURPlqeeR3e/dOd6/NP8dnfIW:ChDll4WmlqNR3m4oNAn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695545841, "uuid": "1b8aeef5-c7a5-437a-835e-32b502a0c997", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695545841, "uuid": "d82acc2e-20ff-4bf6-83ba-5035c0979f10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695545841, "uuid": "a621edee-3f8f-411d-81ad-50191dd91b3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe6395d-5ac6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1695552036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695552036, "uuid": "3400fffe-358a-4d94-bdef-787e6e70eff6", "comment": "Malware payload (RecordBreaker)", "value": "ae0e84b1c471528048ec59658ed69bf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695552036, "uuid": "723bbaf4-ebfa-4d5c-a15c-508103dff5d1", "comment": "Malware payload (RecordBreaker)", "value": "808b9cff96c4777439f0e8e8fe1be539ab290fcd7e1587d51d151cbe162231e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695552036, "uuid": "39285c1a-69bd-417e-b846-122c0bcf3285", "comment": "Malware payload (RecordBreaker)", "value": "bc10c0e2f4ab83dbf6d33aa66c36c0c43fb53bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695552036, "uuid": "435016fd-75b3-46df-b7a8-34eef665d022", "comment": "Malware payload (RecordBreaker)", "value": "72a91652ea438a15b9dc4efef97029c8178b21ff1e7978f4600db675cb69f0571e48c5fe9dc7c50429eda17213d7ec5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695552036, "uuid": "edd0ca0a-0222-4f00-8568-8ade2c9b7132", "value": "T16F46122232E2DC37D79A82B04172CA911FBB395F57B850BB37541B2D3F605914ABA316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695552036, "uuid": "fb96b0e1-b1b7-414b-9ee3-aaf57545e7cd", "value": "5b554c388a3c865e206967d272cdc3f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695552036, "uuid": "1604972d-7f3f-454f-a52c-0ebdbc7b011e", "value": "12288:0DPXTL6tR7OV10FFJffqnru9VbYXguLOG1jlSoi:0bjkRSV10FFJKnr+V4gAOY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695552036, "uuid": "5605e2bb-bfb4-4820-a772-97dccd689a78", "value": 5562880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695552036, "uuid": "17a8da9e-d4cb-464f-b348-df3999ed6d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695552036, "uuid": "4b16968f-dc2f-47ae-ba33-0aa9bb2a1772", "value": "ae0e84b1c471528048ec59658ed69bf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d1e0a4-5aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695546771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546771, "uuid": "ac17b2ad-edb4-42b3-b542-76aaa0aa3387", "comment": "Malware payload (RedLineStealer)", "value": "e447780a3c76ad3b5e7c28d8eb9c8913", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546771, "uuid": "a0b68d24-1853-4c39-acb1-465fd563eca4", "comment": "Malware payload (RedLineStealer)", "value": "80b5e9f3d1d8cb3215e50040ba4c6341bd1f20db1f6779f509ad93ee33891acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546771, "uuid": "d3811ff4-b9cb-4b60-8d70-068fb3218df4", "comment": "Malware payload (RedLineStealer)", "value": "2a8a38d1a4b9a467fef7104a9fd2da58b0c6ac9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546771, "uuid": "2405566a-ee49-416a-bcf0-6019df7bdd1e", "comment": "Malware payload (RedLineStealer)", "value": "fda6f72a89fc28bd12b179aec1ba349e74f98b45e0f90b7b3825a3a78396224df4f74694b5e03d692cf48b05b6897a41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546771, "uuid": "ee4ac280-b09a-4b6b-b8da-e2ff042f15af", "value": "T16BA4C003A3E17C51E1768BB19E2EC2F8372EF5604E5977AA2218BE2F04B11E1D673751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546771, "uuid": "dd39a773-f261-4756-9b87-8a5bdcf9379e", "value": "5208e0d407d61105b978bd2c2254eb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546771, "uuid": "4507e126-a15f-4aa2-9fb4-3eed7da6399c", "value": "6144:C1LUDzkXbc2zWOQB9VR0WuxHm+9v/5mt3IoX/jzb1rZNTE6wLQC5fTkxf/na:CCDgrcHTnVR76hm1nPvhrLTA/52Xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695546771, "uuid": "ce477a29-914c-4c1a-a177-4fa0d463aa77", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695546771, "uuid": "901884e2-c3a9-43fb-9845-698866cd6ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546771, "uuid": "16550020-465f-4f7d-a32d-2daaf22d6856", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c434fd-5ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695559817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559817, "uuid": "67ac21be-607d-4a2f-97ec-a219c6334f57", "comment": "Malware payload (Mirai)", "value": "d6c011c433b0530351fc4e9c04df2c3e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559817, "uuid": "82902c62-5000-47ef-8629-8fe697b878ec", "comment": "Malware payload (Mirai)", "value": "8616152fb84d6585377b83af2ce3892157333c995b389a87449d6d720272d15e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559817, "uuid": "e2af86d4-4828-4e44-b58f-42749e81f94f", "comment": "Malware payload (Mirai)", "value": "8c7b03bcaa46f3d44a07ab20253210de0cedf44c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559817, "uuid": "455def0f-ca00-46dc-9551-e8c70879786d", "comment": "Malware payload (Mirai)", "value": "a50ea07c487fb52b466d42f054a55558939fc5e81cdabbf2d149c0a5a95910601b6b4cc4e197a5dba6b3ceb085cedbe2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695559817, "uuid": "3fcdb7b2-4a4f-49c0-9265-bfb7071a2efc", "value": "T1F8331885B9869A06C6D0537BFA0E83CD3B2A73D8E2DE3313DD196F5127CA92B0D67141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695559817, "uuid": "d82644eb-85c6-4e54-88f1-0f41ecdebed4", "value": "768:oyaeMwOjFRngjSNf5T0W3+5xmoBloZVoSrvxDpkYca/V8EjilLzd+TMt4MNlZDcL:zaeMdjFRngjSNf5TuCdr2a/GT5sW3yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695559817, "uuid": "b16eadf0-f061-4239-abb7-d2f7bde26652", "value": 52900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695559817, "uuid": "d3d1f43e-eeca-4665-bf41-3dff28e03e9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695559817, "uuid": "7a6381c2-fcf1-41b0-9510-991eb3a3fc02", "value": "arm-20230924-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ac1e20-5abb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695547083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547083, "uuid": "fd2f77ad-3940-42c7-947e-fbd9afbd2bfd", "comment": "Malware payload", "value": "79e90f5f184e81cafefacc7072e31f7b", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547083, "uuid": "c47f1e8d-5af7-414f-9822-84c7f12d1780", "comment": "Malware payload", "value": "87df66fc4ca5703a631f8d8528965437e348d87c137af08cda544108199ccaa7", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547083, "uuid": "84ef7aca-fa26-47d3-bc3b-c3291456cda4", "comment": "Malware payload", "value": "7cb9edf7c6f98130104c6fd0a970857c7e7a2781", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547083, "uuid": "3b78f860-022a-477e-a967-6b293abafca0", "comment": "Malware payload", "value": "6fbd9136bd49d6560052c33f3286edeba8671a904ab05e5d49be22048f631e3ff379f8e6d144eb85be75d9579aa4a9fc", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547083, "uuid": "a8bfcba6-5c5c-4ba7-99d3-e708fb6291a6", "value": "T1B2362311F2C9D632E5AB443084ABA311537A2C709AF0C45F93ED7ADE1CB1781E2FA5B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547083, "uuid": "904511db-6315-4b92-880f-6517cc13efaa", "value": "98304:iamwk6Am1RxUtsahuHuZ1JEZ8PeSrgm51CtTxAnOHbg1jEkeWbVWNvpr:Hmw55h+JEZ8WSUldxUOHAjEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695547083, "uuid": "5b66b99b-0e66-406a-b605-eedb9ae5a27b", "value": 5034496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695547083, "uuid": "ddfb30da-5d4c-48cb-84bb-146055e7b830", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547083, "uuid": "407b0567-713d-4db0-a737-7c08f0a4227b", "value": "IEBrowserAssistantSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd365f9a-5abf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695549005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549005, "uuid": "2baae26d-071a-472a-9fc3-30fc81c43c3f", "comment": "Malware payload (Mirai)", "value": "51c1619352336620a6e009ec6549d9ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549005, "uuid": "9c1bc0eb-1c87-4073-a4c8-3cd9731d467d", "comment": "Malware payload (Mirai)", "value": "883ebb6d820b2f829061a26c804baac9b2da01e139daccaf8035c0d95ea93780", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549005, "uuid": "904d8d60-0adb-4e16-95fb-81837b8815ff", "comment": "Malware payload (Mirai)", "value": "9929ab31241a28b9b3e6f0b226f91cdbf02d31e2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549005, "uuid": "2ad8c202-b20e-46d4-b9af-e729320a34e8", "comment": "Malware payload (Mirai)", "value": "48dc43f81e39c85c099501c1f2756ad65a770681cbc27d9e7843f9750da9aade56b211495be9d15ca99444fc7eca9396", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549005, "uuid": "071e7674-b213-43a4-a7a5-f0796f86916e", "value": "T1AA334BC59A83E9F9DC1515712173FB328B72F53E5159EA87D39CEA32BC42A01E20729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549005, "uuid": "ef9e9515-d0e7-4606-b242-50224991fc74", "value": "1536:akyzRjI9MDsdaV4E5/NX7QN4deIOo61svBe:akoNI9MDCY5/NX7QN4cIj6Kv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695549005, "uuid": "05e82332-e703-4628-939e-cbfa761ba3fc", "value": 51292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695549005, "uuid": "57e3bfcc-21da-4982-8123-01f2596dc19a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549005, "uuid": "61997867-3608-43c2-8c70-a4d2517ef57b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e22b5d-5abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695547808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547808, "uuid": "6002c674-35ca-4c1a-89ca-915340c170fb", "comment": "Malware payload (RedLineStealer)", "value": "dbfdb4a7c1a394b277f15403a7c6b338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547808, "uuid": "9332c130-7bd3-4800-bab9-36955e5c1a21", "comment": "Malware payload (RedLineStealer)", "value": "892d61deccf50da3e77e8c3c026ca5361bc75feb2765de4dc246f3638061a234", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547808, "uuid": "1d4f15a3-ea47-4e1c-b85d-8fafcd76c16b", "comment": "Malware payload (RedLineStealer)", "value": "38d3c5b77743d220970ad23d9f6c2ab41e7f0c53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547808, "uuid": "2a26901a-cdd8-43e2-a219-62911a652e50", "comment": "Malware payload (RedLineStealer)", "value": "e656c840e096ffbb520b0ee231c2a404aa3707f8551ea784ce2f5e3ef023c99480a667cb8e6eac89404df46fc7853c81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547808, "uuid": "d2c26a19-5359-4c97-bfa6-e9136f86a767", "value": "T1B2A4C01393E17D91E5368B329E2EC2E87A1EF6104E69776B1318BE2B15B11F2D273701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547808, "uuid": "bd94138e-9c3b-4fbb-8f89-9a76746af718", "value": "915313f9baf3d4fbe9e467fb8242a50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547808, "uuid": "24b05016-8006-4926-8068-731b61a031d9", "value": "6144:0tB5sTykNv7PB2vnFFBqgBYxDIW17TlGmpt2Cc7r7R/fwk:Y4T1h7snDexcW1/l/27xXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695547808, "uuid": "b152beb6-271f-47a1-92b7-b9a0d59f2f41", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695547808, "uuid": "683a3ed9-a3d7-41af-8d29-e046bc31f996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547808, "uuid": "dbae0ae0-f951-4a22-9778-4665f0c41026", "value": "SecuriteInfo.com.Win32.RansomX-gen.11006.18702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e36efe-5a8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695526171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526171, "uuid": "96ec5e64-11d7-494b-a858-7e76a980fff6", "comment": "Malware payload (RedLineStealer)", "value": "8bdacce5f5f9df798dfafd7a65ac0712", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526171, "uuid": "0b1a87fa-af98-44dc-9c18-531afeadfc16", "comment": "Malware payload (RedLineStealer)", "value": "926b994a4817aa4c1bb4a993a173ec82f112f145d406ccdfa236c52d8a48ab85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526171, "uuid": "cb6a92c9-8424-4442-b5ed-63a991f5384a", "comment": "Malware payload (RedLineStealer)", "value": "c86e098ea9a375e57a154b5930fa45843b6a7974", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526171, "uuid": "90391ed5-4cba-498b-983e-a7cf5e32c066", "comment": "Malware payload (RedLineStealer)", "value": "b651186e95ff7ef35873019c2f4e9c400fe83f200dd6ec8cda47962f58d98c1e85ff05d6a7db5ea72f3d09acdb4ffc7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526171, "uuid": "c1b39be5-9b03-410a-a6da-d938287e762b", "value": "T13BA4C01393E17C61E5368B728E2EC2E8771EF5608E6927AA13147E2F19B05F2C673741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526171, "uuid": "e1aab8c4-ed5c-45b6-accb-b2b4e8c686fd", "value": "915313f9baf3d4fbe9e467fb8242a50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526171, "uuid": "f7cbd261-efb0-4b24-8463-9bf04d173e71", "value": "12288:AcTYdxxvw4BTi1fA9NvUX8dGRFrXL41D:UhvwOevsmFriD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695526171, "uuid": "ae6474b7-0980-4393-8e3a-09428e6e8473", "value": 483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695526171, "uuid": "18b9a9c1-55d3-40e5-b108-ac08982f56ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526171, "uuid": "f371238f-0992-4dd5-a35e-97d574e6b0a7", "value": "SecuriteInfo.com.Win32.Evo-gen.20294.12709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f3edc0-5b00-11ee-a6f9-42010a9c0055", "comment": "Malware payload (OnlyLogger)", "timestamp": 1695576742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576742, "uuid": "41bffb1b-9b17-4428-b2b2-8be99f01d196", "comment": "Malware payload (OnlyLogger)", "value": "8231d2406c1fcbcb6fe8b71f6adff992", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576742, "uuid": "6cb45200-c3af-47bf-8e1a-58f4d3d24cb3", "comment": "Malware payload (OnlyLogger)", "value": "93fd64f45f9e672c1cf11d5ea78356e8fb5862ffddeb9819d8886137c87ed3c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576742, "uuid": "49f83128-be65-4ad7-831b-2ac0ccf99caa", "comment": "Malware payload (OnlyLogger)", "value": "6a2b22d35c878b152c58161d2ae63aad0268a886", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576742, "uuid": "82493dfc-bba7-4be8-a08d-0f3abda47737", "comment": "Malware payload (OnlyLogger)", "value": "95b57ca51dae7f2a20b3b9f24f297607b3d3e33005fb48fe07cdf1bbfce710d4bbb140fdba48ca7403408fae2d832246", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576742, "uuid": "ab4f6aee-d4c3-4556-8a74-800b87c608d7", "value": "T15184AF5393E0BC60D5264B329E2EC6E8765DF6508E593B6B6218BF2F08B05F2D273711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576742, "uuid": "e14cf492-903e-47b3-8adf-0ff847aef18a", "value": "2d6b4f4a9e62e7d851c0b57974ea64af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576742, "uuid": "8d00f2ea-dead-4d08-9728-3c8487bbbb03", "value": "6144:xqrN0ZBTZFLVZH4qchMH7TUx04s/evn5Z8d7jD:xY6vTL7HTTScBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695576742, "uuid": "fff1a055-7e50-4ee9-9c15-522229f8ae19", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695576742, "uuid": "81959f08-51a3-4594-b56e-ae9e0bfcc917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576742, "uuid": "d15e0600-0db3-41fc-bee4-095d5379f885", "value": "SecuriteInfo.com.Win32.PWSX-gen.22915.15940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f29de9-5aa0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695535517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695535517, "uuid": "c90ea3bd-e8a8-4c83-baba-e2856399bb6c", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b895c232e59997b1e932820328a0a582", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695535517, "uuid": "7111b4dd-e8b7-483f-a7b1-8677188b310f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "94103c90cd7762b94392f8823ba7dc9c0560e85164a7b97a45aaa02e98810998", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695535517, "uuid": "95338219-e2a5-4182-9e84-97e13d1338bc", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3f0f16db878c1ac8f7c231e60eff8e6ad3c29b31", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695535517, "uuid": "9dcb3b63-da2b-4f9a-85e1-743aeb3339f8", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c09c2674d83cf9f5582bc77cd6dd08237b2005a4b4e498bb2f535e5deecf9595238bf2e8f23aa74fe9ec862ae6f6d261", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695535517, "uuid": "2f6a2592-16ff-4468-a792-ec99a2374701", "value": "T11D1522526BF89073E9F6177045F223C31535FEA1AC38825F2B41E9BA0CB25E9A03575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695535517, "uuid": "fdc45fe5-1e40-4dc9-bdde-7be98fcb228c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695535517, "uuid": "98696959-b086-417c-a803-98dcbf85edcd", "value": "12288:ZMr7y9009n9chUa96QjZGiG7rE451wdN446Kqnchca2jQ7ucFGOM6:iyDn9cA4ZGrrEq1jWqnscak+VAOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695535517, "uuid": "479eb3e7-fd0d-46c2-b0fd-da4e2df05d82", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695535517, "uuid": "34716398-dcf8-4dc5-97f6-73f31e086428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695535517, "uuid": "7ca28113-8139-4e53-980a-87b539a03337", "value": "b895c232e59997b1e932820328a0a582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4851e14e-5acf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695555681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695555681, "uuid": "f440f820-4d31-4bc4-ba25-dee0afdaf9ef", "comment": "Malware payload (MysticStealer)", "value": "d9306b2b70c05f378640d3360e04cfd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695555681, "uuid": "3a326f47-916d-45d4-afe7-6e1a2049924a", "comment": "Malware payload (MysticStealer)", "value": "94169cc275ef0c781355d2f4266114298f592cc105e6bb79e5340c586ceb9e3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695555681, "uuid": "1002eced-c699-4c0f-a73d-529db01d67bc", "comment": "Malware payload (MysticStealer)", "value": "689ee1bd60c45ab8edb177fb6019571a6579e36d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695555681, "uuid": "72b1b3bf-3ae6-420b-b071-3a99d0afcbd2", "comment": "Malware payload (MysticStealer)", "value": "ecd8fe136cd14a110dec69bfee6ab74cac33c88ab973fafdd63fbf5f456b4e8eed3fe12c71d977e5994bcfadaa9a177f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695555681, "uuid": "2ea9602f-7079-4706-b6fa-0f64e026d574", "value": "T16C84BED0B492C4B2E4E5143659E85BFA8B3EA4F5430548DFA3DCCF2E5A301C29A3BB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695555681, "uuid": "7eccccc4-2b12-4f51-a231-763e2ecdd4b7", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695555681, "uuid": "b2d47a80-e1fa-4dee-b017-17b38a451c36", "value": "6144:5646fuYXChoQTjlFgLuCY1dRuAO5moNRIMsSMDeiXXL2t7IPC4kQ5MPaNpIJaEX4:5/YzXChdTbv1buwNDL27I64j5MPaNImg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695555681, "uuid": "676ef8f2-a62c-454e-84ac-ecf3cb913e51", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695555681, "uuid": "8d643dab-18f7-4438-ba40-1f0bd34a2a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695555681, "uuid": "2a946df9-b95b-40f3-afcc-79eaecd6c77b", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.13743.18407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95115e8-5ae8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695566688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566688, "uuid": "7d1d029c-f810-4906-90d9-23b4cce35738", "comment": "Malware payload (Gafgyt)", "value": "fe6d0331c0462532872fbc31a739a833", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566688, "uuid": "35a1d4d4-f089-4eb7-ac8b-2311c27d3b31", "comment": "Malware payload (Gafgyt)", "value": "94415aad5086034d95320a3c57cffdf7dd238e3e889c6698d67bac399fa5a447", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566688, "uuid": "45b27635-463d-498b-af23-6b3ea5687838", "comment": "Malware payload (Gafgyt)", "value": "e8b00d8ff8445a71ac4f38cb801310c5d0302b42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566688, "uuid": "93873e1e-0fd6-4d63-8a99-7cb276f1ee1e", "comment": "Malware payload (Gafgyt)", "value": "a22d9e83e7b0d0f401e6a870de948f2ee07a4ef9883c0c290ac3d05c80c9443d2548b871cd07ea4c801c250f20ac0985", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566688, "uuid": "ab8215cf-f6f3-4236-bcbc-2c2b663bb729", "value": "T1C5A30993B801DFB6F40AE77604D34B247230FB664E531A32721779AAAE762D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566688, "uuid": "4cc33f7d-dff8-4989-8ee4-9b7292bfecc7", "value": "3072:6FbndQ/VstqlcvX6xyR4qmmuGVjtP2TLXl:6RdQKtqlZyRDmmuGVjtP2TLXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695566688, "uuid": "29cb26e9-766f-4716-b18b-6f3eb30e347f", "value": 101367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695566688, "uuid": "62aa8309-8ae4-4e3b-829a-c711f434d36b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566688, "uuid": "a99e9a38-92d9-4649-bd3a-d76c12b79c7d", "value": "i-5.8-6.blaze", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b1b0bb-5ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695545422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695545422, "uuid": "c12998ac-5ec2-48a8-96d8-259fa22ca1ff", "comment": "Malware payload (RedLineStealer)", "value": "9fc8d09e0127e363fe83c7963d95fae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695545422, "uuid": "c645f9c1-d6d9-46c4-8b8b-2b085786749d", "comment": "Malware payload (RedLineStealer)", "value": "965bd63b929535575a7c9c2cd7f1b96aba86063ea210ac0b3e73faf103d1550c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695545422, "uuid": "bccf3829-ffbc-4824-888f-e5669a57f7bb", "comment": "Malware payload (RedLineStealer)", "value": "16c11945fc865a3dd9ec7759d94c8493c23519c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695545422, "uuid": "4c11d330-e08e-47fd-83ed-1673154af2d6", "comment": "Malware payload (RedLineStealer)", "value": "a243f1ab60846c4baf07ca918b9e9421e098765118c6b357f6bc9354d09e13bc1a7c83306bd5a4ea0955d94f039029ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695545422, "uuid": "3dd3474a-7abc-46ff-a353-a0cadef6affc", "value": "T120552312B3C69063E6B253715CFA0AC3173BBC90A9F6229773469EA94C725E47CB1317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695545422, "uuid": "39bcab8d-e0de-41f4-a50b-95c3b937afb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695545422, "uuid": "2ff02784-0009-45a0-9c74-165a942cad70", "value": "12288:GMr9y90J1QtcGl+Xl5/E2scgQu8ovKJP1TUaC5lQZiSXTbdMhcV7yIQct/2QWGtr:DyBcGGPE6CvKIa5gVZk2QvZ+AhgdccE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695545422, "uuid": "83e0317b-3827-41b9-9c5e-332684420ff8", "value": 1296896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695545422, "uuid": "6731d02a-02fa-4c8f-b50c-0ebc7b2cac26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695545422, "uuid": "43b6024a-244b-430e-b069-52277daf1dff", "value": "9fc8d09e0127e363fe83c7963d95fae1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4897798a-5a97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695531629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531629, "uuid": "34db83f0-001a-4130-93b8-cba7d3bd23e5", "comment": "Malware payload (Smoke Loader)", "value": "417a2fe4dfddd3df59e0fd54f3332a95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531629, "uuid": "7ccc860a-7c3c-442a-a062-483a84117a79", "comment": "Malware payload (Smoke Loader)", "value": "96be8ff9b843492bed68b3c607dc752173eba06304f36de400c803fd6dc4635e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531629, "uuid": "82286fb4-860f-43a3-ae42-c437b7fd9c10", "comment": "Malware payload (Smoke Loader)", "value": "58725b939e69171ccd89f43e955834d51f41392c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531629, "uuid": "92c2a2f1-2819-47b0-a33c-f005f7159285", "comment": "Malware payload (Smoke Loader)", "value": "f832970432b76989e098521bff778d86103cbe52dd8a2557602a2d1061d44af61e1d770947769d9845eb47c226603057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531629, "uuid": "e3fd9f56-c984-47ee-be89-90dca760987d", "value": "T1CE647D13D3E17C51E5368B329E2EC6E8772EF1208E69676A23587A2F04B01F2D673751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531629, "uuid": "df5b6bb7-6e1d-453b-be21-dfa1fb6407de", "value": "915313f9baf3d4fbe9e467fb8242a50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531629, "uuid": "b2438a38-19af-4028-892c-b3391c0019c7", "value": "3072:oPKSClTHnkL//Y1V4sXHqYDytXZP1tht7bYfPRr3vP50lMvj:WKSClTHkM1V4OH3Gxx1thZbYfPNXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695531629, "uuid": "86a6c6e9-493e-4037-9b07-3bc80a2321f6", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695531629, "uuid": "864453a7-f691-4d3c-b94b-ef9f37bcba6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531629, "uuid": "999383b0-25d2-43bf-8c3d-17978123c719", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49d04c9-5aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695546924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546924, "uuid": "2127e35a-39d6-4089-a6bf-d42d9e38583b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "06827c21047c47c9c51926b061b239cf", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546924, "uuid": "0c3bf631-704a-4bd5-823e-fcc30dc8683d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "97f317f95f936e4f1169048bd33e53a779f12a42647e41d7eeb71d3d601b214a", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546924, "uuid": "06bfa5cc-d60b-443d-824a-2a3d5f189622", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c9dccccd793615cffc30315abc961ab193d8a751", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546924, "uuid": "fb728bfc-0801-4cbd-b8a4-692d07976a03", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "da6e435438f7e97165f1a5fb457b59b8992e73ccd10fcc26a323493db6a1add6e6e85f57d706b0318a39cf2c80bd4382", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546924, "uuid": "c00fb25d-5607-4d0c-8f0a-eb1153f4abb9", "value": "T16815231797F8E426D8F017B418F513930B32BCE54CB8825A3346AD9A4D73A94E572F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546924, "uuid": "4c7b4c86-aacd-415b-b9fa-c915d95f54d8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546924, "uuid": "1ace10ee-6cb8-45ff-9dca-1a22d1520c06", "value": "24576:6yadhwWARq1b/7YWWGfOkb+IKXau1oFwQ:BYkQnYWWGfOkShXRoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695546924, "uuid": "ed537582-63f3-48c9-b4c4-413efaa72c4a", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695546924, "uuid": "335aab1e-8535-4870-9491-23566d2db9f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546924, "uuid": "4eb55ddb-15b7-4a40-b17a-2d06eeaf59ec", "value": "06827c21047c47c9c51926b061b239cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b929f4-5aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695546925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546925, "uuid": "00b65855-a9c7-4308-9183-28e81347eb3e", "comment": "Malware payload (RedLineStealer)", "value": "6c088dd2e794fa0b21bac9516460e281", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546925, "uuid": "7cb4be0a-9c0c-4f2b-8f95-3567ecf8d0f1", "comment": "Malware payload (RedLineStealer)", "value": "98d483844bf481dc9b86f52ad8a0a50a3683c3dd98aef7c475cece6f6fc775fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546925, "uuid": "b56850b1-427f-4721-afd1-6d80050262d0", "comment": "Malware payload (RedLineStealer)", "value": "5515b96c971b9fcfaa75ee739bbb6ef37f06b98d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546925, "uuid": "a91a5f51-bbfa-4a88-9c03-67f889632966", "comment": "Malware payload (RedLineStealer)", "value": "384b9e3273c26efd24dde5f4b9dcdd6a5ed71bcfdd03f2ca507980d9889f83bb0837cd330a8b5e7379525f9d3bd615d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546925, "uuid": "78bd6899-bbe6-47a0-acd8-2856f9060a8c", "value": "T136152353B6EC8073D9B55B7058FA23932B33FD515978825E3387468A5C72788B82272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546925, "uuid": "0252c81c-c81f-4856-9859-127b501b8327", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546925, "uuid": "5156edc0-58cc-472b-b2b4-938285437995", "value": "24576:uyIrEhtzS6Q0nXlb/nAzRCOzswy5RqK8j:9IKtGilb/AsfRqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695546925, "uuid": "7922ea3f-6331-40c6-ad9b-9c7861307ba0", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695546925, "uuid": "d35496cf-1002-4ebf-ab51-adfc6d1092aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546925, "uuid": "279dcca7-23c1-4652-885b-b275797f5299", "value": "6c088dd2e794fa0b21bac9516460e281.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c139a72-5aeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695567606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695567606, "uuid": "822a471b-c1e7-4b30-8ccb-7c080ce7c867", "comment": "Malware payload (Mirai)", "value": "f367225d74f755b8cdd1b92f00b72e07", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695567606, "uuid": "ad82da2f-eb9d-4868-bd3b-879eb41e73dd", "comment": "Malware payload (Mirai)", "value": "9a2399175aee94f641d7ff8249ebf2d154a7925e5a4c2523e367149f4a3fb844", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695567606, "uuid": "f2e8f4c0-2738-43ea-a529-3516e73d565c", "comment": "Malware payload (Mirai)", "value": "717df671ffb22035ae02ffa49772fe9dcfc29c9c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695567606, "uuid": "535bbaae-9ad6-4c4a-bf21-255dfab9505c", "comment": "Malware payload (Mirai)", "value": "3e1fd8d6a5b1ce5b65f4bfe0376aa71e09a86cc362da40049e612e8bcbc5167f475d588d41194d31d940dd3fe022c09d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695567606, "uuid": "daa58ea1-5bdc-49d1-92d6-930467ed6ab8", "value": "T1F7635CC09543E8F4EC1215756077E7334B72F53A1169EA87E369EA33EC42A21E64B2DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695567606, "uuid": "cdd3595f-58fa-4b66-b08c-8e3af7f6473b", "value": "1536:/NFp7KQXRgoXRSEUV0wR56Q0X6P29V0RrSRGekCzOWl1noseaxshg4CUchSsd:1Fp7KQXRgoXRSEUV0wD6NqP29V0RTiOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695567606, "uuid": "d02acfc8-acd5-486b-a5dc-6b859709747d", "value": 66736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695567606, "uuid": "831add70-76c3-4f86-a942-c7c72af0f375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695567606, "uuid": "7d8660d4-74e8-4225-ba0e-09d738abece1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ad33a3-5aae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695541805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541805, "uuid": "8c3069b7-c6f4-487c-a679-309461e4efe6", "comment": "Malware payload (Mirai)", "value": "561c6b31510f05fe1d4f20b5addd290e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541805, "uuid": "e614cfec-0a05-4d4b-846f-6907a6649dd3", "comment": "Malware payload (Mirai)", "value": "9e8e976c0c210a4190d3f9d9b186a74d2fd0a96fd1a52d05960034d6644bdf7a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541805, "uuid": "48420f67-b72b-4611-9c7c-088ba3e31a3f", "comment": "Malware payload (Mirai)", "value": "9ce1ff774352e618bd48114b9eb22e03e5e3e2ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541805, "uuid": "7397bb72-7931-467d-8ac2-d0cb8a91cf9f", "comment": "Malware payload (Mirai)", "value": "038e5b8288f0b6dd2feadb4d5677f7788a850e22e5d981a3c57c58d94f7566081f60bb216b0326c65427e29d538a73af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695541805, "uuid": "467c650d-7cc1-4aec-8a70-fa8b2004a80b", "value": "T1AAD2E151F1479B82E16A0C761CDE74990421570F2CC5F1D7BE6073368A53F64262EF6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695541805, "uuid": "ff4030d9-d234-4939-acc3-2cfc05d93927", "value": "768:Wd78ykw0/RCgm5dY+6GtVbZHFGH1OlhKMAGpnbcuyD7Uryqq:A7RLHY+5tVbKH16KMAanouy8mqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695541805, "uuid": "12229a91-a06f-4042-a8aa-5b98999ddf41", "value": 29624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695541805, "uuid": "a67ba85d-3cb5-4efd-a1d4-88cbcf3efff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695541805, "uuid": "5a50a129-cba7-49f7-bcd7-62b30b46096f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149567f8-5b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695586088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695586088, "uuid": "a2051bd4-50c7-4393-a3b3-632c43e175f7", "comment": "Malware payload", "value": "53e0b79de435bf2c6415df7be0984a6f", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695586088, "uuid": "6adfe1a8-9ac6-4928-822c-a7fd4adf88aa", "comment": "Malware payload", "value": "9f5c2ab1de59e8770f34d7a6bb6aa55696aad07a180a3794fd68d48798587f83", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695586088, "uuid": "216ee19b-874d-483f-851e-e42e617db2c7", "comment": "Malware payload", "value": "f491e3cd1d339d2c5148b80d4dae9ebbcb518ba8", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695586088, "uuid": "c92a8fdc-f30b-473f-a357-d54b09198a29", "comment": "Malware payload", "value": "5b68eb0f0238499c93aecd5e3d16b0539e9626189aef80db73b35fbcd93e723162842a30424eaf59e7d83c6bda7df162", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695586088, "uuid": "66451541-46ba-4d09-b9e9-b1d3fa34137d", "value": "T1B39633C66187FC4EFC1EDD3391BB28C1A62550A2E166D430F38DF754652EAA081279FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695586088, "uuid": "9fa9f4eb-c269-4cb6-a27b-d64f9c2335f0", "value": "196608:ZSK7okBrquZ7Ss9AMClMf3HOlyqrhSc+dMhSkTLWCyc:ZSIBrqg7xh3OlypkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695586088, "uuid": "de9f72a0-c093-40f8-9e5d-e31f30457ed7", "value": 9190374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695586088, "uuid": "45d61ff7-8bc9-4c3f-9a48-b2a58acac1d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695586088, "uuid": "ab6e374a-9651-4b6d-b23e-68c36ac4be1a", "value": "Chr\u043em\u0435S\u0435tu\u0440.msix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f484cf3f-5abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695547809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547809, "uuid": "93657ec2-be3e-45f1-9285-ff89335a680d", "comment": "Malware payload (RedLineStealer)", "value": "a8f3e02d53d395301afa83f2d2ddbdf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547809, "uuid": "533b85c9-1ac9-4601-ad47-e681eb9818c5", "comment": "Malware payload (RedLineStealer)", "value": "9fd28b5790c1db81cfee1c28df437aecce017aceec0d24f5570778ec9d3ffbc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547809, "uuid": "916ec900-48d3-46ec-a4a5-e492431bd263", "comment": "Malware payload (RedLineStealer)", "value": "d7c49d6741f6f4b8ad358c2eb15b215387ff186f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547809, "uuid": "98c8cdb9-3d9c-4587-a4e9-95c16e1cbd9f", "comment": "Malware payload (RedLineStealer)", "value": "c0bca80a6f56fc9df25ad16bc42ced4bae07ad9241f808ce5af1c0330e4cf3b16d8693dc82b3f2db3c347b58f2f7acaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547809, "uuid": "e2f6e53e-9313-4d6e-ba2a-9f8f570fbe4c", "value": "T1DCA4C01393E17C51E5264B719E2EC6E4762EF6208E6C276E2328BE2F18B11F1C673751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547809, "uuid": "55c8816d-9ccf-45f2-a451-6db19a15aa4f", "value": "915313f9baf3d4fbe9e467fb8242a50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547809, "uuid": "ba67b10e-576d-42fd-8f08-96b9920dbfa6", "value": "12288:2ZTmhfZDWhdvmaOBqI80hlAUT1cpuZhAM2BA/3/X0WjUCu:xrShk9qI1rZT1zsWsWNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695547809, "uuid": "11e3e5f7-7cea-4756-a887-2725c252aa7f", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695547809, "uuid": "969edd7b-74bf-4de1-9ced-d0ccd10206c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547809, "uuid": "65f6b0db-c7f8-4e2a-a9fb-01217b9f5ed6", "value": "SecuriteInfo.com.Win32.Evo-gen.23761.17367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1afbbe0-5ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695559804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559804, "uuid": "052557ca-96c4-4b0d-ae06-538ac4b88438", "comment": "Malware payload (Mirai)", "value": "f3bfaa4ebf703c0c9f03318684f52805", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559804, "uuid": "c78cb041-27a1-477b-9699-4bc979a6fc69", "comment": "Malware payload (Mirai)", "value": "a1390bb7ffa98c3623b55d6caaf390a01bc8e09f76c13c2367aff19f6cd5d58b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559804, "uuid": "d9318156-b63c-4626-b179-7fa150b09d03", "comment": "Malware payload (Mirai)", "value": "7b4d9ab9461ddff6ab14d5fccabd18c141a1b1bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559804, "uuid": "bd2c8649-e60b-47b0-8afa-db55ff13b3cc", "comment": "Malware payload (Mirai)", "value": "c02214d18e9e65fc506226a75f96675e7835943a7c94d8fae0e2d4ecc8c825bf4c17f0b32a5a667308a70e58d8a26330", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695559804, "uuid": "0744c486-3629-4b03-927a-c9715b22c7e3", "value": "T18CB3B44DEA649B29C7E332FFFA5912CE722A0BDCB7EA70119E310B4537C8B565935120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695559804, "uuid": "81877d8c-80b9-4238-a674-68dacd186d87", "value": "3072:PFQkttnNhZ9RrPsgSxE6iqzarfLMB4MzgPu:dJXNcAqzarfL04/Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695559804, "uuid": "4892d2e7-a0d1-4f49-b7be-9ac6de743375", "value": 115692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695559804, "uuid": "33b47bae-d955-46a8-9e2e-c487f999e065", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695559804, "uuid": "6659343c-9198-4033-a8a9-52f46a388b12", "value": "arm7-20230924-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7638853e-5b2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695594842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695594842, "uuid": "37c9c3d9-66ee-4496-8bf4-d9b23c494e93", "comment": "Malware payload", "value": "e33a19d21076734b8a8a7e372dab61ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695594842, "uuid": "c141a076-029a-4ddd-b11a-9f3906ccac12", "comment": "Malware payload", "value": "a23f4242a76cee5433ded21e591af5e1973bb00c561b089256ceff69d154eb06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695594842, "uuid": "2e330b44-0ba3-4f32-92cd-c3c9355b2e73", "comment": "Malware payload", "value": "509b1cf993fe3b1e36832ce47e3300ebb26a9be9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695594842, "uuid": "03478cf2-dc3b-4d3c-9def-b0e53d02576c", "comment": "Malware payload", "value": "ce3583b9f0b552ba67db38c3c82fe1f801daff0f7965d799b960eb121ff12a6e106bf3aa512b16526a61f1ac3c08e589", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695594842, "uuid": "f7bf0b33-bdcd-412c-ae6e-f02db37ba9fd", "value": "T17584BE15B1D28433F976193205F0CBBA063FA862575399DF6B608A3F4F202C1EA6D65F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695594842, "uuid": "d9a8f0c0-1872-4a4b-99d1-441069eb9575", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695594842, "uuid": "c566f1f1-ee2f-4f47-b3d8-d436a3aa1e6b", "value": "6144:4NohUOqW5XJ6EDOpvOCm5MNuAONHdSDqVCeyvOAGr2JtbpJ8c62KVqwh:4NOdqW5sEe2uujHYDqMeyvOA1bLhKUwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695594842, "uuid": "7dac601c-c646-4c40-8f89-b88c5d792c8e", "value": 405880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695594842, "uuid": "f1b7dfee-46fd-4519-9339-698922298ae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695594842, "uuid": "5dfec5cd-620f-4740-b2d0-28c8f19de33d", "value": "SecuriteInfo.com.Win32.Evo-gen.13021.24820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99dfb1a6-5a71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695515445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515445, "uuid": "cc5eff61-bc40-4801-949d-136f8817d5c6", "comment": "Malware payload (RedLineStealer)", "value": "a29c5ea5f009e37f2b567fdfcd6f04d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515445, "uuid": "a0ae4fbf-8ef4-45af-b8f3-92d066da8c3c", "comment": "Malware payload (RedLineStealer)", "value": "a33ec26c7f1dbc1b4bf33f9692fdb267faf8748a66de2cf5f3342575c29e7dee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515445, "uuid": "47eea4d2-e972-45f9-a001-80e63023a70c", "comment": "Malware payload (RedLineStealer)", "value": "44eae13fe113f6f98f3b38f8d995c475c7af8d9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515445, "uuid": "98a92cf7-8500-49f1-b4c3-662915cc8c2a", "comment": "Malware payload (RedLineStealer)", "value": "44601f7ad8d7e5356106935a55e0eda4681027753ce19ba1914b1e243c3ae186ef9d23bc60eaa4438d27734c86b15c1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695515445, "uuid": "ed0654f3-3eb2-4b48-9352-289ca11d27c8", "value": "T1F7A4C00393E17C51E5368B719E2EC2E8766EF6608E697B6A1318BF2B1C700E1D673711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695515445, "uuid": "2767da9c-9fb4-4b75-951a-3e10bb3d24f7", "value": "915313f9baf3d4fbe9e467fb8242a50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695515445, "uuid": "cb7e7f54-784e-4361-8106-a78b563aff57", "value": "6144:5g4KETQkSPqJwdeidzErR1zVqRS5BiycPms6KRlaUxHUpxP0SFp9bvgJsAZXZJoP:WMTLqqKmR1z8Siox6UZkpZLz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695515445, "uuid": "55776c5f-9e5f-4ddd-bed0-29b65ffc0889", "value": 483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695515445, "uuid": "d3d24c5a-5a3f-4f11-ba38-cfd2797fe64c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695515445, "uuid": "32e56449-c633-444e-8e01-bd56ed19def3", "value": "SecuriteInfo.com.Win32.Evo-gen.14725.3648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3aa74fc-5a97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695531916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531916, "uuid": "f55cd029-b51e-4e6b-9ff6-c34bb1674017", "comment": "Malware payload (RedLineStealer)", "value": "f708ab645345d13f0db213b6fc2cfa4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531916, "uuid": "6bae0535-1fbd-4c48-a15d-97ab4e3e43aa", "comment": "Malware payload (RedLineStealer)", "value": "a41834478ad7fd4d639c995d904833e6166e2ff74714aab20ddecdbe77a0689a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531916, "uuid": "8649814f-8794-4d35-977e-a2e817689b00", "comment": "Malware payload (RedLineStealer)", "value": "52b217ee47e05a81d8fa17c8eb63c7f88ecf212e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695531916, "uuid": "8c9a366a-5bb2-42a1-973b-334e27f9c9c4", "comment": "Malware payload (RedLineStealer)", "value": "96e966a90d4ef766975bb580baacb8319f9554df31485cb785c88066fbc18d0a7f73eb0016c4dfd544b737d8f8a8517f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531916, "uuid": "df673c08-ea36-4dca-bbfa-0d0a90c00263", "value": "T160152242B7F85163DDF05BB02AF703931336BCA08C7A495B27899D99ACB36856433727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531916, "uuid": "c41876fd-640b-4631-99bd-0bf03eade632", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531916, "uuid": "4fe7d2e8-5c7f-4291-a1ba-a95d8dbfcc60", "value": "12288:rMrTy90U/Q+RfgFMFJq1M8BJMUhbI7O1yivVvH0ijRdwhst6vazYBiyFuqdUsIp+:4yczq7q52ivVxP6va8B5WxzcBdUOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695531916, "uuid": "65231190-dfac-4d07-ac02-60c49a6415ff", "value": 955904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695531916, "uuid": "15c3a9bc-01ae-4cbc-b54b-c73327b34643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695531916, "uuid": "d0a3a693-0401-4f97-803b-7023ab8e7199", "value": "f708ab645345d13f0db213b6fc2cfa4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1a9167-5ac8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695552927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695552927, "uuid": "8f25244f-8aba-4519-a360-0380a2d7d407", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "efec8e9b0adb2baaa0d5b01bedf90682", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695552927, "uuid": "2a5d7602-1ef0-4bf3-89d9-b00b43d91da4", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a503fdda1bccda3effe3f0b01135db438342faaf8259d48bb4e7912d7ee8445e", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695552927, "uuid": "5f6ad3b0-26c5-4b84-be11-4be19b04ead0", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "e407444243d9faad56ffe131744b0b1531b09819", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695552927, "uuid": "a1ad4121-ef58-41b6-993d-9756bf0e9e74", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "678feb8e0671abdd2e1ad7aabfc91faab4ed79a5aa133f105fcdb51b1b6d4e4cb562050b72fd98d1aa3190b68e0a5e7c", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695552927, "uuid": "304d45ab-6aac-4332-bb8f-3f726e3f99e7", "value": "T17A5523059BE8D0B5EC78277139FA4BC70B32BDA5447042AB5751A98A4CB3ED4F23172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695552927, "uuid": "89a502ca-c30f-4ada-8eef-71128714028f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695552927, "uuid": "efd9a711-a786-42a7-9bd5-401a5e432304", "value": "24576:py/oCwttJTT3042M/2UZivjMQ3p7rp05p5uXerDjHHNMZfOpx59j36Y4LvqV0wiz:c/oLl//KLM07rp03wUNMZ2px59DmLv6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695552927, "uuid": "02401fc7-715a-4a19-94af-2b43034a4598", "value": 1285120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695552927, "uuid": "48b01e98-cf74-4667-9f9a-7daa4ab51e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695552927, "uuid": "2c1b3db2-ea2a-4d45-8361-90c346281440", "value": "efec8e9b0adb2baaa0d5b01bedf90682.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6c0390-5b00-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1695576622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576622, "uuid": "c7aaa9ca-c070-4319-9b2d-3a6f04cffa34", "comment": "Malware payload (njrat)", "value": "bbf9380a0afde50f62c53918bd032edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576622, "uuid": "c7e6d42b-d34f-4a05-9d9e-44d4bb4d3dbe", "comment": "Malware payload (njrat)", "value": "a72957878c03dbcd6fa1735e785eae22254fd23e2b7c06ce638d361c0b4a4878", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576622, "uuid": "db190399-0b0a-44b7-ac77-11bdedbcb516", "comment": "Malware payload (njrat)", "value": "a516e71c553703aa47ab7d0142e075b723763ecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695576622, "uuid": "a8f068f5-94cf-4913-b97f-b7e244d5ded2", "comment": "Malware payload (njrat)", "value": "aa8e73dc789d206b9008fbab5f130a4288fa42957e06038aedc1068dd82fe6d4aa858a8e28825312e6281505ce19d462", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576622, "uuid": "bc2df26a-c282-4dd6-8375-a4a34aac1187", "value": "T1BFB33A4A72884715F527697091EB253013E1AEDB6F32D6813E086E8F1D527D2DE83E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576622, "uuid": "6005b081-4480-4081-bb32-bed6fb271f11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576622, "uuid": "0a8ac2e1-8d64-4e1d-be86-60b8d0a4a86a", "value": "1536:vQPkS+yD6k4iifWTSfKP86nQC8vEqcqhJr1YZjmZTNowZaVf21BlR9xlz:TSiuifLfrwl8MNykmZ2f21Bjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695576622, "uuid": "fd2f54c3-42f1-4344-9e33-7e9ada5d8c0a", "value": 117760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695576622, "uuid": "a2be2796-5a53-4d44-8b35-6e770704d934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695576622, "uuid": "2f2b02cb-653d-4f6a-9655-948cdb1a915b", "value": "bbf9380a0afde50f62c53918bd032edd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5ba1d3-5a92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695529703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529703, "uuid": "4e8d95a7-3a35-43a4-9601-1f2e8caddef6", "comment": "Malware payload (Smoke Loader)", "value": "a6e293deb8a7f51a306f4129bd1e0468", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529703, "uuid": "58274965-8c69-4154-97ca-1562a49e53fe", "comment": "Malware payload (Smoke Loader)", "value": "a9745e8b2c41acee769ec0e28c1d73adb4d664a93da8724ff187bcdcb2994e12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529703, "uuid": "c75209e6-d36e-4319-9b7f-d270b86a9b89", "comment": "Malware payload (Smoke Loader)", "value": "26587da8f2fba983e2cac67d4e2bc1a692eced25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529703, "uuid": "7f4df215-1182-4d8f-bd29-372da7155d8f", "comment": "Malware payload (Smoke Loader)", "value": "24de24555fab18f16933ebaf6db77a85e84c3a3839d1b2d6bed4a726913ca523b4e5ba0e44875c7e664aeac063dcaaf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529703, "uuid": "3872bca1-bea0-4a95-b5bc-75ba26d91001", "value": "T185646C1393E17C60E5768B329E2EC2E8762EF5608E59376B23547A2F08B05F2D673711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529703, "uuid": "8fbaae45-1870-4bda-8617-ce190186398d", "value": "915313f9baf3d4fbe9e467fb8242a50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529703, "uuid": "73ca0d80-fa1d-463a-83cf-58a9ee8e2a65", "value": "6144:J7rslT/knvHRbSU3Cm+T+pPCbIG51HmPIL:dkTsvHNSUymhC04GP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695529703, "uuid": "48447114-e3db-4764-a968-f3ad84654683", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695529703, "uuid": "4374b4d2-f48d-46fc-83ea-f093ba5096d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529703, "uuid": "a3c65b88-f8c3-443b-bf82-04fd402e8252", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfffefe-5b06-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695579501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695579501, "uuid": "62a3262a-882f-4ad3-b957-5625ce496cff", "comment": "Malware payload", "value": "3888ab38ad9f0517bfadd58656ea7f05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695579501, "uuid": "b82e246c-6097-42a2-8622-ba58f0fe7085", "comment": "Malware payload", "value": "aa9d54d5001193efee0e4315f45a635321e84c719c0c4736f54a8d1b663f095c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695579501, "uuid": "836f0950-00c1-4a6f-9bf7-a3310e83bb69", "comment": "Malware payload", "value": "bcda449801ab0b77a8f6912b88b38afea1e37f4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695579501, "uuid": "8c4379ca-960c-4c8d-8bd3-e2ce6fa87819", "comment": "Malware payload", "value": "172d926069078f9f49934da2a6436dfc03f5322e8a015392bdf9940c53b66b0bf1f5ab11ff4158db7836e2e239383277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695579501, "uuid": "c3c50d3f-f9ca-4bea-8759-71d861d27450", "value": "T13BD6C04AF66310E4D85DC8F4826BE572D0743E5A0367EEEF2684B631AE717C0572AF09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695579501, "uuid": "3b437a22-2d91-4779-9aa2-ffca46af988c", "value": "5d3aa908e334e626a5c0f84098f52e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695579501, "uuid": "c94d6462-301a-4aff-90be-3e9f5e6571c0", "value": "196608:f0PYyLbV8Z1EanXunoYJZoUMGNgcRx2yapVesMn1aIocTgsftU:sP9L6Zu13fLRx2yaRZAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695579501, "uuid": "11cd315c-2e1e-45a8-bc33-ca9b02b956d6", "value": 13032216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695579501, "uuid": "c65e713f-df7a-4fcd-b471-17a76fb1ea93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695579501, "uuid": "5007b0d4-8f6e-45c9-9583-243a1124f01f", "value": "widevinecdm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d4d1a7-5aae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695541804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541804, "uuid": "fe7082e0-4b6a-4d34-8c98-3e6a5078a41f", "comment": "Malware payload (Mirai)", "value": "60d7a7bfbe1622ec696f1da6091a9678", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541804, "uuid": "1c939d37-8c5c-4792-8003-2033c1b60417", "comment": "Malware payload (Mirai)", "value": "ab6cfa0c76c5880263490f20b7d220b3d12622ce835f0d13027b386ae7ee8f17", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541804, "uuid": "fc25fda5-1cd8-49ec-995f-a57c240d3c6d", "comment": "Malware payload (Mirai)", "value": "cd4dfb1ce002cf79a837f73ee2247d5e145ded47", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695541804, "uuid": "14e15289-9804-49b0-92d5-2a1c5b8c1d1e", "comment": "Malware payload (Mirai)", "value": "20a91633c663416b10c3fe754bf702cdecf14c69538656336fc14334457a238a90169b8da60e403da11834e5aab1042e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695541804, "uuid": "1b4d2363-0eb9-458d-8822-2d68373225ae", "value": "T11A430110D3097FA6FB7B90B4B52650D2336E0AE1F26B63C4D7390B3259D840B71E9593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695541804, "uuid": "be86a7bf-a146-48af-b2f3-49e8714292c8", "value": "1536:oin4/vjvlGhKHhbLf1WN8WyIeK19vZErRJVn:B4zloKBeNyIeKnvy9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695541804, "uuid": "25bdc743-bee6-492a-94c5-2e31b623a5d9", "value": 58712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695541804, "uuid": "e8a4a094-1ab0-4e05-9781-184ab57284c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695541804, "uuid": "a5b04e27-b89e-4c1b-8ebd-c90b4aa40115", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cc32e8-5aaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695542121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695542121, "uuid": "616974a1-2e6b-4332-a1dc-875916553ede", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9bc8364158c6682e63af9abecbb83409", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695542121, "uuid": "266767cc-e593-47c0-9271-75c591a700c0", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ab7c63c5d970a89f6cd05be687cd26688d919cf05fe82ab00f5a5501b6202836", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695542121, "uuid": "d0dcf015-0114-4fc4-812b-b9eebfcd7123", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "bda20829ccf357dbd9688ed48c59ff02fb09bf0a", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695542121, "uuid": "2b7fb61c-ddd0-4142-88a0-58b660e0c69d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "078cc3f405b1aecb7557ebb2744baf968801f1438c1ae0e9d74aef31bb98b3044968a8776acd3cec627483a630ba34c6", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695542121, "uuid": "aea6430e-a393-44e7-b185-052c897acade", "value": "T13434AE0174E18472D672153209F4EBBA5A3DB9700B519DEFA7D40F7E8F313C1A632A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695542121, "uuid": "e55903ad-f1f3-46ee-9e97-8d9044e1b2f4", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695542121, "uuid": "d2d35ff8-c123-4fea-b2a8-d88f499e7dbd", "value": "6144:6w46fuYXChoQTjlFgLuCY1dRuAOEPuCbIZ+vdw8y0:6BYzXChdTbv1bu7Cb/Vw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695542121, "uuid": "e943934a-03ea-4fb7-8732-f2a62358c384", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695542121, "uuid": "df26ff8f-f320-42ac-8ec9-36f51cfc4221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695542121, "uuid": "12924b69-f0cf-4011-8bc1-55b4890ee046", "value": "9bc8364158c6682e63af9abecbb83409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5c54cf-5a8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695526215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526215, "uuid": "a5a60dcf-0ef7-4abe-9062-009d4214937a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3c369a10cb79de4e918ea6c326c52fb4", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526215, "uuid": "5d1418c4-ec40-4f81-9732-ebc8926236be", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ac7a4d6eaf0008bc520d859f8283be297a1bfddd9c92584aa73b4d30cb9fff8d", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526215, "uuid": "ddafbf8f-c14e-424e-aa56-33b918179a2a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "88a48e08bf7e518f5c87199e8a58ed8f616e788f", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526215, "uuid": "c95ef083-43f3-4568-bab7-71a0a5787902", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3cfd63b541adf5a76e919c120cdd68b547a80cc2d2b07332165832a9a235f46c7c0b0f3230efffdb03c48a2c61510385", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526215, "uuid": "607cfa2a-3f7f-4e28-84ec-f9a8fc68b199", "value": "T1B2348D0174D18472D472353209F4EBB65A3DB9700B6279EFA7D40F7E8F206C1A636A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526215, "uuid": "b1776a11-980a-4bbc-ab93-530385b35f0b", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526215, "uuid": "c286afea-21ed-427f-986e-3523a6229506", "value": "6144:Uz46fuYXChoQTjlFgLuCY1dRuAOSnLiqyw8y0:UcYzXChdTbv1buILiJw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695526215, "uuid": "3a4d1d39-b8c4-4772-a542-5e5b4ce04ed0", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695526215, "uuid": "60f17aac-83b0-4b8b-a552-71063ffe5541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526215, "uuid": "bfe0b9be-3aa6-410c-b2ef-b7064278583f", "value": "3c369a10cb79de4e918ea6c326c52fb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0aa3e9-5abf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695549006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549006, "uuid": "9bfbce8c-1650-45a3-bfcf-6e6e1a13b8a5", "comment": "Malware payload (Mirai)", "value": "816ba05febba435bab78d040a5ec9eef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549006, "uuid": "41b6c79d-7397-4d6d-a2df-18020d9a23da", "comment": "Malware payload (Mirai)", "value": "acef9c5d379cda1337febcc78a5a48460649f0a7d2e04c4c2cefe24140b43f28", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549006, "uuid": "9988cb01-fecd-44ba-a7f8-1562c7ac2346", "comment": "Malware payload (Mirai)", "value": "8af8585ab926a4a9bb3ffcdf365662009d1e01e8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549006, "uuid": "4bfd1225-17e3-41fc-b0b3-5f5200fcd820", "comment": "Malware payload (Mirai)", "value": "09fa053e60ca544e00edb0c50698131edf3dd26b1b1c88dda4c321a2d43a88a11054efc6d1ee5ec53937e12ff1e12f73", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549006, "uuid": "8563b3cc-fbbe-4741-a648-661733041fb3", "value": "T1C6431755BC918A16C5E022BBFB5E818C332523B8D2DF7207DD212F55778A81F0EBB691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549006, "uuid": "e7b65f55-cb1b-4a0f-af07-c6c202854d69", "value": "768:mWBQXjje5jdegyS+zmZ9JXS0/U9AytPSL05CVn9oOEpuPhtPLJt5m0wrhebNLP6u:MjmjdzJXdc9ntvDpuPhl1t5m0VPIJws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695549006, "uuid": "1649246e-30a1-4779-ba7a-9260b41c2516", "value": 56992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695549006, "uuid": "400d1b28-25be-45f5-a8b7-80192911fea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549006, "uuid": "0432e17c-2b38-42e5-98fd-81416016e1aa", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34de92f9-5b11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695583995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695583995, "uuid": "de4b6e45-0922-4f32-9ab9-c1219f29c2a0", "comment": "Malware payload (MysticStealer)", "value": "355e77edf624035bf7543af28b08e80b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695583995, "uuid": "b1b12985-b35e-4c2c-9891-9290a1f30f5e", "comment": "Malware payload (MysticStealer)", "value": "b22be0c777ed1cf28efb837a32be0f6e1d7871ff3e02e7c6e96a3605321feaa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695583995, "uuid": "9217687f-0b69-443b-90ce-47af560fe019", "comment": "Malware payload (MysticStealer)", "value": "7389af1e18653dca964bed93a1422f80be5033ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695583995, "uuid": "e0172702-5581-4307-a301-e14c0fad2f48", "comment": "Malware payload (MysticStealer)", "value": "bee157cecd359117ca15f41824c8d8bff55cb394b9ee98113cbaaf1f3659312661baee8c429aae72ddb5c51f7c2f5f4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695583995, "uuid": "0c0ddda0-1d98-4aa2-986b-8a063064db41", "value": "T11A84BFC17CCD6572EC6210350AA0DBF2D93EF820471249EBABE5CE7EDE645C0A732956", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695583995, "uuid": "3f879b9e-3b49-416d-9c8b-7e9a57a51654", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695583995, "uuid": "ab62a357-3099-462a-9a33-ae5ec142f3c2", "value": "6144:pN/hUOqW5XJ6EDOpvOCm5MNuAO41hH+XXKuJa/Jiyzdv1Sszxqwh:pN5dqW5sEe2uuO1hcQwypvss0wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695583995, "uuid": "53831126-d539-4186-8c75-025af5224aa1", "value": 405880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695583995, "uuid": "146f04c2-e5ae-4411-a856-eaecd5cb2fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695583995, "uuid": "1b7fd49b-d2c5-46a7-a5b2-f4c80c281a28", "value": "SecuriteInfo.com.Win32.Evo-gen.14932.23470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be4555c-5aca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695553459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553459, "uuid": "57318642-d2a1-4052-8f6b-74b29db30309", "comment": "Malware payload (Mirai)", "value": "ebc71cf2b38c4fa591ab26cf5690448a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553459, "uuid": "b06f72f6-1cc7-4b0a-ad2a-f8d7c1a8da37", "comment": "Malware payload (Mirai)", "value": "b278f380719e259b24a998637a6ec0c78240130b29da106af38fb9e76b52cb50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553459, "uuid": "02694739-97a2-464b-9d1a-b912a40fcdeb", "comment": "Malware payload (Mirai)", "value": "848e507ae1023e6b226d159657c3c0fa348553fa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695553459, "uuid": "d60e54db-1b97-4a35-8ac8-43d190fd268c", "comment": "Malware payload (Mirai)", "value": "1e3260c2839d4692fc74d21603073cc4976b8ce26e6f915433bf500b5b123692df64d9192e2bda4438a39bd106d233ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553459, "uuid": "262e6fb2-eb90-4c0a-a99f-49a82f3be9af", "value": "T152F31A46EB404B13C0962BB9FADF42513323AB5497EB73059528ABF43F8679E4F23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553459, "uuid": "58f42e34-53ab-4e34-8fd8-aa4d64c4eee5", "value": "3072:QRa2eFdHlkQaNcTZeZz/oMsCXPtW/szDDohM/RXpsBQl:seFt2QaNcTZ6zwy1W/cshM/R2al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695553459, "uuid": "7f3a18a9-4014-4d3a-afd4-a44f269e0b38", "value": 168092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695553459, "uuid": "8cb165fc-450b-454a-8804-fea635e02611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695553459, "uuid": "5bd8500c-4f4b-4eab-b343-62dd83d20f52", "value": "cundi.arm7-20230924-1104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8b4f7d-5a71-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695515446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515446, "uuid": "02422082-5562-48a0-a65a-f4601a0bf510", "comment": "Malware payload", "value": "a8d7f5920828ed37d77d91f1c08a6110", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515446, "uuid": "99854acb-5e35-4aa7-a14c-7bd84ed43974", "comment": "Malware payload", "value": "b498a04fb5b4593424c42a15abe821e6f68dd8f6cd23bdfecea80f3238eea484", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515446, "uuid": "5e39fb09-0858-4161-b2ce-4d3b7e0b44d8", "comment": "Malware payload", "value": "6485e334377b4d0706d7b3d4544335bc2960280d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695515446, "uuid": "0b9db45c-850c-4166-b0de-4bb8beef0e0b", "comment": "Malware payload", "value": "d1ab522f2321c84dc457e2fcdecbd30f1a700ae87588db90432c2de6666a8ca096a986eb61a2f89efdab026d8b93485f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695515446, "uuid": "55fe1633-7b97-4cd8-af8b-34a5bff86f16", "value": "T14D23D44AF9909657C4C00B3ABA0E538A33335618D3DFA3115B296EB49F47B6F0E3A815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695515446, "uuid": "26fba91f-2acc-44a7-b42c-159272e6723c", "value": "768:RlnJ99TC33T/8PaXFKfumbp2qIV69iEwWVt3sAZSBV/nTjHbVDF0QAP:Rln71CT/8wFKP3IGiEws3sAsnPbVZ1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695515446, "uuid": "71493090-4b48-4658-b6bb-8724324f8d9f", "value": 48081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695515446, "uuid": "51814dcc-edc6-4e6b-87d7-23bc364a17e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695515446, "uuid": "4ade4afe-4406-42d0-83cb-970205461a3d", "value": "SecuriteInfo.com.Linux.Siggen.9999.29005.13930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1913eb25-5ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (OnlyLogger)", "timestamp": 1695551307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551307, "uuid": "4e1bc523-0fb0-4ff8-b6f1-4578aaa23048", "comment": "Malware payload (OnlyLogger)", "value": "c10f5d08aaae20c7eb7a1b4c27823baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551307, "uuid": "55e07e6c-48d4-426a-946e-bb690d0a4579", "comment": "Malware payload (OnlyLogger)", "value": "b4c2c0bc21a4740b9b4949688c618a22008e630879faa8e87c488f44bfc1ad3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551307, "uuid": "faac69e5-6f22-450b-a927-458e21caf477", "comment": "Malware payload (OnlyLogger)", "value": "a078f7e6474c7028f953d9aa662a2a34cb2a8f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551307, "uuid": "4295a9ad-0860-456d-9551-66fe9c718a40", "comment": "Malware payload (OnlyLogger)", "value": "959b9ae8b3ce2546d7bd5d6ae5610e503fc63211c786aa5ec0f80f6b514fede4e9222e8f2e669bf28faa1cf09712501b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551307, "uuid": "c9a39c24-e473-472b-b2bf-0d5c5e443b48", "value": "T18184AE1393E17C61F5368B729E2EC6F8762EF5108E693BAA23147A2B09701F2D537711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551307, "uuid": "b928a057-7810-4f1f-bf9e-16e8fe5cd45a", "value": "5208e0d407d61105b978bd2c2254eb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551307, "uuid": "98d7f23e-76cf-4e33-8b3d-e7afa8d679f0", "value": "6144:5fKRDOk6wmGwkCdyfHKNmeBcnh8AtFkvrguRMO1r1rmh5:5+DhVmGCyfHbnh8kFkrguRVrqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695551307, "uuid": "8ad9da56-3abc-4499-bc0e-a4a6938d71b6", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695551307, "uuid": "4e393264-6f03-48de-9ea8-538b424cdfd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551307, "uuid": "7b67e44f-f56b-4dc8-b919-6c7ca7c970b8", "value": "SecuriteInfo.com.Trojan.Win32.Krypt.1481.14090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e69665-5ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695557903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695557903, "uuid": "a4a32dce-5af8-4e29-8ea7-11a390766252", "comment": "Malware payload (Smoke Loader)", "value": "9f0c754b25df48784f9a5a90d2b83cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695557903, "uuid": "4ec2fdb9-7f8f-4156-af71-5e311f06a335", "comment": "Malware payload (Smoke Loader)", "value": "b6fba9803a085a82700599c71a74b024193fde59071fca8b0fb4b33fbb1171f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695557903, "uuid": "9546e22c-f899-4713-880b-ffcb1b19791b", "comment": "Malware payload (Smoke Loader)", "value": "343e588a26e16708fa96c44c0f9a7af0eb021261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695557903, "uuid": "6dadb6c9-c969-41e5-94fd-dd345c110bff", "comment": "Malware payload (Smoke Loader)", "value": "da16293c03ddf73874d9909262cd83a5dbf95ba5837919c9696d26e79ac348cd9e76239859c02339d721441135470f96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695557903, "uuid": "5fdd3cbb-5209-456f-8ded-e1a25691489e", "value": "T16F647D1393E17C61E5268B329E2EC6E8775EF5608E59377B2258BB2B04B01F2D273711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695557903, "uuid": "cd5445c9-e5ca-486b-9701-c8695059092a", "value": "2d6b4f4a9e62e7d851c0b57974ea64af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695557903, "uuid": "c5cbd634-28b8-450e-b358-c7f68c5c51e4", "value": "3072:WBf8QN0ieyaqnbfwxEQ1wp1bC0MLx5LVslCR6X3Vr/ZZsM5AN0lvS:8f8e0DyaqO1HLVslCR6Vr/ZxyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695557903, "uuid": "af0367f5-2805-440a-b231-acc592365b8f", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695557903, "uuid": "16dcd005-8fe3-4071-a1ed-37a0d0e34372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695557903, "uuid": "e6332914-987d-4abd-8032-f2d4bf2ecce1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ef36c6-5ade-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695562334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695562334, "uuid": "c45c8f9e-5327-4353-97e4-c1277bcf2eec", "comment": "Malware payload (MysticStealer)", "value": "2d5d8d55e461986b5f3245d0a73a6643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695562334, "uuid": "f9369c6c-11ca-436c-b9d4-fd446aa81bc7", "comment": "Malware payload (MysticStealer)", "value": "b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695562334, "uuid": "4034f020-1fbe-433f-b1f3-9e4d4d998574", "comment": "Malware payload (MysticStealer)", "value": "755070b71b3fa2a8446256d0c0dac54be95b63fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695562334, "uuid": "fac5cdc6-3d31-4eb7-b6a2-92a725a14a98", "comment": "Malware payload (MysticStealer)", "value": "05863fa776a2622163b5a932685a1e717d50cd86b75daa1db764e619066aeec660710a21e99df2126850f67cf4c3bf1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695562334, "uuid": "098686de-4b4b-40fb-9524-2ea8dc88f571", "value": "T1AB84BF8DBCF28531D97260314EF5E6FD9FBF7910471484EFB7980AA90D206D2E63261A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695562334, "uuid": "816b6205-cc4d-4488-b6e3-68146cc1a36a", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695562334, "uuid": "cf13a0d9-f05f-4a09-9144-3e97cb156544", "value": "6144:Pq46fuYXChoQTjlFgLuCY1dRuAO3xkqJkcEsu1OGxkE7VRw8y0M:PPYzXChdTbv1buUqJMsXGyEVRw8yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695562334, "uuid": "882c4cc3-237b-4417-abec-a032e88dac5a", "value": 381896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695562334, "uuid": "76d7e202-d163-48ba-8896-a4b71fee0c94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695562334, "uuid": "5c059fb4-8d51-4622-af65-4b4810b08e83", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.22386.16364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa5a1c6-5aa4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1695537136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695537136, "uuid": "433ce5ca-12a4-48fb-83ef-86bf455ed395", "comment": "Malware payload (RiseProStealer)", "value": "e43fbcded51659471dabf49d791979c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695537136, "uuid": "4ae43080-42d2-4dc4-b31f-63422f5db365", "comment": "Malware payload (RiseProStealer)", "value": "b95f692cd08b542566781aa9b70b093160d19dcab106403ff5af6bcee89437fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695537136, "uuid": "5ea2a476-5f2a-45e4-ac40-cd3f970b9ead", "comment": "Malware payload (RiseProStealer)", "value": "70a747d8426e1f14e60b0791c870aef1b35fc4be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695537136, "uuid": "4f8bf0ab-ab90-43a4-9a1f-0ff1e0db9f74", "comment": "Malware payload (RiseProStealer)", "value": "695115e0fbe5eebb1e4e8aaca70ebd956e61273f870fc469db42d0f66fd567fa2f25b10faa42d90ded3d3d67820fece2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695537136, "uuid": "aaf0c123-068e-4318-8ce5-ab7425a2958c", "value": "T185348E01B4D18472D472153209F0DBBA5A3DB9604BD55DEFA7D40F7E8F306C2B632A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695537136, "uuid": "bde67f79-b12b-4284-ab9b-4e676d19ba4c", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695537136, "uuid": "28c245d0-a5db-49a8-90f5-f2dd4bf1e800", "value": "6144:q+46fuYXChoQTjlFgLuCY1dRuAOAzGfmQ1gw8y0:qrYzXChdTbv1buOGfmSgw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695537136, "uuid": "548d8aeb-9cc8-40b0-bda9-14ba6b4167b6", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695537136, "uuid": "59de9f86-5412-4ab3-bfed-abb00bcb44c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695537136, "uuid": "5dd6cbe3-24c8-48b0-8ab5-3ab509f143ed", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.2742.3185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6944ee5f-5afa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695574204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574204, "uuid": "82f3ee97-ad52-4442-98bd-02617136b3d4", "comment": "Malware payload (Mirai)", "value": "439d06dca9aaa46f4729412e02432484", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574204, "uuid": "2e62146c-f26d-485a-b3c6-51ce6c6d1968", "comment": "Malware payload (Mirai)", "value": "bc7ef3a55598fa507a3c735ce7ea8f400a043a91744d5fded179851d332ed6e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574204, "uuid": "1185b7bd-6647-4aaa-a519-f79eeca429f6", "comment": "Malware payload (Mirai)", "value": "8f1001cdbf4c25fd67a3189044940cca76c20895", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574204, "uuid": "9f0bbfb5-b6e9-4ec3-b59f-9ff9197a3471", "comment": "Malware payload (Mirai)", "value": "fc28f767bac93b9f2818e947dbd131c55dce088bb4be85fc4262b5d88c685ec91f7a6e400edd16dbb7cec2bd5c1b6d9c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695574204, "uuid": "886c9315-59ee-4481-9619-18b6789efa1b", "value": "T1ADA2E155BF1882CBC836253555E9EAD21252FC72F2ECCC193A40C15FF1A33A96870F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695574204, "uuid": "079971e8-eff3-4a65-a781-792c9e0ba63c", "value": "384:M0hLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAK9:T98o08kxofBE+ZkXaqGbp2F2TWul0c50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695574204, "uuid": "fe72dc26-27a7-44a9-8ede-527c52a116b3", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695574204, "uuid": "bb9f80a8-1984-4eca-94a6-01ec164b731c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695574204, "uuid": "13f865e0-3a4f-4b96-b2ff-0a4c666a9dd6", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae77da3a-5ac4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695551128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551128, "uuid": "2b6cafd9-e329-444d-94f4-6f748954794e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2a0d4a7ddeb25b4f5a5a0132c439e582", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551128, "uuid": "19438125-fba5-42d9-9ae1-5d39bc8ac83e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "bd0d5bd2155c8ee07f96c5f619bc7ac4ba3a177a97a6729ed6d19a3b35e7a7b3", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551128, "uuid": "1b48b112-0fdb-4ddf-8bf7-d415d9fe3b98", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ee00bd9ca4ba440379941622f08269abd72af1a3", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551128, "uuid": "3510ad48-0914-467d-92f5-fec3114c0e48", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "85b0b042cc87d0d22f1005e749285ccc992913e1fc3ce249a64bfe5fb6172c39c69d9a9821ebd6e3615fda28726ea765", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551128, "uuid": "d7989277-5861-4568-859b-b1d313eba4fe", "value": "T10634AE01B4D1A672D47215320AF0EBB65AFEB9700B5199EFA7D40F7E4F302C1D631A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551128, "uuid": "190c0245-a890-43a0-be89-0785f8726083", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551128, "uuid": "cb49f199-52de-4a3a-afe8-5f18a00c1444", "value": "6144:No46fuYXChoQTjlFgLuCY1dRuAOHq6btHSQ7w8y0:NZYzXChdTbv1buj1b7w8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695551128, "uuid": "17420c23-7f83-4d49-80c6-169e4b34c1de", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695551128, "uuid": "bb5a95d8-d120-4872-a5be-6dd8433dd6e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551128, "uuid": "dc85cd8f-56a1-40e9-8cfd-e3ee0f23f145", "value": "2a0d4a7ddeb25b4f5a5a0132c439e582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf2b412-5a92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695529785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529785, "uuid": "36268425-5aad-408e-b69e-3c2186ee4ee2", "comment": "Malware payload (MysticStealer)", "value": "08cf4ae16e4cce7aebb9305cd20d3973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529785, "uuid": "ae837759-f54c-4536-b848-2516d9d9a8e5", "comment": "Malware payload (MysticStealer)", "value": "bfb4eee283be58d338c3be6764107238535623494c92c2dd0e96a9dcdc3b1856", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529785, "uuid": "57075a6a-4ffe-46d1-baf4-38ac63643924", "comment": "Malware payload (MysticStealer)", "value": "7fcfe14da82311fa7446ef47d93140d5dff38c47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695529785, "uuid": "b6b8b1a5-4abb-4dbc-b4a0-968025b12a73", "comment": "Malware payload (MysticStealer)", "value": "1bd4503ede9db163610407324a06d183e0886ee6b6a9fd5bc920193ba5de2d54b62a7a4718aef56e08bfb9b22f5c75cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529785, "uuid": "b92b4cc5-0e47-49bc-a74e-100a67e7906a", "value": "T1B584BF80F4B5A4F3D872203689F0F6B9E67DB072B70449DFD794073F4D24E816A29A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529785, "uuid": "f1a736dc-28a9-4fe6-b4a0-ec3e5aa4ef84", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529785, "uuid": "c4dd481d-9f5a-4e4a-984a-9dbe2b364582", "value": "6144:1846fuYXChoQTjlFgLuCY1dRuAOZpaSXrLCM+yML3GsYTnlqRKEw8y0:1lYzXChdTbv1buhF+HxYTn0KEw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695529785, "uuid": "7fe5ebe9-612a-40d8-855d-103b92102a39", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695529785, "uuid": "ac956ebd-9a70-434b-8566-9783a39bf3f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695529785, "uuid": "46ca467d-bd1a-4276-83e7-82610301a9c9", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.22923.7782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069a421a-5af0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695569744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569744, "uuid": "0c20301d-7224-4e34-b15a-ba95e71ee3b6", "comment": "Malware payload (Mirai)", "value": "c4beba78346b9e6c0db6c926d9dca180", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569744, "uuid": "883823ac-7b7c-40e5-b55d-ac445887f7d4", "comment": "Malware payload (Mirai)", "value": "c2a87691e51b0ff1678c0ccf845d442962da1923da8634b220b474ba9472fbc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569744, "uuid": "ba098f8d-1b27-4d09-b5a6-5a5da678e3f0", "comment": "Malware payload (Mirai)", "value": "df36ec467c352e6e8685e2dc3e4a06209e8f6e81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695569744, "uuid": "12d52d7c-5a0c-4142-81f2-bfc85f891010", "comment": "Malware payload (Mirai)", "value": "6f69d8b67208917588837c3c2d5602f6680320ea6ad8c7216b2fd6788452a99eda1d7a3b65127f79de958539808fd72a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569744, "uuid": "06ecad0f-9ae6-4eb7-81e1-c66768a214fb", "value": "T1F313023202666FB4EBF69075D57A130D73555B28C6EF31673F2208983E03AC2AB60E57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569744, "uuid": "287c24e8-ed6b-4087-9016-02f6c4c7937d", "value": "768:rlbm7MqEuhrDYC9uol8rx69K20273LUc3iE8q+knY2aRQvw0Yq3UINe:9rqEu9Dpdl2xZ2+Eyww0fA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695569744, "uuid": "30f0afc5-425c-4b72-8125-8ff97bf7b8da", "value": 43664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695569744, "uuid": "fb8476c6-092c-471f-b51e-6aa5f2b25e5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695569744, "uuid": "3a93fbea-a9b4-4474-b8a3-1365cf196c9a", "value": "SecuriteInfo.com.Linux.Siggen.9999.23969.31587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09979d65-5aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695535819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695535819, "uuid": "1c16746c-97d8-4597-9ec4-b4d7e137c81c", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "aa36ac9045d69fa46563cb09182569ad", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695535819, "uuid": "99fd563e-50ca-4dee-9f45-d2fff092b275", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c2e62838664b4b65822e962644d04685b5be11cda159762c1986c6b191e2e487", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695535819, "uuid": "5734b418-02af-4fae-bbe3-d43e15525fbe", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9b3ca4ddd9c08c3af604facc4513f737f0e893f2", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695535819, "uuid": "b6ed9670-673d-4edb-9524-1f0d4273aab9", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9413cbafdd556037473d67fbcd4577f8d49f1257bddabf20ece76fbb1b741d7a7bca4b7cf5274219a92c1215e664e18a", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695535819, "uuid": "5a8be48f-5196-42ba-ba8b-537aafdc8817", "value": "T19A158D2139C49172EEE320B787ECBA3642ADE4B4071556CF06D857EED7606C27F32686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695535819, "uuid": "ffd9fe6d-1663-4a1d-9613-595be4794279", "value": "275c1ac8a0a90e452d90c6b023f705b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695535819, "uuid": "149b284e-2b5a-4914-98f3-24397731e840", "value": "12288:Xom/dPenqp953bJ28JAbfo8oJNFJZ5pTT7jKuLpHQBG7bL5:jFPenqp953bmfo88n1Tfjegl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695535819, "uuid": "591d73f4-a436-42a1-a17f-1079b9ac218f", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695535819, "uuid": "ae2d002a-9c73-498c-95b1-758e94b49375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695535819, "uuid": "ad3c8a87-c006-4bd6-82c4-505e7b744ec2", "value": "aa36ac9045d69fa46563cb09182569ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be1b12e-5ab1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695542721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695542721, "uuid": "bfa0d820-f159-4cf7-987a-9007750c7b60", "comment": "Malware payload (RedLineStealer)", "value": "3c2d12e547d70af30656e12cf0c4e4a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695542721, "uuid": "9ca1fd2b-7d72-459b-b2c6-66dd83c7c1d9", "comment": "Malware payload (RedLineStealer)", "value": "c30899444d84440defd946ca430816ca6a856a7d7dba7e34c446277b2cd1bea4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695542721, "uuid": "760af9b2-d15c-4dd2-bdfd-13269985f22d", "comment": "Malware payload (RedLineStealer)", "value": "1a41baebb14f9ba0a96e2c6cbe7be4f8aa3084e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695542721, "uuid": "b80c4102-b91c-449a-84f4-445b1d18d23f", "comment": "Malware payload (RedLineStealer)", "value": "1c3f9b8557887620bd71b1e84b10472aa4ad368f4917c8b90df726dce678986303be66ae8d7a424cd8171a989f1f46d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695542721, "uuid": "51326f52-7705-4a16-a6cf-438c2307bee0", "value": "T17B349E01B4D1AC72D472153209F4DBB65A3DB9700B519AEFA7D40F7E8F306C1B632A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695542721, "uuid": "1000848e-2590-44b6-a8f0-fcdb4ee52130", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695542721, "uuid": "9ec9f3ee-86d8-48ee-858f-05cfc652b16b", "value": "6144:dV46fuYXChoQTjlFgLuCY1dRuAOXVXHw8y0:diYzXChdTbv1bufHw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695542721, "uuid": "30ca850f-7df8-4755-b108-62ac5f4bc1ba", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695542721, "uuid": "f46346c6-2d18-40ff-b9ed-c05d98d69c28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695542721, "uuid": "3361e18c-f7b7-4898-a109-49221bb28b49", "value": "3c2d12e547d70af30656e12cf0c4e4a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d69b436-5abb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695547073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547073, "uuid": "ffe7ba1e-18ed-4a04-9c08-7ab06b60f64c", "comment": "Malware payload (Formbook)", "value": "41b8caca7e2c1ec36c2528fcd6a3f334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Vega", "colour": "#BA6E00", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547073, "uuid": "832721d9-d0a5-4849-8c2e-541ec875aa3e", "comment": "Malware payload (Formbook)", "value": "c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Vega", "colour": "#BA6E00", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547073, "uuid": "1f5e474f-a345-4d66-b11c-666017f5a046", "comment": "Malware payload (Formbook)", "value": "45ef2451a4916cf5c88e90eb1e4360f04ba3549e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Vega", "colour": "#BA6E00", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547073, "uuid": "5465a8d7-ebef-487b-acac-9070cbac9fd2", "comment": "Malware payload (Formbook)", "value": "e79ad5087c0c35a90be7a282096268635da7a59395417e59c021f9766646011c96f0747f7302846019aeda85a6d45c91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Vega", "colour": "#BA6E00", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547073, "uuid": "54c4fd15-dabd-4959-af75-32201e9407f2", "value": "T1016633C00DC9278AD72B0673625295387A7436BDC9CB3D53E5AC16DB41F1A6CE31AB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547073, "uuid": "24558e44-f71c-484f-bb8e-d4201171c5dd", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547073, "uuid": "760b65df-e72f-4871-9f23-f9aa7a433a51", "value": "196608:Rrp3ECTkyi+4l72FW1aq3BzV+gSYyPO6GEkhQAp6UFj4:VHw/lqFWYq3lV+gSYyP3GEkmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695547073, "uuid": "68405361-6162-41ed-b40d-21667e485ae2", "value": 7065088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695547073, "uuid": "16a457bc-f2bc-48f3-91ab-a1597cc25ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547073, "uuid": "a56752c7-782e-4ba0-82f7-22d315b4c0d7", "value": "VegaStealer_v1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a53550b-5ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695551309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551309, "uuid": "583f7c5b-4ec6-4749-9dac-968a8ea3ec26", "comment": "Malware payload (MysticStealer)", "value": "d4b7d057e49d1a06fbb7ed8adb79f514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551309, "uuid": "2f35838f-d8f1-405c-93d6-8976a30d2bb9", "comment": "Malware payload (MysticStealer)", "value": "c6490fdc23e3922af12fc09440c84ea282526917fcc9d7a4282f8353ab760711", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551309, "uuid": "2ed5f5fc-31af-46fa-b02d-7778818a91f9", "comment": "Malware payload (MysticStealer)", "value": "798a9b144a8464b9f55519d4f00bae70d2bc6358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551309, "uuid": "0d1f793c-821e-4aca-bf35-5333904ba2ab", "comment": "Malware payload (MysticStealer)", "value": "1d92a120ab5e33d78f75e67f93feabe0cd908d3d663daa9ae630a8e4291644281a0d9100b65b27fa079bffff5d862ff9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551309, "uuid": "ab4e4fb5-0b92-4156-8a87-0e9201268f6a", "value": "T1C184BF31F6D04871D8B2113916F09774163D7E610B6568FBABE84F3D8E627CD92E2A0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551309, "uuid": "77fe248d-69c7-42d0-af57-02e31c8a5a07", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551309, "uuid": "35bc631c-b302-464f-9b10-8f5cceceef4a", "value": "6144:1k46fuYXChoQTjlFgLuCY1dRuAOhCgxrKoD40i/5aws90+XLPdje/99xw8y0:1tYzXChdTbv1buygxrKoc5Bs9u/9Tw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695551309, "uuid": "ac0d2b99-c14c-4ba0-b917-fabe46321596", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695551309, "uuid": "351159c8-8792-4806-9181-e3628a4f409e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551309, "uuid": "3dd09590-8613-40ae-a162-e1f2702e6b94", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.21916.30336", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edbf4835-5ae8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695566696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566696, "uuid": "f42f0840-8dd6-4e20-b6f4-5af3c1a134a7", "comment": "Malware payload (Gafgyt)", "value": "cb3859fd8631c3ad046b68890583dded", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566696, "uuid": "df2c1f11-836b-4822-abc5-ed2cde41bb7d", "comment": "Malware payload (Gafgyt)", "value": "c6acb46eaf0a30193208843e1e7dac1c42891c1e1bd9e965d4bd56c2ff422281", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566696, "uuid": "99aa2a63-ce06-4b3a-a351-11551fbe2060", "comment": "Malware payload (Gafgyt)", "value": "0c45fe4f63a62b8b836a3ea613cf3e78e883ec9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566696, "uuid": "d383c3c3-aed2-462a-af91-391f663cd7bc", "comment": "Malware payload (Gafgyt)", "value": "6692a7d771a642f476bf25ad643b05584d9557f6f1fecc4fe6082c54c7a8101a7aefb1a9b7c7fa79b180d07c71a063bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566696, "uuid": "39f53eae-eeb7-4ce9-b009-080433313edd", "value": "T1E6B3182B7B270E63C1CA107115E30331AAB5E74538BE5797B9D0AEAC2F16AC438167DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566696, "uuid": "502ece1f-d726-4ad3-a9c9-2eeebaf69164", "value": "1536:ndB0X2jnXb/7QMXLCBZoM5eLt5tAKLvj+GmVm1EGFjJIe2Tg26l:nTkMXsZo8GiKmVmuGFjJP2TL6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695566696, "uuid": "5dd0959e-2fdb-4eb4-9c08-4d9e9d606fac", "value": 111013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695566696, "uuid": "0aa77784-86a5-41c8-9408-757af0ececc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566696, "uuid": "6c0c5e99-737e-4a4a-9297-63f57487fde4", "value": "m-7.8-k.blaze", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd38b87-5aa6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695538218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695538218, "uuid": "3719a422-d674-4701-8b02-b9940807a5a1", "comment": "Malware payload (RedLineStealer)", "value": "a7e57a14b5a4a9ded9ad54e822934550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695538218, "uuid": "66ceecd5-9382-4f42-bec9-40fa6f0a63cf", "comment": "Malware payload (RedLineStealer)", "value": "c7badb8ce0a8e5163d6a4f079b89322299a95fc56745cf6cade7661ee1c981ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695538218, "uuid": "632340da-bd52-458d-a309-ac1796d8023a", "comment": "Malware payload (RedLineStealer)", "value": "b59c8ecc124a1bbe1e0b118cac66e9da120e7a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695538218, "uuid": "261bc2b7-8e1e-482d-b78b-6293988830a9", "comment": "Malware payload (RedLineStealer)", "value": "f89def3a1725083fee0dd847475577f944e9249a0cd9652ae93925209a11029368ff13232756c752a8004e6fd0ae019e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695538218, "uuid": "3f5326db-a819-4e2b-a4ab-8a20f065b3d7", "value": "T127349D11B5C18432D4B315310AE4DBBA5A3EB9704B659EEF63A40FBE4F342C1E631667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695538218, "uuid": "615ba393-e0ff-406b-ae73-90062e82c5aa", "value": "dc563239367bde3bd3527a2dc91eeac9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695538218, "uuid": "5f8e9f2f-ed02-42eb-86b2-53d717d9c449", "value": "6144:sm5frpxdonyq4zaG2u5AOjeK5jqlEdkquqp:sYrp0/9u5les2Wdkquqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695538218, "uuid": "217a2443-9e3d-4952-bae4-e232f17ad604", "value": 246136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695538218, "uuid": "2f64cff0-1609-442e-a09a-7b1cfdd02ff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695538218, "uuid": "195fdda6-83c9-4a2e-9943-82bbe662fedf", "value": "a7e57a14b5a4a9ded9ad54e822934550.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085a10ac-5b09-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695580484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695580484, "uuid": "7f0da4d8-e293-4efc-9fae-d96d47784a02", "comment": "Malware payload (MysticStealer)", "value": "8c70aa8e2e0fc319fcfc16d45b2c92be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695580484, "uuid": "fc308472-7497-4c6f-aca5-64b9da0888bf", "comment": "Malware payload (MysticStealer)", "value": "c90b731a014d86b0d47786c43c6dd0a395762c966e5b3416dc98ad506d0cb6e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695580484, "uuid": "12e884de-6873-469f-a666-9dcdf6c1bbd0", "comment": "Malware payload (MysticStealer)", "value": "25060d765452449bbb4f13018fa83630efc4dcd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695580484, "uuid": "21f2e235-4de0-426f-932d-763d2f6ef744", "comment": "Malware payload (MysticStealer)", "value": "e0d52c12fa9028792b016a21e173139b44cd74270d622f29829805db662f2254a1e93e32f40b05880fc2c46923e7f160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695580484, "uuid": "b172c54f-abe5-4526-8c57-be2ac5d97b84", "value": "T13D84BF00F8914D72CA76193D88D0DB3D597EBA2167840DDBEBDC0DAA4E357C392346AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695580484, "uuid": "754c962e-ea41-4ee5-876a-83420be9fc8f", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695580484, "uuid": "a49d00c3-f4b3-48f2-b085-63e7590b240c", "value": "6144:WNQhUOqW5XJ6EDOpvOCm5MNuAOnzt1kkFHMc7q6d8I8jblRxod3Nnqwh:WN2dqW5sEe2uuRztukZ7L8P7oNqwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695580484, "uuid": "9fc865cd-05e3-4e4a-a528-2f1aa113de67", "value": 405880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695580484, "uuid": "ec38854b-d881-43c5-9e71-bfa858d9bdab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695580484, "uuid": "491c8ce3-7bc5-4228-a213-4b85f8e9e0a3", "value": "SecuriteInfo.com.Win32.Evo-gen.28213.32149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa88d694-5ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695558557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558557, "uuid": "9252813a-9d1f-49c7-a2f6-5ef35934b7cc", "comment": "Malware payload (Mirai)", "value": "98ae9fd16bd645d6b9cad85ff037ee10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558557, "uuid": "4055c0db-7a99-48af-80af-bc9f589245c8", "comment": "Malware payload (Mirai)", "value": "c9fc6e5b5c468d950238751f5d95dec06698d36ada5062c8968a48e5452b8016", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558557, "uuid": "94529b5b-bd3b-4ad8-b3ee-2547f3673598", "comment": "Malware payload (Mirai)", "value": "c7ac9301ce332d25fb974c9eff6252ba94c480a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558557, "uuid": "1885d184-97b9-45b2-b49e-258bc50d4eed", "comment": "Malware payload (Mirai)", "value": "0de6161ae00653ca9a4dd3f5076ef7aa37e947138a2d9af6d8b5b342b0fd00dc6ee5c30f36ad4ab57b3da84c063b5c46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558557, "uuid": "49f16c66-f920-4c64-bc7f-2185a499f247", "value": "T1695302009E2621729F009DB48637509EB31343F8D26F856727E0D296BAE2AF0B1FDD07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558557, "uuid": "2bd0889d-6d90-42b4-a869-7e3cb18984c7", "value": "1536:VgMMJTAnoO0Wfnjrb1tvYzRAkaUNcqejhz2tZC9zzladC:VNGTS0W7m6+czjB2XMzRadC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695558557, "uuid": "3eb4183b-351c-4575-aab0-8e408934d37b", "value": 65732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695558557, "uuid": "662d846c-39e4-416b-ac41-73f824a1f43e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558557, "uuid": "bf4cec52-0c11-408b-9a8b-471c0dc9e504", "value": "SecuriteInfo.com.Linux.Siggen.9999.358.6494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b58728-5ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695551308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551308, "uuid": "e7c624e6-2716-48e7-b345-0f099033506d", "comment": "Malware payload (RedLineStealer)", "value": "24aa7a6f4d895d142dae7d089506275e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551308, "uuid": "be234750-8f72-49f2-80a5-84626397c35b", "comment": "Malware payload (RedLineStealer)", "value": "caff8240330f37671da2a1e294d5e6e2a5c1def99eda91e0864a38a1cf9cfb11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551308, "uuid": "c252b70c-d59f-4bcc-84bc-efba37af05f1", "comment": "Malware payload (RedLineStealer)", "value": "46455040e71ab3f38cb0801f9a2ac9c2788efe3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695551308, "uuid": "daca0342-fa74-474b-b669-1814d25900fe", "comment": "Malware payload (RedLineStealer)", "value": "371f012ea4282f9055e7d3251fedf1a3213865d2874416f5e61b1bb8a345f5a227821b30680cbe9f9d16da01072e3d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551308, "uuid": "196084da-fd3a-475e-95d6-7418d6c44af9", "value": "T107A4C05393F17C61D5368B719E2EC6E8772EF5208E9A37AA2218BB2B05B01F1C573741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551308, "uuid": "a4b1210b-9cfc-4707-bcee-5a65015e90d9", "value": "310289c7e0b0f9cd306cd0cf8e539555", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551308, "uuid": "50c915ae-ee9e-4841-8204-6ba5d3364cae", "value": "6144:i6RUPCkJ4wHKgYs/XLZsKuADM9+eZ31MdJ2+ELaLF4d2U0lPC37G9C+ez:i7PFCwOs/7ZrEpB8U+C3o9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695551308, "uuid": "96b9b859-634b-4957-b281-4bf64d67a482", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695551308, "uuid": "c17e9b5c-b849-4893-ab42-406fa0a6faa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695551308, "uuid": "dbfdb8fe-ed23-4ca8-b13d-aac719a73329", "value": "SecuriteInfo.com.Win32.PWSX-gen.31718.10435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f2447c-5a93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695530014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530014, "uuid": "f101a196-5f1e-4877-91d5-58586c13ab09", "comment": "Malware payload (RedLineStealer)", "value": "60170cf6afe86e47050d017401235afe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530014, "uuid": "49054a3c-fe4b-4170-8f10-0e2a4b4c873a", "comment": "Malware payload (RedLineStealer)", "value": "cb75c635646eefd4968b22a2daf07a4197278a4c10271b5d56618199dcf0f46d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530014, "uuid": "4efa51ce-8562-4101-a16c-98b74bdca422", "comment": "Malware payload (RedLineStealer)", "value": "6f3f2baf9f569b38f1b7a675d7fe16102a65fd2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530014, "uuid": "60626328-579f-4d52-8206-3486b7d1d067", "comment": "Malware payload (RedLineStealer)", "value": "52a186f9df0cbab23893a7a06ab31d13d2a3010671d29baf01851f90436aa7afcb4b57fa882175745165908ea91fb6d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530014, "uuid": "3a6b816d-8457-4f7e-8047-250c174fef54", "value": "T1E9846A1DF4B0A4F3DAEB273314E3DE25FA2BA8A08B4E8EDF635407795A203C95523455", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530014, "uuid": "68207b36-a39c-448a-a86a-91ac4916dd52", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530014, "uuid": "f4069631-ef60-4010-8ee4-37cdb021f726", "value": "6144:PWAXnWyMhuCAA11eRNCYt0uAOph4dNs2Owb7yT2lWthF33dfSRMdWw8y:Pn3VMhRAUWCuQqcDlGf2xw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695530014, "uuid": "b805f02a-c59d-4bd3-9560-fbe7d393c6e1", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695530014, "uuid": "da1fdd01-013c-4c2f-91c4-439fccdc5c29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530014, "uuid": "fee573bb-3f7f-49ce-8911-228bf1936da6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfddb87b-5ae8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695566672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566672, "uuid": "1cb4e36d-02b6-44f0-b983-b39b327dee74", "comment": "Malware payload (Gafgyt)", "value": "e69ee3f7fd49ac99778c35dcac6e2fcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566672, "uuid": "18054ee6-fbec-4128-a96d-5d790e100fff", "comment": "Malware payload (Gafgyt)", "value": "cfe3adbbc9d09bc15a7e8be04c938ae2bb379489194075099eccc6e6d5d2b0f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566672, "uuid": "f6085789-81d0-4845-97bb-6a347b9f5b20", "comment": "Malware payload (Gafgyt)", "value": "68469e3a32d1727763ad12acde2195f44390e615", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566672, "uuid": "5c2f5032-c840-4bc9-8a27-1ee834097ccb", "comment": "Malware payload (Gafgyt)", "value": "40ca7b7f53236f8266efeab2b53a7bfebf4ec154dd0ea0d4c354cbc6d3bd621458ef0dd0789d4ae0c95f428dd46dcff5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566672, "uuid": "3dddc252-8c86-4fc1-a405-cc375df9d982", "value": "T15EC31805D4508717C2D227BEF7AE429D37336B64939B33225A24BBB81FC279D1E3A121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566672, "uuid": "7af5d29c-09d2-4680-8521-18131becd455", "value": "3072:2gQPIVBtii0za/T7Yc1v5AuJgIOVfsnUmXQRshXqwQ:RNBtii0za/T7DJgIOFsnUmXQRs1qwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695566672, "uuid": "e2017a5b-7962-4e7f-b090-938e96ad443b", "value": 125697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695566672, "uuid": "0f1cc7f1-8f6d-4c3b-8b2b-be7db423d0fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566672, "uuid": "b7c4687b-cdcc-460c-93db-0f001accc888", "value": "a-r.m-6.blaze", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1941d5-5ac1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695549730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549730, "uuid": "b145769a-7912-4559-a5e8-9e124b844589", "comment": "Malware payload", "value": "64f99023e9ed80ca062a201af692441c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549730, "uuid": "2b8d60cf-db4f-4267-b887-bd6da4d89abb", "comment": "Malware payload", "value": "d1f8afab318e9df57d53b5b960846859d7a4a88efb0c68abffe925e8789232ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549730, "uuid": "9e267e0c-1930-4028-bf42-c20d00bad445", "comment": "Malware payload", "value": "df96fe82d3b410f69fb997720374ba4aeb2b2e34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549730, "uuid": "92014abd-b99c-426a-bc7f-52ddbfdcc4eb", "comment": "Malware payload", "value": "9a4459211f8e7e68b6fbf0a4c029b3499965337c4bf3a7d7cf84590930621f0ea96e8793af09768b1441710d6c92f9b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549730, "uuid": "71e59040-8ac9-4463-9dd7-11479a355772", "value": "T1340733E413480992E8E6A53EAC1FDC6A1167FD822364EC8E83F195344F53B562D7BF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549730, "uuid": "b70934bb-bf7d-460c-bdaf-f442710a1079", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549730, "uuid": "8d5d3841-224d-419e-b6f4-e7a9cb02faef", "value": "393216:sqPnLFXlrPUgQpDOETgsvfGeg/g1yoJvEGeOZwLq:dPLFXNPtQoE5agagZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695549730, "uuid": "8d81fa07-5db8-400f-8ed9-b60a528bd675", "value": 18441885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695549730, "uuid": "5cd3a364-e278-4cb5-b6fd-86317b728272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549730, "uuid": "4a06f8e3-4238-4b03-8f70-d0387df00d73", "value": "binbincheckerlqvw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5fc6f5-5abb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1695547235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547235, "uuid": "11c54707-1963-4f10-a079-491377847ac7", "comment": "Malware payload (Amadey)", "value": "a00c7c1867d9e31f4c2adb273adae424", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547235, "uuid": "c100456e-e9ac-4250-bb2f-f1a9e69d8f48", "comment": "Malware payload (Amadey)", "value": "d36d3e3be73c9a4ef91dc2377ad84bbb26f158680a46c2512b212e8181984dee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547235, "uuid": "be83a3be-8dae-4cbe-b33b-e64b0c0e6f7d", "comment": "Malware payload (Amadey)", "value": "00ffe6a11daf090bc8be833a5441d6907d0df2ed", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547235, "uuid": "f06032de-87f8-419b-aad7-b8c7819aac78", "comment": "Malware payload (Amadey)", "value": "cefcb12f29efe5069a00970357ff38f64f6d9f51f34a3f2091bb0428eceffeac6cd50173997336bdfd6fabe17e98d7ce", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547235, "uuid": "11c60d65-6d0a-476e-af3e-f459910a6aab", "value": "T1EFA4AE11B9D280F1D863153101EAE7769A78B9318B719DCFFBC41D78EA3A2C0937925E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547235, "uuid": "fde7250b-5a9a-4476-b8d3-23ff8f1eaad1", "value": "f6f05543bfd8242a24ed7d1738a5cdb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547235, "uuid": "9a8b8c72-3480-4d4d-b927-c58ff9cb0c42", "value": "12288:CJGR4j15DxM8CUyMg0lrCgsImbFpYROEa:CJBZ5DTCzMg0lrCZXFpJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695547235, "uuid": "98ae0963-52aa-479a-8721-6e71bb6f8aac", "value": 475216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695547235, "uuid": "3565d591-5461-4e39-919a-902bd5967fdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547235, "uuid": "8a1e08fa-ea45-4ee2-9b23-bb2221045f4f", "value": "a00c7c1867d9e31f4c2adb273adae424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03355957-5b07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695579617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695579617, "uuid": "677f121c-bb3a-46e1-b15e-b539ed0c4235", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d242355dfa20d58280aa72867f41ce60", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695579617, "uuid": "74b48d1f-9f5a-44ae-b4ac-32d4f5afa881", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d41ca3f8c094abda9409b9c405bdcdf6eb79856a0ecf5ac3a358c2fc6760f7d4", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695579617, "uuid": "7bcae797-e02f-4073-87ee-3080131a90b2", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b47064bde013cee0e949010e529a89e4f6a50228", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695579617, "uuid": "f924ab6a-1a0b-4e93-bb26-e3069b59b3be", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "bd1f16e768a64639318929000ee2870cc169198ab56032791330c0ac29effc1d4aa21cd7fef7228a797bdd9da94b43d2", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695579617, "uuid": "ae9825fc-3f0f-4d8f-965e-23edc205de7b", "value": "T15D646C1393E17C50E4264B72DE2EC6E8B72EF6618E69776A23185F2B08B11F2D173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695579617, "uuid": "ac91c92d-fe90-46d4-919c-26ebd6b07375", "value": "089d1b85a24796da8e36040b0bf10205", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695579617, "uuid": "5195fe71-b0ea-4073-b1f1-8476bb9dc817", "value": "3072:ov/XR0GYhaljdPaVkLaVtXXdF5APx8BaOxWCB9vjXydh+:0/h0hhalhPauLItXNF5AP6aO4CB9vW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695579617, "uuid": "6e1c4ad4-bd53-400d-bba7-c3086ca2dbf8", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695579617, "uuid": "ce2ada81-2314-4b2b-b58e-38ea94d6e37d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695579617, "uuid": "5feb5ec0-fe72-4bda-ad9b-e15b5ce24b3d", "value": "d242355dfa20d58280aa72867f41ce60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0835ad-5a94-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695530320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530320, "uuid": "71c49c51-ea3a-451f-baab-6ff4a6e308ee", "comment": "Malware payload (RedLineStealer)", "value": "97f6bcf042f49088a23f18f2eb535574", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530320, "uuid": "39e36bbf-603c-4084-a250-2ac669091a5a", "comment": "Malware payload (RedLineStealer)", "value": "d788b57c63f3c366d5771b86feb1f0c0a394656feefef3f6f18bda1f8380d4e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530320, "uuid": "d282bf1c-eea2-4f29-950b-9789719fa5ed", "comment": "Malware payload (RedLineStealer)", "value": "37c12d35bd887509c5b4903a6eafcf7536486f2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695530320, "uuid": "e9503d7e-b627-4668-b19e-a44e413c0914", "comment": "Malware payload (RedLineStealer)", "value": "eb5a913576a0ba9e5f4616699ccebff32fab65a554fcaa89817a11288a6c07f9304f28b3ee05afd04942463a078a7002", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530320, "uuid": "8537d4f1-c570-40b7-aac0-9d03491de147", "value": "T1CFA4D013A3E17C61E5758B329E2EC2F8771EF5618E69376A23147A2B08B04F2D673711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530320, "uuid": "be8afbd6-e62d-4afa-b78c-0a37c3ed8592", "value": "915313f9baf3d4fbe9e467fb8242a50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530320, "uuid": "9f127240-9aee-4bda-9237-71ad203490c6", "value": "12288:kHTQFlLgNNjMfPPU1ukaAiAOk/n8q2ucr:zjg/GPkMAwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695530320, "uuid": "63def6c2-ee71-456a-a01a-5e4d08a901c1", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695530320, "uuid": "096b62b5-9f5f-432a-98d8-8a8adb7fdd74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695530320, "uuid": "0d37ea9d-913a-49bf-a30c-3cef8d21f2a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e726260-5abb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695547128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547128, "uuid": "4053f054-fa07-46e8-9507-ba36a8ef99fc", "comment": "Malware payload (Smoke Loader)", "value": "ce74b480e13742a0d2f8deed668ce619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547128, "uuid": "ae09d10a-e9b6-4384-b5c5-82e1bb206100", "comment": "Malware payload (Smoke Loader)", "value": "d80b243ce613fad00db08c6614db68527af554e6d3996aa06609ba811268089b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547128, "uuid": "2c272e05-4202-472f-91d2-6870ce0f46e8", "comment": "Malware payload (Smoke Loader)", "value": "e093c0fe0137f014fc843cb3d87c380bea61c6f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695547128, "uuid": "e76bc303-375e-488d-9ecd-e790d3ec45ca", "comment": "Malware payload (Smoke Loader)", "value": "9d10ae067c4b1806a82b10ea60eae01a6c93146189b31f4ac5d3863de1368cffbe5ca569afc301cf534fdc68ec84e764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547128, "uuid": "b73dbb09-6c98-4696-99c2-cd1ad8b77b01", "value": "T1B0647D1393F17C51E5364B329E2EC2E8776EF1618E69376A2318BA2B08B02F1D573751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547128, "uuid": "7e64eae1-0e38-4cbc-9ae8-8f541c5789d6", "value": "5208e0d407d61105b978bd2c2254eb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547128, "uuid": "7f14557f-ad7f-46c0-acfd-4aa6a8fb1283", "value": "3072:Df1xKDdnkXDYu67soFYkcpPcJzzxcG7iU7cxq5qEURI7KAcD35pJC80ljvj:j1xKDhkcu67sQYkcRo2fHCKAcD35u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695547128, "uuid": "5fcad84d-76b1-44e5-8da4-33aadabc4fe4", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695547128, "uuid": "db396c90-f926-4946-b158-416d8e9fc9b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695547128, "uuid": "3d92bffa-1e9f-4f35-82aa-92af3690decc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75550f61-5b2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695594841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695594841, "uuid": "a288e6b6-439d-4507-8a78-293b42927a62", "comment": "Malware payload", "value": "70d22bdea653f9f0b2a65639412ea29e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695594841, "uuid": "768cb6bf-3dec-452a-9436-88255ebc3796", "comment": "Malware payload", "value": "d8b000c612b2ce9557ce07cfe8067b5d7e6bfb5039ccaedaa6df5b21cfbbf473", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695594841, "uuid": "6e749895-4e7d-489e-bcc3-887a7337cf59", "comment": "Malware payload", "value": "0a4ddd847743f3407902cab38851aabec6824341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695594841, "uuid": "4b649d72-e061-40e8-acd6-fec71d7963a3", "comment": "Malware payload", "value": "ef5cadacdc30704cbca59ec796281223ccbd536c005be3ec7c14297af0b00fea97b6aa778e4d5b2ad965d52803c427df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695594841, "uuid": "68691fbc-0015-4005-96c2-d31e61bef92d", "value": "T16544AE01B4D1A473D472113209E4EBB6BA7EB93047515AEF67D40E3E8F706C1A7327AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695594841, "uuid": "11a6347d-ec45-49a2-b0d5-622123cacd52", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695594841, "uuid": "16c5121a-9c64-40c7-b286-4b98356ebed7", "value": "6144:NRBhrJ+j+5j68KsT6h/OCy5U9uAOIAt3r4hQ/+g8CEqw6:NR3N+j+5+RsqGGuDJmQ/+g3Vw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695594841, "uuid": "39a69ec3-0a5b-412d-90bf-47dc6980e87e", "value": 277368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695594841, "uuid": "1e7d5dff-a63a-4085-8b4f-9f6896c8a421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695594841, "uuid": "a4571703-e523-46c5-9468-aff387568a86", "value": "SecuriteInfo.com.Win32.Evo-gen.9690.15233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b191f78-5aeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695567604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695567604, "uuid": "ef155ecb-fc52-431d-9f9d-0f3f9a94bd3e", "comment": "Malware payload (Mirai)", "value": "95f6571ecfe1d6ee7c883aaf68a36e23", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695567604, "uuid": "4f49a36c-2aac-4a66-b232-18ff1b2f193b", "comment": "Malware payload (Mirai)", "value": "d9684e6929e9f819dd3d03b04e31469e08f2f434d4f11642b7ac06770479c4c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695567604, "uuid": "8e0a84d8-5efa-4872-afa4-fef62d2acc9c", "comment": "Malware payload (Mirai)", "value": "94b10791a2655c799180aafe031c7a15fc91633d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695567604, "uuid": "c5906150-d22b-40d1-b4f5-9eb460c6ed7b", "comment": "Malware payload (Mirai)", "value": "d931d52a4baf63be6072db79fa601a66f1cda2a69e3c22f782489587a460a45c223226a2282162aaeabb46f25059facf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695567604, "uuid": "b4966edf-a107-432f-b628-535cccf966dc", "value": "T1A2F34D46FA808B13C4D52776FAAF424933239754D3DB33068928AFB43F86B9E0E63515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695567604, "uuid": "a1f102ec-d40a-425f-a0af-bb1006a6845f", "value": "3072:Q8gd6hAWmQ2rHaZEIUdMYcNN3sPwj3PCaQzvM/92JId9i:Q8gVWRaHaZEIUdxYN3JfCaQ7M/9H9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695567604, "uuid": "cc7aa16d-3f0b-474f-a6e0-ef11cad3229f", "value": 159536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695567604, "uuid": "0053b21d-0d04-42c3-af15-c5798282e848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695567604, "uuid": "2bfc726f-10cc-44dd-b00d-63f16b9d48c5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8444191d-5aab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695540320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695540320, "uuid": "0fa92c89-a7df-42f9-992b-f4960405e255", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "1ab121af3dafc35b613a3afc6f406361", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695540320, "uuid": "203b1cd5-37f1-4c5a-9195-ae629f9abc98", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "de472f9015eb4c73d4017d1c4c10962372cc72ea5750fdc68aaaf7396fe244a6", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695540320, "uuid": "b2d41a04-f6f5-4b18-a952-5a9fd792feea", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "09f90cf1f15017ba312b1132e1d56e89967cafb7", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695540320, "uuid": "e8469d94-2ee4-4c81-aab8-ec4eb959e9d5", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a93fea3170bfe5a655ddc8b8d9c3b3f4a32bc0724a11f2778b46aafd2a9a0d66ada0c8a45e6556e24f685963dc7103cc", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695540320, "uuid": "771357a1-792b-41d5-bba7-f8475d88a4fc", "value": "T150552355BFE584A2D8AC6B304DF743C723777D924974866F2387AC9E0E73680582272E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695540320, "uuid": "c16411c8-ee3f-47f2-9d87-5707ad079e7b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695540320, "uuid": "3a6716f2-41ed-4e9c-914f-4ca09dddb56a", "value": "24576:lyn2jJVVlIlwsKg0+NphS9v+Z0/bMGx7FLiOno/QNr:AnYJVVDTG0/bMg7pz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695540320, "uuid": "0de988ea-554b-4d80-bc01-3a9fb5b3aa8b", "value": 1293312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695540320, "uuid": "7af397e7-1332-4edc-99fb-78ac21e3d061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695540320, "uuid": "5d3b4957-c166-4138-8b41-f55561e0f5c1", "value": "1ab121af3dafc35b613a3afc6f406361.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6974dcc-5ade-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695562335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695562335, "uuid": "a1c05681-a70b-4fd9-aa27-6fb226629756", "comment": "Malware payload (RedLineStealer)", "value": "df9a4ec558094433ae719046f81db271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695562335, "uuid": "5df4e344-4e09-4d47-a254-102a1fda64d0", "comment": "Malware payload (RedLineStealer)", "value": "e1679d89ca8d249d11e9d66aa0234a8f090e567ecca6ad806075b8d3bb0a7674", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695562335, "uuid": "cae19af0-6b56-4617-a0d8-9974217e8ad3", "comment": "Malware payload (RedLineStealer)", "value": "d8280d861013bde39ef955ed164b266d8f99ffa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695562335, "uuid": "25da8053-d745-46cf-957c-ec717d86cdf2", "comment": "Malware payload (RedLineStealer)", "value": "763d34216747722a18f54051e0e9252a88d83b1777c61fef4940dfac88bcadeb13cdf5a54b75d6f45257e38eb52d2aeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695562335, "uuid": "b75facc8-a997-4874-9061-7480ec1299f0", "value": "T16244AE00B4D18472D472153309E4EBB69A7EB9304B555AEB67B40F3F8F706C19732BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695562335, "uuid": "33aad68d-0f0b-4136-aa27-0b71c502ce09", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695562335, "uuid": "45367329-11a6-44c8-9020-dfcb056bebd3", "value": "6144:8RPhrJ+j+5j68KsT6h/OCy5U9uAO7AQ7IIrLwINqw6:8RJN+j+5+RsqGGuyHICw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695562335, "uuid": "624a6aae-b4e5-4c55-9872-65cc3ebde7a7", "value": 277368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695562335, "uuid": "d677901f-237f-4b5a-8743-b809ebbd8313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695562335, "uuid": "8e4d02c4-cc5b-4715-b157-41f37e6c0e3f", "value": "SecuriteInfo.com.Trojan.Win32.Injector.9143.30241", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d5e657-5afa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695574115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574115, "uuid": "b47ec512-b8a3-4f03-aee8-f847882530c9", "comment": "Malware payload", "value": "9413c8a57a1ee67623946d3c34ad2b2f", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574115, "uuid": "877aad73-4458-406d-92cf-bcca7b715a20", "comment": "Malware payload", "value": "e1d6fce02225d2c53c998780a6145d6ac85769a94eb8e639498bc7a49d61b043", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574115, "uuid": "bf35bb4f-f753-4ad1-a71f-9344d1dc640d", "comment": "Malware payload", "value": "b6c08e09a0a853b0c172201e943b432834d44c99", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574115, "uuid": "c00dedc4-645f-4e3e-b29b-e04fc2b2bb92", "comment": "Malware payload", "value": "eae84f074b89089e76d1aa7e1ecdb2720d3b6285d3fd84fcb72bc9a0e95f9d5f098c7655e36ee72b1bde757191b1aeef", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695574115, "uuid": "a87d4b15-f3c6-4a10-9760-ea18f96d7564", "value": "T17873BF42E9C84476D166027D17763AB599B0F5FA3651C18A7A8CCCE4DBD1CF092273CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695574115, "uuid": "906dfc5f-e093-4916-80f0-1aa60b852fd9", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695574115, "uuid": "1ac9a55c-ee9e-4988-999e-9fb08340b2ea", "value": "1536:IkjymPrPZKeJq2ywbjBZGTXTxEbo10SD+nLMb+KR0Nc8QsJq39:BjPT02hBZGbSboTqnLe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695574115, "uuid": "10bf69f5-2a8b-4d12-a5a0-5b163bf1ba3a", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695574115, "uuid": "816efe21-365f-4e6f-a9b9-133608e072b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695574115, "uuid": "32166fc9-f899-4b63-80bd-3a1eea3d25ea", "value": "ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3915b7f7-5ad2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695556944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695556944, "uuid": "21d5c6f3-b343-4190-acfa-2e072594f2e4", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2ba491f6b487017a1c58b647a7e05d3c", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695556944, "uuid": "4f564536-3f36-46cb-800c-637317e15889", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "e46720cac2a8956c652db483c7dd7b7fe0bcf7cdf8653d9687159e6355a17d7b", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695556944, "uuid": "a8af949b-c088-43d8-94af-b73b851c5d89", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b5b7f44bf018de87168323cceb09a0934ea661e0", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695556944, "uuid": "4ffa419c-e1bd-44a4-bc22-255d79f1a0ee", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "8cbe7ec11899294d3ad49a8654b592f6f76571bf44440b74d222ada24af62f6920e98048c10d7b168ead874ee4f9549d", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695556944, "uuid": "92b78821-b2f9-45de-8f98-ac9e6a6df5bc", "value": "T1A4646C5393E17C61E4268B729E2EC6F8775EF2608E5D37BA2258BA2B04701F2D173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695556944, "uuid": "3f37f144-825b-4425-b13f-b88469254a3c", "value": "2d6b4f4a9e62e7d851c0b57974ea64af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695556944, "uuid": "076c9b42-f744-4106-930e-60c7405d3d7a", "value": "3072:9TW8uN0G95ahxyZvs3wMkT8UcaQdJyzYQoWMSCfUC7wgsMet0lvS:VW800s5ahMmvgPcdeY/lR8C7w0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695556944, "uuid": "4d6fbb65-83e3-430c-ac50-86f571d2ff79", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695556944, "uuid": "4b1e5fd2-d29a-463d-abd9-e9faa65ceae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695556944, "uuid": "63c7afec-8a4e-4542-b162-62589b41b5a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e852e08-5ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695546323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546323, "uuid": "fb3b6d6a-f080-47d6-b3e3-76681054be21", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a870b3e4c3dc630b5f0149f633e45312", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546323, "uuid": "d5191385-0f38-49ea-b2f4-d6a151e87085", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "e4e363ba2bf7ba09114982630a3de87d42ee99a9c3f2ca25f410477d83b354f5", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546323, "uuid": "3f6cffd7-4fee-4446-90cf-4dc9293b484a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ac57e8e0dfc8dd7c1a7175b14021ade6ca546312", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695546323, "uuid": "9d34dd29-9c25-44c7-a7a0-1a772416c89c", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "565e1a0f3af3b657f3ace3d459e18f6b85080c9d35478a4c7ef63a0d121d9d73ffab69d0a9926ed84413f4ccbbec0768", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546323, "uuid": "f3b1a424-4c21-4f5b-afa6-b262042e0544", "value": "T151349E03B4D18473D472153209F0EBB65A3DB9680B619DEFA7D40F7E8F212C1E635A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546323, "uuid": "411ed0a7-c175-424c-afe6-98222e124692", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546323, "uuid": "b17c269e-ddc3-4f48-bdc7-fb0ec7a9c3c4", "value": "6144:tY46fuYXChoQTjlFgLuCY1dRuAOrKI7w8y0:tpYzXChdTbv1buAGw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695546323, "uuid": "ae059f8a-2a96-416e-a4b9-ad97b3de4498", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695546323, "uuid": "aadbfa2f-8f43-478e-99b7-8a92dc0b84fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695546323, "uuid": "9868df90-d513-456d-80ec-15974b7a58be", "value": "a870b3e4c3dc630b5f0149f633e45312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17d7804-5aaa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695540020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695540020, "uuid": "0d5b8d09-cdc3-41c3-a17f-f1a52770743c", "comment": "Malware payload (RedLineStealer)", "value": "d190932ff973f26e272e1316e53d91df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695540020, "uuid": "3b479d01-ae01-416b-b64d-4aea68ac6eb4", "comment": "Malware payload (RedLineStealer)", "value": "e5eb7faa4b2f9b410813a6a7a13a9dc9516185b0d149ccf3afe9299e33f779c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695540020, "uuid": "fba5be05-1aa0-43c5-ba31-015e0aee4de2", "comment": "Malware payload (RedLineStealer)", "value": "e87f6ce2086934b16eaffedde6d08734bb7e3540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695540020, "uuid": "b596e118-5dde-484e-863a-6aaf5d5adf76", "comment": "Malware payload (RedLineStealer)", "value": "cad38bbee342ade548897fcceaa9c46e1cafe13c8f4e3dfd3f9656a41d50beefd1b245beadd8b8f9607ccd0287a8d50c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695540020, "uuid": "5f888768-67d4-4692-bc63-b1527af220dd", "value": "T1D245235AA6C849B1CEF653300CF222971A3D7D02ECB4563F2703654CAE75B48B971B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695540020, "uuid": "cd9a5a76-f7b6-4524-9e92-72b67317a2ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695540020, "uuid": "8b921a66-2e8a-4635-9e79-22882a9f4d77", "value": "24576:kyh8Gl/8wr9mgRZKspjMIJLm9/zcA4LJVMZuqiwO3L0WS5EhDPdOP:zqGl/vr9fRZKmLfvSiz3iEJP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695540020, "uuid": "b370ba08-d986-47e3-a7e6-15b464165bf8", "value": 1257984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695540020, "uuid": "f25aad25-e938-4494-8ff4-e8ae6ab5166c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695540020, "uuid": "be9aac26-f11c-457c-90fd-d2821b9ce0d7", "value": "d190932ff973f26e272e1316e53d91df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906b45a9-5b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695585008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695585008, "uuid": "3f1ef62b-6134-48de-b78b-3f5f5e94e1d9", "comment": "Malware payload (Mirai)", "value": "2055cba6daa0a917a390e4f3a4c810ea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695585008, "uuid": "9d701b52-be2a-4b2d-9f90-cccf52725fa6", "comment": "Malware payload (Mirai)", "value": "e7725a3b41caae172d6953f5094acb6090c5e1e6df623324edcc058072fdf1bb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695585008, "uuid": "dd0e6a00-b374-45ae-b6ea-8deefeb9fcba", "comment": "Malware payload (Mirai)", "value": "73798512cbaa2f66628d302ea87b823badd164af", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695585008, "uuid": "255718f4-85f2-4f29-9afe-c77f44cba6f8", "comment": "Malware payload (Mirai)", "value": "a637e39d47e1b9445853e929d581f4ef8b1e6a1df1b990a28b594359d862a54e5ce51cc9cafb3d3f5a1330123f873cf1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695585008, "uuid": "e73c9963-71c5-4566-a7a4-f6315a2e6764", "value": "T1B9633992BC819612CAC413B6FE5F519E371213D9E2EA7207AD15AF2037CBD1B0E77252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695585008, "uuid": "5a90fd60-ca6c-46e1-9518-a25cfa5bfd0b", "value": "1536:zSDWsMHjmC8XrdbrtP0HZ0YbwqqaxgFDvyt0X4N70RXtvz:zSPKjm5X5FYEZ02vk0wIPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695585008, "uuid": "86623838-6a21-4716-a33a-ae59977c475d", "value": 71988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695585008, "uuid": "b0e90780-0c24-4ca5-9960-7472e017ea0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695585008, "uuid": "e094dbca-c34f-4abc-861b-69d153edde26", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273af096-5ae9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695566792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566792, "uuid": "f9960f89-b5c4-42f1-baf7-4574ca3d56c2", "comment": "Malware payload (Gafgyt)", "value": "6b245d02eb55a41bc881954f9ed415ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566792, "uuid": "2ee5677c-e88a-45aa-b1a8-4035a5a06131", "comment": "Malware payload (Gafgyt)", "value": "e79f6fd8ea847e4051109a8e00088e5fd1f3ab371658691e96db888193dae3a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566792, "uuid": "5bbcf437-3cf6-4fc6-af64-a6ac1e405e20", "comment": "Malware payload (Gafgyt)", "value": "816361dd2e40967ce01917139b5bb4a50867b953", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695566792, "uuid": "1922dd21-6318-4523-b05f-ad137c331ed4", "comment": "Malware payload (Gafgyt)", "value": "2af46aa62a5c6022cd47e9ebc5988fb8da457369b56d761555461bed50b7f418795e1c340c8f6243d18d807c99b97dec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566792, "uuid": "90d39b1a-0f3f-4911-bbb8-d95a95e1b65b", "value": "T12E832C46E643C6F3C8830BF5069BF66A4631F9290E2A8F4AF71C7CF4AB168C47215765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566792, "uuid": "660e5e3c-b263-4828-9c33-93fe6c676a32", "value": "1536:0FJSfNKIykWjImuHEWNCyeMijcyRlEyN0rahlCZINBvXwMmFoxVHkIRQTYjD:YSfNKoWjgAnMkcyRlEnrayZcXm+xVHk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695566792, "uuid": "343e4014-0ed7-4ae4-b424-2ae103d8527a", "value": 83706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695566792, "uuid": "4d1d4309-00a7-4c86-8f38-2bacdc19c3ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695566792, "uuid": "ee4fe412-e30f-4273-b1cb-043876b722b6", "value": "x-3.2.blaze", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e51773-5ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695558556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558556, "uuid": "e1620705-e3cf-4860-880e-dafc9decb4cf", "comment": "Malware payload (MysticStealer)", "value": "6ab89a92531ac59f30f7229a21166d3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558556, "uuid": "8ab615b2-b831-48c3-921f-b53ade8003dc", "comment": "Malware payload (MysticStealer)", "value": "e8023b68d5a9c7c7dd7a0ac7a2026c7e4af92c48466a8977e3490723222ad9fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558556, "uuid": "347bb433-b451-41a6-9ed0-c0453b029c8c", "comment": "Malware payload (MysticStealer)", "value": "69575a527642b40f553b1b1edf49912eff0ee6c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695558556, "uuid": "3059ea2d-0f24-4206-b2b9-92cec42344b3", "comment": "Malware payload (MysticStealer)", "value": "2cd1de6d785861b1560b893700b0f599df4f475a5bf2789872f97fe41300bc927e722cdbc2e3746296e502cd71d0f3ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558556, "uuid": "eba3895b-ca0e-43d6-8bbc-a30f07344f45", "value": "T195849D0575C181F1F937393759A1AFB5CA3D7A20479108EF63A01A7A4F232C0ABB6D56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558556, "uuid": "14b769d2-c535-4912-84bd-87fb8dd67339", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558556, "uuid": "cc6ceddd-8bf4-4069-9ebf-bb6fbfcfd3c9", "value": "6144:RG46fuYXChoQTjlFgLuCY1dRuAOFVFlywWmMksz80paGy6NW3wF82bJ5Zw8y0:RzYzXChdTbv1bu5FxWY87VbNW3wFH9zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695558556, "uuid": "09b84b78-b6e0-483e-a6f2-d7b87a830a08", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695558556, "uuid": "5f9305f6-ff96-471e-af5b-cf6c8428f685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695558556, "uuid": "cb4bf635-b72b-4969-ae4e-7f68a771a469", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060798aa-5aa8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695538819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695538819, "uuid": "15e7ed78-7b51-40e7-8663-5c1a24dbdcef", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "bc8614702b1e5798a24f45c8b08faec6", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695538819, "uuid": "667c6ce5-be40-45b6-85a0-f87f951398f0", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ea8021233b5497626196cca57f8c208dc498fd50a1520e80aa7a5b19fb559e5e", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695538819, "uuid": "2297730f-9cd5-42b3-b99a-7cc8ee026f7a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d661c45f5e1aed5d47ef0ed1a082a969f9782527", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695538819, "uuid": "549359c9-376a-43a5-80ae-6d6e3bf9cd8d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "569a30548762b5adc182d16d3dbbae868d7f1723ca68b2505d22d9b748b6b181b4089a026e35a6e840bd1cebddd364e5", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695538819, "uuid": "ea0ab3bf-62c3-4529-ab35-077118a5397a", "value": "T11E34AE01B4D18472D772253209F0EBB65A3DB9700B659EEFA7D40F7E4F306C1A631A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695538819, "uuid": "323e0172-660b-4fa2-b3bc-7a96db42f6b8", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695538819, "uuid": "04df07ca-3561-4d4b-91ea-3fff6aa5d57c", "value": "6144:kq46fuYXChoQTjlFgLuCY1dRuAO+4MI7svw8y0:kPYzXChdTbv1buH9ovw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695538819, "uuid": "763e17b8-bc6f-4eb5-975f-10b94bf45b28", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695538819, "uuid": "75961b41-ed7c-4a97-8745-676fcc4214ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695538819, "uuid": "3cfd24f2-d613-4c53-9d7d-92d7732dc873", "value": "bc8614702b1e5798a24f45c8b08faec6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b9face-5ab4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695544129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695544129, "uuid": "0ab48b5b-228b-49a2-aadb-0b7d6b68f8c7", "comment": "Malware payload (MysticStealer)", "value": "9ef1baef01154da549b3e3c84a49ef79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695544129, "uuid": "9c198fae-bb0b-47c0-a5d9-010b0e136dd5", "comment": "Malware payload (MysticStealer)", "value": "eb24bc4aed498450dd91873db7832cd33be36a94c32d4fb049bd334ab0a4a5ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695544129, "uuid": "2b21ecae-5a8f-4aa5-bd21-a2184c3fa186", "comment": "Malware payload (MysticStealer)", "value": "f3f7a87d2c26c50ed6e8602dffa805f2d8b624ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695544129, "uuid": "dc34f998-98cb-49e4-9fc5-d38c6cdf81b9", "comment": "Malware payload (MysticStealer)", "value": "c1293920621e08779690bba5ccf473c4a3c354805d60fa25a6c3c736e8f6e0168e41e193373ccc4066004bb0c94b9bb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695544129, "uuid": "4c401b8d-8859-4bf4-ac21-39db4a4b7a50", "value": "T1B084C041F5B088B1D87212F108E0A6754EB9FA3C2B314EF763C41E7E4E68681B579A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695544129, "uuid": "9bcb9733-7267-4b4a-9e96-83eebc9ef196", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695544129, "uuid": "51c43a5f-7f38-41d1-a26a-3a7b1164ce40", "value": "6144:cp46fuYXChoQTjlFgLuCY1dRuAOUiXZzLFU49WXyuJJX6OLsiRas8jzyy+Q3w8y0:ceYzXChdTbv1bulXVLS49W1JJNRhwqQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695544129, "uuid": "42bb1a25-63bd-44a7-b103-26ce0e33d2f3", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695544129, "uuid": "5b237b13-55b1-46c6-b37f-18e3d4f10d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695544129, "uuid": "6b37c7d1-730b-4e5c-8942-c7afbc42d029", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.27945.3628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7268dc00-5a9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695533418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533418, "uuid": "62f0886c-f56d-48f8-8aac-be71eb0737aa", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c943716e9355b12aa348bcd80d51ea25", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533418, "uuid": "c04c221f-1d32-4b40-91e7-4e807c2df475", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ebaa5e1d375254fcecd2725d6dff4cfc63a054060fc04921577ecaa1d70947f6", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533418, "uuid": "458d196e-1b4c-461c-ab61-3d295a0e4213", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3c0bdf3974bbd6ac2ed8b50ccab9697041e2109b", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533418, "uuid": "8ac5cf44-5b32-40ac-9356-a881e3c9d568", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "4a3542c684c65309f4192db89cdd8b65eff48e54805309b2ae0dbe62b1054e8f1e1c2ac7910b0c5da159d8ad9f78f1f6", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533418, "uuid": "8dd121e0-0829-42ca-904f-f8841ea94ea0", "value": "T1F8349D01B5E18472D472153209F0BBB65A3DB9600B51D9EFA7D40F7E8F306C1A636AEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533418, "uuid": "734f74ba-fa64-4344-b936-d29299a7aa79", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533418, "uuid": "7b391bc8-75f4-4693-b93a-c9a4106adae8", "value": "6144:or46fuYXChoQTjlFgLuCY1dRuAOGlZw8y0:o0YzXChdTbv1buOw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695533418, "uuid": "40a7ca14-8ee8-40f0-8f83-590dd636719f", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695533418, "uuid": "b39bbe1d-14b9-4c1f-8e4b-ee6a41b98f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533418, "uuid": "e60eec3f-8efa-4288-8a24-1f51cb352bf8", "value": "c943716e9355b12aa348bcd80d51ea25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc87aaa-5a9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695534618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695534618, "uuid": "6a42346f-d197-4af8-831f-b8e2791f79a6", "comment": "Malware payload (RedLineStealer)", "value": "6e72b25bb52e9ac5b74c9bb02d194ddc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695534618, "uuid": "a7e7cd78-424d-431d-a5b9-9479b8533fb2", "comment": "Malware payload (RedLineStealer)", "value": "ebb95f160718dc7c84274fad3879a5b02d3944a84374d9c5a7df877c4e52655a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695534618, "uuid": "34544a7a-5539-44ce-94f3-aeeb81d6ec76", "comment": "Malware payload (RedLineStealer)", "value": "b2c135578fa9b017927c9939570ed21d670d67af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695534618, "uuid": "05ae0119-67b5-45f9-8400-166e0a05ccf7", "comment": "Malware payload (RedLineStealer)", "value": "884dfae74c8bc33e24009953c8a20b954a6807171f0c39eb2f86bbf3316dabeee94f15b2f16ef19c177873c6baa526a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695534618, "uuid": "974f257b-5088-4240-bf94-c4628346a3e5", "value": "T146349E0175D18472D47214B209F0EBBA5A3DB9700B518DEFA7D40F7EAF302C1A636A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695534618, "uuid": "50bb8dc1-6c8b-45e1-87ef-c778cbdf51d8", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695534618, "uuid": "4e87a56a-8133-406b-bffc-6fff89999e8e", "value": "6144:Pt146fuYXChoQTjlFgLuCY1dRuAOz95w8y0:1CYzXChdTbv1buBw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695534618, "uuid": "eb0a36f4-77d8-4832-a430-6b853437395c", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695534618, "uuid": "1edf1df5-b56a-4f39-9cc8-4e9058546bd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695534618, "uuid": "8253db78-1211-46fe-9329-19af10482132", "value": "6e72b25bb52e9ac5b74c9bb02d194ddc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e466d9e-5a9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695533679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533679, "uuid": "7edd0e9d-1a43-41e6-8465-80db9cc46805", "comment": "Malware payload", "value": "637a518aecb935f3b0b8e5f8d0b4aff9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533679, "uuid": "7a00c3fc-37c1-4cd0-8cba-a6a4c73a3d82", "comment": "Malware payload", "value": "ed4b05aa35f2b5b2c976bbb65d5a2079f6ab6bb166b517bec3b02470d35e4d9e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533679, "uuid": "6d265877-6eea-4d96-8efe-5f425384fdfe", "comment": "Malware payload", "value": "791e5cdddf0daf20dec3a2908b9e73e28a751e0c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695533679, "uuid": "0f02c6f9-5c07-4e8d-be43-5707ba928e70", "comment": "Malware payload", "value": "0db06595c06b005d1cc4860da7730e2326ec8b2cadbc54ca3ce72351a6dd558135641f5373640043303b6673e62b0d5f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533679, "uuid": "1a1305c3-4e08-4d5e-830f-ebdbb3a6027d", "value": "T150672311B5C2C432E5BF15301E3AEB6946BA7C604F71C0EB63E86A1E1F729D19631B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533679, "uuid": "2c430e08-0285-4cff-a2ac-45f7afb4bf28", "value": "786432:6p3+BQd37a3AUBWyuIaWp8SOkbWyLMc6zWY:6puG1UAU0yuFW3OkbPLM3WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695533679, "uuid": "31aa9605-2e78-44ce-89cb-120bda810eac", "value": 30266880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695533679, "uuid": "7d1a2450-89b9-4378-aacc-1076f313dd89", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695533679, "uuid": "78870f9e-4cad-4e34-80d8-e74cd705c517", "value": "FeedandGrowFish_installer_39402443.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1e4071-5afa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695574208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574208, "uuid": "5e8b3aaa-6465-4170-a271-9f6880931be0", "comment": "Malware payload (Mirai)", "value": "1725aa07d2ce4e09efe739f62998c63e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574208, "uuid": "4d5aff2e-37fd-4d6e-99fb-9973be3e9594", "comment": "Malware payload (Mirai)", "value": "ef706cedd2222c021e19dc1776285680f312ab415066c66a05c89297a01f9658", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574208, "uuid": "e065b251-316c-4db8-b6db-e5c8fbbb0a22", "comment": "Malware payload (Mirai)", "value": "4653a758936ec2848ca1a4dbd8d67a1d538c0962", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574208, "uuid": "87f3e135-4010-4bba-9589-2cbf4b9232c4", "comment": "Malware payload (Mirai)", "value": "8487a829bc4e6fb43a7811f5932972ee55e0660b32109b7e75135e223d0b87ed92647e64951aeebb19476dc162442284", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695574208, "uuid": "3dcba64a-04e7-4e0c-ac25-2757fc527674", "value": "T13FA2E01172532D66F3ED2C3DC9AA835BF9661BFC90F5327679416620C94D20A3E38A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695574208, "uuid": "e655bf49-fc42-4d4a-81c6-5e56c6cc579c", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj/dhymdGUop5hB:vvQn4j+ZO5fKAlxxs3Uoz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695574208, "uuid": "2e0438e4-ca69-42d5-8d57-fb02a51b75b3", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695574208, "uuid": "cd95f032-1012-42d9-9929-a6acfee47d2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695574208, "uuid": "2771c40c-4ed9-408b-93d8-e05edca97f4e", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0474f81-5ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695559828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559828, "uuid": "da9cae26-1dfa-4a09-ba6a-23ffda2520a7", "comment": "Malware payload (RedLineStealer)", "value": "225e2fd1d8b5da38d8a394ae16f3dbbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559828, "uuid": "2d3af5c9-49c9-4587-9aca-9eee38b027a1", "comment": "Malware payload (RedLineStealer)", "value": "f0a743de78f9b72a37b9a4c90899646cb65ce9df4a070284ca83b5ca6636f719", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559828, "uuid": "e5bffb1e-40ca-4e43-ab13-d74b6fa2b66c", "comment": "Malware payload (RedLineStealer)", "value": "ca3dab7e9726692d91c31c4ecaf0bda980935039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695559828, "uuid": "3fb5ce50-5ba6-42d3-b22d-048c3e270e49", "comment": "Malware payload (RedLineStealer)", "value": "46889b74fec9826cc34a81ae0c0ff35f5ae64be800b5361a273c5598c9524c9653ee8abe415d052ac64bbb8cc0e3e683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695559828, "uuid": "d4c7b226-80ad-48d9-8687-c2682d2ef9f1", "value": "T17C349E01B4D1C472D472253209F0EBB65A3FB9700B6199EFA7D40F7E4F216C1E636A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695559828, "uuid": "70d5a170-d156-42a5-b506-334309531a63", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695559828, "uuid": "c7a1d2d6-4d84-44a1-ba81-ace63700a5df", "value": "6144:Pq446fuYXChoQTjlFgLuCY1dRuAOMTstx8w8y0:SJYzXChdTbv1bu++x8w8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695559828, "uuid": "a92b4ed6-a429-4997-ad8e-1bca4b2b327b", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695559828, "uuid": "50c1a933-196c-4f50-83b8-725bfa9b59a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695559828, "uuid": "e2bd4bf2-63a0-4e0b-a70e-20cef4506b6c", "value": "225e2fd1d8b5da38d8a394ae16f3dbbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9380bc5d-5a8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695526172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526172, "uuid": "6ccf1b06-cc5a-4e9e-a36b-9bda76e4aa1b", "comment": "Malware payload (Smoke Loader)", "value": "a2c45383ee874ecfe28bc3c7b694e728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526172, "uuid": "6071e2df-d378-4d56-9430-314a3f5f68c6", "comment": "Malware payload (Smoke Loader)", "value": "f458d5f6d2b95c3c79dc44e200e7d60df06653ec29aee11a961e16a55a8b5a3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526172, "uuid": "d1e75892-bd96-4ea7-b0f3-67af9fd42356", "comment": "Malware payload (Smoke Loader)", "value": "29c1b06b94767b7fdbf83447d4b01207e5d72c9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695526172, "uuid": "545aaf08-6f95-48d9-b45e-40748548dcce", "comment": "Malware payload (Smoke Loader)", "value": "e3be27b98c73192892a60a4d6bb60fcaf9df3161cb42bbb7195036b232112324bec2c17b9de9430893916a1c0b0e0523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526172, "uuid": "507a2297-b623-41ec-9111-134bcd8e03e2", "value": "T154349D01B4D18472D47215320AF4EFB65A3DB9610B629DEFA7D40F3E8F206C19636A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526172, "uuid": "03c78b14-5689-4b41-9b28-02515ae3322b", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526172, "uuid": "544a0f7b-b131-4788-926c-dd359a7d9852", "value": "6144:YY46fuYXChoQTjlFgLuCY1dRuAOGakN/MaMw8y0:YpYzXChdTbv1buokxw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695526172, "uuid": "fff9cc2f-44b5-4271-9e54-7eeaaa2091e9", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695526172, "uuid": "41012996-d9a9-4eed-9661-e6dfb87f7497", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695526172, "uuid": "d88e4469-2a3f-4b5a-af36-dfdd77c137b4", "value": "SecuriteInfo.com.Trojan.KillProc2.21513.29360.23916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8b618e-5b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695585004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695585004, "uuid": "24d06b50-7b6f-472a-a450-e916676835c5", "comment": "Malware payload (Mirai)", "value": "de007d83348a174e5b746cca225cd0bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695585004, "uuid": "3367f389-d6da-4dca-8bc1-3deff09d236a", "comment": "Malware payload (Mirai)", "value": "f6db2428ba0b7d6ca024e89a82136651fe9f8030d6f8a97524bf6dd67155b19c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695585004, "uuid": "7e426739-d01e-4245-9f72-9a830049ef7d", "comment": "Malware payload (Mirai)", "value": "f934ca551c4522ae6b7afcf4f2ce209967fa80d5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695585004, "uuid": "1a999c6e-feb8-4e5a-840c-e5d4e75108e5", "comment": "Malware payload (Mirai)", "value": "22d70422a3f57b94b8a94a9bdba5cd9fc8c14b8dd97287c1e8680b7305c22c26f844dba26e3fa89e622d001558c24738", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695585004, "uuid": "7f585d34-38d9-4ddb-86d3-8b38c23e578f", "value": "T112E35C46EA808E03C0D61776BAAF424A33239754D3DB73069D28AFB43F87B5E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695585004, "uuid": "2c06269b-972e-4a58-a844-6d8b7401d36c", "value": "3072:axVkUpt32KLa1Ug2uIOflkD//jts/EE38xGM/911of:kV/pV/La1Ug2u5kDRAEE38sM/91Cf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695585004, "uuid": "e3442fd7-01df-4696-bfae-18b8ac53ffeb", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695585004, "uuid": "824c3902-6b30-45bd-a8b8-1b3ae5d76014", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695585004, "uuid": "00e82bf6-e67b-4020-affc-699723ea5de1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1ff834-5a73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695516313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695516313, "uuid": "414db0b0-807b-420a-bd8e-f0ee366c9b46", "comment": "Malware payload (RedLineStealer)", "value": "adcc66edac3435337462e6dfe62b572e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695516313, "uuid": "9a9f5f34-f19c-463c-8413-04bf5dde8bbd", "comment": "Malware payload (RedLineStealer)", "value": "f6e4e507c58b29c405b98d90f85fe673a56743a8d7a1bd1f371a8d491000cb73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695516313, "uuid": "2cb098cd-5368-452c-8b72-e3724aa47242", "comment": "Malware payload (RedLineStealer)", "value": "f5ef299eab18ed07fca463d0619ef2d80f274b1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695516313, "uuid": "f3daee15-1eaf-4f5c-9ca2-2786bde4ce3f", "comment": "Malware payload (RedLineStealer)", "value": "3858813bd2ac3b2f552e7e9f719da2bca87b4525e25b96eeae8cdeb102cb8af7d9a30e8408ef81b3db942012a0b5c67a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695516313, "uuid": "808df10b-7ba7-4096-9d96-e170d15d2d31", "value": "T1D6349D8174D1C472D472153389F0EFB65A3EB9600B619DEFA7D40F7E8F206C1A631A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695516313, "uuid": "988921dd-b7de-4ddc-88f8-9ccbcc88d152", "value": "383ebf01ac19979467e97d3debc83542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695516313, "uuid": "b79bb6e7-6823-46aa-a496-4849b5a6764b", "value": "6144:ySV46fuYXChoQTjlFgLuCY1dRuAOMAcZ3EOdw8y0:yhYzXChdTbv1buTczw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695516313, "uuid": "bce5781a-de99-4348-a030-1a1ff6074fc1", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695516313, "uuid": "e6ef1c31-3ddc-48a5-915a-3cb29c485a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695516313, "uuid": "eeaa53f2-f421-4978-acb0-2d82940adc44", "value": "adcc66edac3435337462e6dfe62b572e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d29b5e-5abf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695549026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549026, "uuid": "1c5b5e49-9717-4842-88ee-f8fcf9444aab", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9871fa3afbc32412b38fe669a9750d41", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549026, "uuid": "a89cd51f-1358-4bf7-9dd3-ab74a54a377a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f85f279eb9593be0d62a7adf93606a89d76993942cfc9127586db0ae218cad9b", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549026, "uuid": "038a5987-c5e2-4fdd-bf6c-0f48e0c64433", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "33cdc5e27324db9aa5adc8c5f7ec12da9e9714fe", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549026, "uuid": "98b2d72e-b7db-4b6e-83c9-9823d867a0c1", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "5696f1f6df8673535ab0c308c3a334f9a2cf9381860f3f952fa6c5c1a33ab46c58443c4249e45baf2e716578087fb005", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549026, "uuid": "c101af07-dc06-412d-a1b6-35652914bf41", "value": "T14E552393E6D98033E9B427704CF303931A7678936A60832717A6D81D59B3BC1B67476F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549026, "uuid": "ef0967d6-cbe9-491d-9360-ff8ff9a8edb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549026, "uuid": "52dd2519-fb09-4f60-b5ff-4145d55bc031", "value": "24576:myz8UisYqM/7a+MVS/36YoO5zH5DVmeJI6Xh2EIcoJdEM+:1I2TM/7dMSSz4zNNIe0EIPJdEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695549026, "uuid": "d5128d3d-dd4d-4a0d-bb25-4a998680e146", "value": 1294848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695549026, "uuid": "e9c43109-bb3e-4bcd-b798-a78d441a3624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549026, "uuid": "561df31f-ec18-419d-a0e3-f6b752af7604", "value": "9871fa3afbc32412b38fe669a9750d41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a33a946-5afa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695574206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574206, "uuid": "555487e1-4a91-4716-80d7-1a1af7c64c26", "comment": "Malware payload (Mirai)", "value": "16fbbc453c113f547514e827e3145c71", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574206, "uuid": "1bdd324e-9ba9-4d48-856f-996fbd5b87a3", "comment": "Malware payload (Mirai)", "value": "f8bc63428a2d49e6703a62585c01c70247c5e7c8ecb95c4fdd147a25317776fc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574206, "uuid": "afbee337-e2de-467f-89ea-c50e104e4f4d", "comment": "Malware payload (Mirai)", "value": "34a26231a1ba07882e5b3759e8e982a5a5e11e1c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695574206, "uuid": "73b88540-a6c3-454f-a8b7-fee9251ef9ae", "comment": "Malware payload (Mirai)", "value": "eec870f71879651bfcae70329e78bd523cc516976b166f307e03325c3cc2db821f2507e016ddbcc4621458604df30736", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695574206, "uuid": "a5885d15-449a-413e-8613-098b9d9102b4", "value": "T1ED230271890E9EF114303C72DBD9D393B6E11AB1C6673013D6280A3C6FB5A231E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695574206, "uuid": "471ebd5e-fd7e-48ea-866f-4a695a7fa65c", "value": "768:5/TYCoIxdEk+AxoTZAZHFeq8b3ik9q3UELbUXfi6nVMQHI4vcGpv0:5ECFd+A6YHAxiNLRQZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695574206, "uuid": "420b352f-b263-46bb-be35-987384a380ce", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695574206, "uuid": "d9250e75-bc87-4033-9c9d-8f66ed487853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695574206, "uuid": "ecfd78a2-7008-40e6-a5f3-18f73ee40633", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce6f1d0-5ac0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695549327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549327, "uuid": "3ecc9a15-bbd3-45db-af99-cdf8093d029c", "comment": "Malware payload (RedLineStealer)", "value": "a22e2f119e5a6e81e6f839d50e173e33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549327, "uuid": "5ed292cb-7359-4fb0-983c-602f1be95487", "comment": "Malware payload (RedLineStealer)", "value": "f9c83998bb134428e81fa8f17dd5f1670901d343661268ba3457ab6c04dc36c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549327, "uuid": "234ce330-72d4-467e-93ab-45f54c7b5522", "comment": "Malware payload (RedLineStealer)", "value": "2cbccd8a9f7337748a8c72877327d3654bebc01c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695549327, "uuid": "9ebfdc70-a5bb-49e4-a6fd-87d4db3ced18", "comment": "Malware payload (RedLineStealer)", "value": "5b550bca44224ee07a2c22c6872fdcbedbcbe96fc893cd5239195adecf570191dd0b0cd23f4582e9fa14a0a7ebb26c1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549327, "uuid": "eefca98e-d965-4eb1-b76b-71ce419101d5", "value": "T125158D2139C49172EEE320B787ECBA3642ADE4F4071556CF06D857EED6606C27F32686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549327, "uuid": "ed0e7dbe-6562-4dda-bf50-5e6cacebca9a", "value": "275c1ac8a0a90e452d90c6b023f705b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549327, "uuid": "73a57811-1b27-49f1-ae7a-67372bec32fc", "value": "12288:eoeYdPenqp953bJ205YDfo8oBNFJIxyTTrrKuLpv+K2DyOpv5:WAPenqp953befo8Un9TvrGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695549327, "uuid": "f503ac81-23c8-4866-8632-c63272f7ccae", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695549327, "uuid": "5ef72a5c-673c-4fcb-af10-e7b3926b04a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695549327, "uuid": "835db63a-acf7-42fb-a2f5-c1d1c585f73d", "value": "a22e2f119e5a6e81e6f839d50e173e33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31bbcae7-5acd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695554784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554784, "uuid": "cba8e9ce-a894-4997-9b78-29cad01547f1", "comment": "Malware payload (Mirai)", "value": "ea1e47835937fedd3ff9f3a0b318cead", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554784, "uuid": "244e1b43-5966-4a06-b5bb-9ec05d6c4522", "comment": "Malware payload (Mirai)", "value": "fa3e377404a8ae3a2c73e91d01335b824130a54cd13fc8e8a51c24912054a519", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554784, "uuid": "5eebdea3-9aaa-461a-aaef-5479e8663dd5", "comment": "Malware payload (Mirai)", "value": "2fdf6a16fc0c7ba564347e550ba63ea61fc708df", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695554784, "uuid": "0e8a70b5-825f-460a-a66f-520f99f252af", "comment": "Malware payload (Mirai)", "value": "524a7ae5f8988590012cacc75f4d600a7cf48d104d7e793fef627f50e6b1a9bd6a4c1433f11925429f5f5402f934c8a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695554784, "uuid": "9fcd1f56-d966-4041-a3c6-9c740fca3b53", "value": "T1BC530949BD929A22CAD1157BFB0E438D372A639CD2ED3303DA295F6177CF55B0E2A101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695554784, "uuid": "d195ef95-7f76-4f7e-aa58-e304a12e23eb", "value": "1536:ANHIeYm0xpgiE0/CgL4UNF11qTy2W5ncpPCwYE:ANEmcgi/CgjNFDqu5nZwYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695554784, "uuid": "db66e155-9cb9-4853-abbf-17cae0b79ba2", "value": 62760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695554784, "uuid": "b401b5c4-e488-4d0b-aa42-75c667b32a08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695554784, "uuid": "ebdf1e57-53ab-4ff2-81c5-18a916be1b2e", "value": "skid.arm5-20230924-1126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827430df-5ab2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695543323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695543323, "uuid": "fa04d09b-ca35-4ebc-91e9-42f3314c3869", "comment": "Malware payload (RedLineStealer)", "value": "aaef11f9c446555dd43348b1986bed70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695543323, "uuid": "13fdadbd-0f48-40fd-86ec-2c796e2c85d0", "comment": "Malware payload (RedLineStealer)", "value": "fce70f2a6b4c4e9aecbd10ff68e495e45861b7e86038517a8c17bc0c7369ab12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695543323, "uuid": "042fc089-a8be-44d0-883e-3bb202f902dd", "comment": "Malware payload (RedLineStealer)", "value": "c3a09f80477b8d44a2428d9ba6a28aad3d6fb5d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695543323, "uuid": "afc75182-7dec-4d55-9f40-5a49f90af518", "comment": "Malware payload (RedLineStealer)", "value": "dd194d4111fe2c5f5e60e47d59082e46521e06f791566dcb67f686ccdaa74537c94f612235c0ae95e71f6ab10201b6c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695543323, "uuid": "1f312bf0-f70b-4ef4-9454-a2f605a335a8", "value": "T134152303A9E91533D9B29B701CF60A870B367C910E39D75B7386CD9768B2844DA3673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695543323, "uuid": "41d6f192-cb80-43b5-9f7a-56f825edcf6c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695543323, "uuid": "fb9f5579-15c9-4d2f-9fc3-43894a7444f0", "value": "24576:cykZBejNIVO7uGtpLqwspJ1fI+IVsstT3a:LwdVal3mnBIKstj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695543323, "uuid": "bd182620-d092-4fc7-aeee-b110604879bf", "value": 955904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695543323, "uuid": "dfc91ad5-e031-4414-a58c-da6736e263f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695543323, "uuid": "0a8b1084-1bbe-4906-9918-00bb3f9f912c", "value": "aaef11f9c446555dd43348b1986bed70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }